-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[CORE-438 CORE-439] added test examples #41
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,147 @@ | ||
# Versions | ||
terraform { | ||
required_providers { | ||
aws = { | ||
source = "hashicorp/aws" | ||
} | ||
} | ||
required_version = ">= 1.0" | ||
} | ||
|
||
# Data | ||
data "aws_route53_zone" "root" { | ||
name = "${var.root_domain_name}." | ||
private_zone = false | ||
} | ||
|
||
# Main | ||
module "vpc" { | ||
source = "registry.terraform.io/terraform-aws-modules/vpc/aws" | ||
version = "~> 3.0" | ||
|
||
name = "${var.env}-vpc" | ||
cidr = "10.0.0.0/16" | ||
|
||
azs = [ | ||
"${var.aws_region}a", | ||
"${var.aws_region}b" | ||
] | ||
public_subnets = [ | ||
"10.0.10.0/23", | ||
"10.0.12.0/23" | ||
] | ||
|
||
private_subnets = [ | ||
"10.0.20.0/23" | ||
] | ||
manage_default_network_acl = true | ||
default_network_acl_name = "${var.env}-${var.namespace}" | ||
} | ||
resource "aws_security_group" "default_permissive" { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Ensure Security Groups are attached to EC2 instances or ENIs
|
||
name = "${var.env}-default-permissive" | ||
vpc_id = module.vpc.vpc_id | ||
|
||
ingress { | ||
protocol = -1 | ||
from_port = 0 | ||
to_port = 0 | ||
cidr_blocks = [ | ||
"0.0.0.0/0" | ||
] | ||
} | ||
|
||
egress { | ||
protocol = -1 | ||
from_port = 0 | ||
to_port = 0 | ||
cidr_blocks = [ | ||
"0.0.0.0/0" | ||
] | ||
} | ||
|
||
} | ||
|
||
resource "aws_route53_record" "env_ns_record" { | ||
zone_id = data.aws_route53_zone.root.id | ||
name = "${var.env}.${var.root_domain_name}" | ||
type = "NS" | ||
ttl = "60" | ||
records = aws_route53_zone.env_domain.name_servers | ||
} | ||
|
||
resource "aws_route53_zone" "env_domain" { | ||
name = "${var.env}.${var.root_domain_name}" | ||
} | ||
|
||
module "env_acm" { | ||
source = "registry.terraform.io/terraform-aws-modules/acm/aws" | ||
version = "~> 4.0" | ||
|
||
domain_name = "${var.env}.${var.root_domain_name}" | ||
|
||
subject_alternative_names = [ | ||
"*.${var.env}.${var.root_domain_name}" | ||
] | ||
|
||
zone_id = aws_route53_zone.env_domain.id | ||
|
||
tags = { | ||
Name = "${var.env}.${var.root_domain_name}" | ||
} | ||
} | ||
|
||
module "ecs" { | ||
source = "registry.terraform.io/terraform-aws-modules/ecs/aws" | ||
version = "~> 4.0" | ||
cluster_name = "${var.env}-${var.namespace}" | ||
} | ||
|
||
module "tcp_app" { | ||
source = "../.." | ||
|
||
name = "tcpapp" | ||
app_type = "tcp-app" | ||
env = var.env | ||
namespace = var.namespace | ||
|
||
# Containers | ||
ecs_cluster_name = module.ecs.cluster_name | ||
docker_registry = var.docker_registry | ||
docker_image_tag = var.docker_image_tag | ||
|
||
# Load Balancer | ||
public = true | ||
https_enabled = true | ||
tls_cert_arn = local.tls_cert_arn | ||
|
||
port_mappings = [ | ||
{ | ||
container_port = 4442 | ||
host_port = 4442 | ||
}, | ||
{ | ||
container_port = 4443 | ||
host_port = 4443 | ||
}, | ||
{ | ||
container_port = 4444 | ||
host_port = 4444 | ||
tls = true | ||
} | ||
] | ||
|
||
# Network | ||
vpc_id = module.vpc.vpc_id | ||
public_subnets = module.vpc.public_subnets | ||
private_subnets = module.vpc.private_subnets | ||
security_groups = [aws_security_group.default_permissive.id] | ||
root_domain_name = var.root_domain_name | ||
zone_id = aws_route53_zone.env_domain.id | ||
|
||
# Environment variables | ||
app_secrets = [ | ||
] | ||
environment = { | ||
} | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
output "vpc_cidr" { | ||
value = module.vpc.vpc_cidr_block | ||
} | ||
|
||
output "private_subnet_cidrs" { | ||
value = module.vpc.private_subnets_cidr_blocks | ||
} | ||
|
||
output "cloudwatch_log_group" { | ||
value = module.tcp_app.cloudwatch_log_group | ||
} | ||
|
||
output "ecs_cluster_name" { | ||
value = module.ecs.cluster_name | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
locals { | ||
tls_cert_arn = length(module.env_acm.acm_certificate_arn) > 0 ? module.env_acm.acm_certificate_arn : null | ||
} | ||
|
||
variable "env" {} | ||
variable "namespace" {} | ||
variable "aws_profile" {} | ||
variable "aws_region" {} | ||
variable "docker_registry" {} | ||
variable "docker_image_tag" {} | ||
variable "root_domain_name" {} |
This file was deleted.
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,123 @@ | ||
# Versions | ||
terraform { | ||
required_providers { | ||
aws = { | ||
source = "hashicorp/aws" | ||
} | ||
} | ||
required_version = ">= 1.0" | ||
} | ||
|
||
# Data | ||
data "aws_route53_zone" "root" { | ||
name = "${var.root_domain_name}." | ||
private_zone = false | ||
} | ||
|
||
# Main | ||
module "vpc" { | ||
source = "registry.terraform.io/terraform-aws-modules/vpc/aws" | ||
version = "~> 3.0" | ||
|
||
name = "${var.env}-vpc" | ||
cidr = "10.0.0.0/16" | ||
|
||
azs = [ | ||
"${var.aws_region}a", | ||
"${var.aws_region}b" | ||
] | ||
public_subnets = [ | ||
"10.0.10.0/23", | ||
"10.0.12.0/23" | ||
] | ||
|
||
private_subnets = [ | ||
"10.0.20.0/23" | ||
] | ||
manage_default_network_acl = true | ||
default_network_acl_name = "${var.env}-${var.namespace}" | ||
} | ||
resource "aws_security_group" "default_permissive" { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
|
||
name = "${var.env}-default-permissive" | ||
vpc_id = module.vpc.vpc_id | ||
|
||
ingress { | ||
protocol = -1 | ||
from_port = 0 | ||
to_port = 0 | ||
cidr_blocks = [ | ||
"0.0.0.0/0" | ||
] | ||
} | ||
|
||
egress { | ||
protocol = -1 | ||
from_port = 0 | ||
to_port = 0 | ||
cidr_blocks = [ | ||
"0.0.0.0/0" | ||
] | ||
} | ||
|
||
} | ||
|
||
resource "aws_route53_record" "env_ns_record" { | ||
zone_id = data.aws_route53_zone.root.id | ||
name = "${var.env}.${var.root_domain_name}" | ||
type = "NS" | ||
ttl = "60" | ||
records = aws_route53_zone.env_domain.name_servers | ||
} | ||
|
||
resource "aws_route53_zone" "env_domain" { | ||
name = "${var.env}.${var.root_domain_name}" | ||
} | ||
|
||
module "ecs" { | ||
source = "registry.terraform.io/terraform-aws-modules/ecs/aws" | ||
version = "~> 4.0" | ||
cluster_name = "${var.env}-${var.namespace}" | ||
} | ||
|
||
module "web_complete" { | ||
source = "../.." | ||
|
||
name = "app" | ||
app_type = "web" | ||
env = var.env | ||
namespace = var.namespace | ||
|
||
# Containers | ||
cpu = 1024 | ||
memory = 2048 | ||
operating_system_family = "WINDOWS_SERVER_2019_CORE" | ||
ecs_cluster_name = module.ecs.cluster_name | ||
docker_registry = var.docker_registry | ||
docker_image_tag = var.docker_image_tag | ||
|
||
# Load Balancer | ||
public = true | ||
https_enabled = false | ||
alb_health_check_path = "/" | ||
alb_security_groups = [aws_security_group.default_permissive.id] | ||
|
||
# EFS settings | ||
efs_enabled = false | ||
efs_mount_point = "/mnt/efs" | ||
efs_root_directory = "/" | ||
|
||
# Network | ||
vpc_id = module.vpc.vpc_id | ||
public_subnets = module.vpc.public_subnets | ||
private_subnets = module.vpc.private_subnets | ||
security_groups = [aws_security_group.default_permissive.id] | ||
root_domain_name = var.root_domain_name | ||
zone_id = aws_route53_zone.env_domain.id | ||
|
||
# Environment variables | ||
app_secrets = [ | ||
] | ||
environment = { | ||
} | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
output "vpc_cidr" { | ||
value = module.vpc.vpc_cidr_block | ||
} | ||
|
||
output "private_subnet_cidrs" { | ||
value = module.vpc.private_subnets_cidr_blocks | ||
} | ||
|
||
output "cloudwatch_log_group" { | ||
value = module.web_complete.cloudwatch_log_group | ||
} | ||
|
||
output "ecs_cluster_name" { | ||
value = module.ecs.cluster_name | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
variable "env" {} | ||
variable "namespace" {} | ||
variable "aws_profile" {} | ||
variable "aws_region" {} | ||
variable "docker_registry" {} | ||
variable "docker_image_tag" {} | ||
variable "root_domain_name" {} |
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID:
BC_AWS_NETWORKING_2
How to Fix
Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks