-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #30 from Worklytics/rc-v0.4.48
update to v0.4.48
- Loading branch information
Showing
5 changed files
with
183 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
|
|
||
| # uncomment to use encryption for S3 buckets and have it work properly for Cloud Watch Logs | ||
|
|
||
| # this file sets up necessary stuff for S3 custom encryption (as opposed to AWS default) with a | ||
| # architecture style that is more 'proper' Terraform - eg, composition of resources. | ||
|
|
||
| #resource "aws_kms_key" "example_key" { | ||
| # description = "key for encrypting S3 buckets" | ||
| #} | ||
| # | ||
| # | ||
| # | ||
| #locals { | ||
| # key_arn = aws_kms_key.example_key.arn # alternatively, use ar.project_aws_kms_key_arn | ||
| # | ||
| # # TODO: can eliminate this if test tool doesn't assume role when uploading to bucket | ||
| # testing_policy_statements = var.provision_testing_infra ? [ | ||
| # { | ||
| # "Sid": "Allow Test Users to Use Key", | ||
| # "Effect": "Allow", | ||
| # "Principal": { # tests | ||
| # "AWS": "arn:aws:iam::${var.aws_account_id}:role/${module.psoxy.caller_role_name}" | ||
| # }, | ||
| # "Action": "kms:*", | ||
| # "Resource": local.key_arn | ||
| # } | ||
| # ] : [] | ||
| # | ||
| # # S3 bucket policy statements for bulk writer instances | ||
| # # explicitly allow each instance's exec role to use the key to encrypt, as it needs to write to | ||
| # # the output buckets | ||
| # bulk_writer_policy_statements = [ | ||
| # for instance in module.psoxy.bulk_connector_instances : { | ||
| # "Effect" : "Allow", | ||
| # "Principal" : { | ||
| # "AWS" : instance.instance_role_arn | ||
| # }, | ||
| # "Action" : [ | ||
| # "kms:Encrypt", | ||
| # "kms:GenerateDataKey", | ||
| # ], | ||
| # "Resource" : local.key_arn | ||
| # } | ||
| # ] | ||
| # # for bulk case, proxy caller role must be able to READ from the sanitized buckets, requiring | ||
| # # decrypt permission for the key | ||
| # proxy_caller_policy_statements = [ | ||
| # for instance in module.psoxy.bulk_connector_instances : { | ||
| # "Effect" : "Allow", | ||
| # "Principal" : { | ||
| # "AWS" : module.psoxy.caller_role_arn | ||
| # }, | ||
| # "Action" : [ | ||
| # "kms:Decrypt", | ||
| # ], | ||
| # "Resource" : aws_kms_key.example_key.arn | ||
| # } | ||
| # ] | ||
| #} | ||
| # | ||
| #resource "aws_kms_key_policy" "proxy" { | ||
| # key_id = local.key_arn | ||
| # policy = jsonencode( | ||
| # { | ||
| # "Version" : "2012-10-17", | ||
| # "Id" : "proxy-key-policy", | ||
| # "Statement" : concat( | ||
| # [ | ||
| # # to allow Terraform to manage the key | ||
| # { | ||
| # "Sid": "Allow IAM Users to Manage Key", | ||
| # "Effect": "Allow", | ||
| # "Principal": { | ||
| # "AWS": "arn:aws:iam::${var.aws_account_id}:root" | ||
| # }, | ||
| # "Action": "kms:*", | ||
| # "Resource": local.key_arn | ||
| # }, | ||
| # # to use for Cloud Watch Logs | ||
| # { | ||
| # "Effect" : "Allow", | ||
| # "Principal" : { | ||
| # "Service" : "logs.${var.aws_region}.amazonaws.com" | ||
| # }, | ||
| # "Action" : [ | ||
| # "kms:Encrypt", | ||
| # "kms:Decrypt", | ||
| # "kms:ReEncrypt", | ||
| # "kms:GenerateDataKey", | ||
| # "kms:Describe" | ||
| # ], | ||
| # "Resource" : local.key_arn | ||
| # } | ||
| # ], | ||
| # local.bulk_writer_policy_statements, | ||
| # local.testing_policy_statements, | ||
| # local.proxy_caller_policy_statements | ||
| # ) | ||
| # }) | ||
| #} | ||
| # | ||
| ## concisely set S3 encryption for all buckets | ||
| #resource "aws_s3_bucket_server_side_encryption_configuration" "bulk_buckets" { | ||
| # for_each = merge( | ||
| # { for k, v in module.psoxy.bulk_connector_instances: "${k}_input" => v.input_bucket } , | ||
| # { for k, v in module.psoxy.bulk_connector_instances: "${k}_sanitized" => v.sanitized_bucket } , | ||
| # module.psoxy.lookup_output_buckets, | ||
| # ) | ||
| # | ||
| # bucket = each.value | ||
| # | ||
| # rule { | ||
| # apply_server_side_encryption_by_default { | ||
| # kms_master_key_id = aws_kms_key.example_key.id | ||
| # sse_algorithm = "aws:kms" | ||
| # } | ||
| # } | ||
| #} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| ## | ||
| ### locals that function like variables, but without tedium of declaring them in a separate file | ||
| #locals { | ||
| # | ||
| # cidr_block = "10.0.0.0/16" | ||
| # | ||
| # # must pick one that supports arm64 lambdas (which apparently is not all of them) | ||
| # availability_zone = "us-east-1a" | ||
| #} | ||
| # | ||
| # | ||
| ### actual logic | ||
| #resource "aws_vpc" "main" { | ||
| # cidr_block = local.cidr_block | ||
| # | ||
| # tags = { | ||
| # environment_name = var.environment_name | ||
| # } | ||
| #} | ||
| # | ||
| #resource "aws_subnet" "main" { | ||
| # vpc_id = aws_vpc.main.id | ||
| # cidr_block = local.cidr_block | ||
| # availability_zone = local.availability_zone | ||
| # | ||
| # tags = { | ||
| # environment_name = var.environment_name | ||
| # } | ||
| #} | ||
| # | ||
| # | ||
| #resource "aws_security_group" "main" { | ||
| # name = "${var.environment_name}" | ||
| # description = "Security group for ${var.environment_name} deployment of Psoxy" | ||
| # vpc_id = aws_vpc.main.id | ||
| # | ||
| # # allow HTTPS inbound from any source | ||
| # ingress { | ||
| # description = "HTTPS" | ||
| # from_port = 443 | ||
| # to_port = 443 | ||
| # protocol = "tcp" | ||
| # cidr_blocks = [ | ||
| # local.cidr_block | ||
| # ] | ||
| # } | ||
| # | ||
| # # Allow HTTPS outbound to any destination | ||
| # egress { | ||
| # from_port = 443 | ||
| # to_port = 443 | ||
| # protocol = "tcp" | ||
| # cidr_blocks = [ | ||
| # "0.0.0.0/0" # any destination | ||
| # ] | ||
| # } | ||
| #} |