Create CSA region-to-email mapping YAML file for cisagov/cyhy-mailer

[jsf9k]

🗣 Description

This pull request makes the necessary changes to create the CSA region-to-email mapping YAML file now required by cisagov/cyhy-mailer as of cisagov/cyhy-mailer#101.

Note that I added the appropriate YAML to the SSM Parameter Store variable /cyhy/csa_email_yaml to the CyHy AWS account in all four US regions.

💭 Motivation and context

Partly resolves cisagov/cyhy-system#114. See also cisagov/cyhy-mailer#101.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

[dav3r]

👍 👍
Please see my one minor change request.

[dv4harr10]

Hi Team, one medium severity issue at terraform_egress_pub/cloudfront.tf line 144, detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set minimum_protocol_version to "TLSv1.2_2018", "TLSv1.2_2019", or "TLSv1.2_2021".

[dv4harr10]

Hi Team, one potential medium severity issue at terraform/ files bod_vpc_flow_logs.tf, cyhy_vpc_flow_logs.tf, and mgmt_vpc_flow_logs.tf each file at line 43, aws-cloudwatch-log-group-no-retention. The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.

[jsf9k]

Hi Team, one medium severity issue at terraform_egress_pub/cloudfront.tf line 144, detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set minimum_protocol_version to "TLSv1.2_2018", "TLSv1.2_2019", or "TLSv1.2_2021".

The issue you bring up has nothing to do with this pull request, but I created #750 to capture your concern.

[jsf9k]

Hi Team, one potential medium severity issue at terraform/ files bod_vpc_flow_logs.tf, cyhy_vpc_flow_logs.tf, and mgmt_vpc_flow_logs.tf each file at line 43, aws-cloudwatch-log-group-no-retention. The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.

The issue you bring up has nothing to do with this pull request, but I created #751 to capture your concern.

[dav3r]

@jsf9k I forgot to ask this earlier, but did you already populate the correct CSA/email YAML in SSM (/cyhy/csa_email_yaml)? If so, please mention that somewhere in the PR description above.