Skip to content

Commit 0262a8a

Browse files
drewmullenbonclay7
drewmullen
authored and
bonclay7
committed
Initial commit
1 parent eaee1dd commit 0262a8a

25 files changed

+559
-10
lines changed

‎.gitignore

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
build/
2+
plan.out
3+
plan.out.json
4+
5+
# Local .terraform directories
6+
.terraform/
7+
8+
# .tfstate files
9+
*.tfstate
10+
*.tfstate.*
11+
12+
# Crash log files
13+
crash.log
14+
15+
# Exclude all .tfvars files, which are likely to contain sentitive data, such as
16+
# password, private keys, and other secrets. These should not be part of version
17+
# control as they are data points which are potentially sensitive and subject
18+
# to change depending on the environment.
19+
#
20+
*.tfvars
21+
22+
# Ignore override files as they are usually used to override resources locally and so
23+
# are not checked in
24+
override.tf
25+
override.tf.json
26+
*_override.tf
27+
*_override.tf.json
28+
29+
# Include override files you do wish to add to version control using negated pattern
30+
#
31+
# !example_override.tf
32+
33+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
34+
# example: *tfplan*
35+
36+
# Ignore CLI configuration files
37+
.terraformrc
38+
terraform.rc
39+
.terraform.lock.hcl
40+
41+
go.mod
42+
go.sum

‎.header.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Creating modules for AWS I&A Organization
2+
3+
This repo template is used to seed Terraform Module templates for the [AWS I&A GitHub organization](https://github.com/aws-ia). Usage of this template is allowed per included license. PRs to this template will be considered but are not guaranteed to be included. Consider creating an issue to discuss a feature you want to include before taking the time to create a PR.
4+
### TL;DR
5+
6+
1. [install pre-commit](https://pre-commit.com/)
7+
2. configure pre-commit: `pre-commit install`
8+
3. install required tools
9+
- [tflint](https://github.com/terraform-linters/tflint)
10+
- [tfsec](https://aquasecurity.github.io/tfsec/v1.0.11/)
11+
- [terraform-docs](https://github.com/terraform-docs/terraform-docs)
12+
- [golang](https://go.dev/doc/install) (for macos you can use `brew`)
13+
- [coreutils](https://www.gnu.org/software/coreutils/)
14+
15+
Write code according to [I&A module standards](https://aws-ia.github.io/standards-terraform/)
16+
17+
## Module Documentation
18+
19+
**Do not manually update README.md**. `terraform-docs` is used to generate README files. For any instructions an content, please update [.header.md](./.header.md) then simply run `terraform-docs ./` or allow the `pre-commit` to do so.
20+
21+
## Terratest
22+
23+
Please include tests to validate your examples/<> root modules, at a minimum. This can be accomplished with usually only slight modifications to the [boilerplate test provided in this template](./test/examples_basic_test.go)
24+
25+
### Configure and run Terratest
26+
27+
1. Install
28+
29+
[golang](https://go.dev/doc/install) (for macos you can use `brew`)
30+
2. Change directory into the test folder.
31+
32+
`cd test`
33+
3. Initialize your test
34+
35+
go mod init github.com/[github org]/[repository]
36+
37+
`go mod init github.com/aws-ia/terraform-aws-vpc`
38+
4. Run tidy
39+
40+
`git mod tidy`
41+
5. Install Terratest
42+
43+
`go get github.com/gruntwork-io/terratest/modules/terraform`
44+
6. Run test (You can have multiple test files).
45+
- Run all tests
46+
47+
`go test`
48+
- Run a specific test with a timeout
49+
50+
`go test -run examples_basic_test.go -timeout 45m`
51+
## Module Standards
52+
53+
For best practices and information on developing with Terraform, see the [I&A Module Standards](https://aws-ia.github.io/standards-terraform/)
54+
55+
## Continuous Integration
56+
57+
The I&A team uses AWS CodeBuild to perform continuous integration (CI) within the organization. Our CI uses the a repo's `.pre-commit-config.yaml` file as well as some other checks. All PRs with other CI will be rejected. See our [FAQ](https://aws-ia.github.io/standards-terraform/faq/#are-modules-protected-by-ci-automation) for more details.

‎.pre-commit-config.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
fail_fast: false
3+
minimum_pre_commit_version: "2.6.0"
4+
repos:
5+
-
6+
repo: https://github.com/aws-ia/pre-commit-configs
7+
# To update run:
8+
# pre-commit autoupdate --freeze
9+
rev: 80ed3f0a164f282afaac0b6aec70e20f7e541932 # frozen: v1.5.0
10+
hooks:
11+
- id: aws-ia-meta-hook

‎.terraform-docs.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
formatter: markdown
2+
header-from: .header.md
3+
settings:
4+
anchor: true
5+
color: true
6+
default: true
7+
escape: true
8+
html: true
9+
indent: 2
10+
required: true
11+
sensitive: true
12+
type: true
13+
14+
sort:
15+
enabled: true
16+
by: required
17+
18+
output:
19+
file: README.md
20+
mode: replace

‎.tflint.hcl

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md
2+
# borrowed & modified indefinitely from https://github.com/ksatirli/building-infrastructure-you-can-mostly-trust/blob/main/.tflint.hcl
3+
4+
plugin "aws" {
5+
enabled = true
6+
version = "0.14.0"
7+
source = "github.com/terraform-linters/tflint-ruleset-aws"
8+
}
9+
10+
config {
11+
module = true
12+
force = false
13+
}
14+
15+
rule "terraform_required_providers" {
16+
enabled = true
17+
}
18+
19+
rule "terraform_required_version" {
20+
enabled = true
21+
}
22+
23+
rule "terraform_naming_convention" {
24+
enabled = true
25+
format = "snake_case"
26+
}
27+
28+
rule "terraform_typed_variables" {
29+
enabled = true
30+
}
31+
32+
rule "terraform_unused_declarations" {
33+
enabled = true
34+
}
35+
36+
rule "terraform_comment_syntax" {
37+
enabled = true
38+
}
39+
40+
rule "terraform_deprecated_index" {
41+
enabled = true
42+
}
43+
44+
rule "terraform_deprecated_interpolation" {
45+
enabled = true
46+
}
47+
48+
rule "terraform_documented_outputs" {
49+
enabled = true
50+
}
51+
52+
rule "terraform_documented_variables" {
53+
enabled = true
54+
}
55+
56+
rule "terraform_module_pinned_source" {
57+
enabled = true
58+
}
59+
60+
rule "terraform_standard_module_structure" {
61+
enabled = true
62+
}
63+
64+
rule "terraform_workspace_remote" {
65+
enabled = true
66+
}

‎.tfsec/launch_configuration_imdsv2_tfchecks.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS002",
5+
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
6+
"impact": "Instance metadata service can be interacted with freely",
7+
"resolution": "Enable HTTP token requirement for IMDS",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_configuration"
13+
],
14+
"severity": "CRITICAL",
15+
"matchSpec": {
16+
"action": "isPresent",
17+
"name": "metadata_options",
18+
"subMatch": {
19+
"action": "and",
20+
"predicateMatchSpec": [
21+
{
22+
"action": "equals",
23+
"name": "http_tokens",
24+
"value": "required"
25+
26+
}
27+
]
28+
}
29+
},
30+
31+
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
32+
"relatedLinks": [
33+
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
34+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata-options",
35+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
36+
]
37+
}
38+
]
39+
}

‎.tfsec/launch_template_imdsv2_tfchecks.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS001",
5+
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
6+
"impact": "Instance metadata service can be interacted with freely",
7+
"resolution": "Enable HTTP token requirement for IMDS",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_template"
13+
],
14+
"severity": "CRITICAL",
15+
"matchSpec": {
16+
"action": "isPresent",
17+
"name": "metadata_options",
18+
"subMatch": {
19+
"action": "and",
20+
"predicateMatchSpec": [
21+
{
22+
"action": "equals",
23+
"name": "http_tokens",
24+
"value": "required"
25+
26+
}
27+
]
28+
}
29+
},
30+
31+
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
32+
"relatedLinks": [
33+
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
34+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options",
35+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
36+
]
37+
}
38+
]
39+
}

‎.tfsec/no_launch_config_tfchecks.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS003",
5+
"description": "Use `aws_launch_template` over `aws_launch_configuration",
6+
"impact": "Launch configurations are not capable of versions",
7+
"resolution": "Convert resource type and attributes to `aws_launch_template`",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_configuration"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "image_id"
18+
},
19+
20+
"errorMessage": "should be changed to `aws_launch_template` since the functionality is the same but templates can be versioned.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template",
23+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
24+
]
25+
}
26+
]
27+
}

‎.tfsec/sg_no_embedded_egress_rules_tfchecks.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS005",
5+
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
6+
"impact": "Embedded security group rules can cause issues during configuration updates.",
7+
"resolution": "Move `egress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_security_group"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "egress"
18+
},
19+
20+
"errorMessage": "`egress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
23+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
24+
]
25+
}
26+
]
27+
}

‎.tfsec/sg_no_embedded_ingress_rules_tfchecks.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS004",
5+
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
6+
"impact": "Embedded security group rules can cause issues during configuration updates.",
7+
"resolution": "Move `ingress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_security_group"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "ingress"
18+
},
19+
20+
"errorMessage": "`ingress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
23+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
24+
]
25+
}
26+
]
27+
}

‎CODEOWNERS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @aws-ia/aws-ia

0 commit comments

Comments
 (0)