diff --git a/alerts/common/main.tf b/alerts/common/main.tf index b5af784..223762c 100644 --- a/alerts/common/main.tf +++ b/alerts/common/main.tf @@ -1,7 +1,7 @@ variable "sns_topic_name" { default = "alerts" } resource "aws_sns_topic" "alerts" { - name = "alerts" + name = var.sns_topic_name } output "sns_topic_arn" { diff --git a/alerts/opsgenie/main.tf b/alerts/opsgenie/main.tf index 988d087..f7f0196 100644 --- a/alerts/opsgenie/main.tf +++ b/alerts/opsgenie/main.tf @@ -4,5 +4,5 @@ resource "aws_sns_topic_subscription" "opsgenie_alarm_notification_subscription" topic_arn = var.sns_topic_arn protocol = "https" endpoint_auto_confirms = true - endpoint = "https://api.%{if var.eu_region}eu.%{endif}opsgenie.com/v1/json/cloudwatch?apiKey=${var.api_key}" + endpoint = "https://api.%{if var.eu_region}eu.%{endif}opsgenie.com/v1/json/cloudwatch%{if var.cloudwatch_event}events%{endif}?apiKey=${var.api_key}" } diff --git a/alerts/opsgenie/variables.tf b/alerts/opsgenie/variables.tf index dc96046..d52722b 100644 --- a/alerts/opsgenie/variables.tf +++ b/alerts/opsgenie/variables.tf @@ -1,3 +1,4 @@ variable "api_key" {} variable "eu_region" {default = false} variable "sns_topic_arn" {} +variable "cloudwatch_event" { default = false } \ No newline at end of file diff --git a/api-gateway-v2/alerts/api_alerts.tf b/api-gateway-v2/alerts/api_alerts.tf new file mode 100644 index 0000000..31ea043 --- /dev/null +++ b/api-gateway-v2/alerts/api_alerts.tf @@ -0,0 +1,44 @@ +variable "notifications_sns_topic_arn" { default = "" } +variable "api_name" { default = "" } +variable "threshold" {default = 10} +variable "period" {default = 60} +variable "evaluation_periods" {default = 1} +variable "alarm_name" {default = ""} + +resource "aws_cloudwatch_metric_alarm" "api-4xx" { + alarm_name = "api-gateway-4xx-response.${var.alarm_name}" + alarm_description = "This alarm monitors api 4xx response" + comparison_operator = "GreaterThanThreshold" + evaluation_periods = var.evaluation_periods + metric_name = "4XXError" + namespace = "AWS/ApiGateway" + period = var.period + statistic = "Sum" + threshold = var.threshold + treat_missing_data = "ignore" + alarm_actions = [var.notifications_sns_topic_arn] + ok_actions = [var.notifications_sns_topic_arn] + dimensions = { + ApiName = var.api_name + } +} + +resource "aws_cloudwatch_metric_alarm" "api-5xx" { + alarm_name = "api-gateway-5xx-response.${var.alarm_name}" + alarm_description = "This alarm monitors api 5xx response" + comparison_operator = "GreaterThanThreshold" + evaluation_periods = var.evaluation_periods + metric_name = "5XXError" + namespace = "AWS/ApiGateway" + period = var.period + statistic = "Sum" + threshold = var.threshold + treat_missing_data = "ignore" + alarm_actions = [var.notifications_sns_topic_arn] + ok_actions = [var.notifications_sns_topic_arn] + dimensions = { + ApiName = var.api_name + } +} + + diff --git a/api-gateway-v2/any-route/main.tf b/api-gateway-v2/any-route/main.tf new file mode 100644 index 0000000..96d4a49 --- /dev/null +++ b/api-gateway-v2/any-route/main.tf @@ -0,0 +1,5 @@ +resource "aws_apigatewayv2_route" "public" { + api_id = var.api_id + route_key = "${var.method} ${var.path}" + target = "integrations/${var.integration_id}" +} diff --git a/api-gateway-v2/any-route/variables.tf b/api-gateway-v2/any-route/variables.tf new file mode 100644 index 0000000..d4498fe --- /dev/null +++ b/api-gateway-v2/any-route/variables.tf @@ -0,0 +1,4 @@ +variable "path" {} +variable "method" { default = "ANY" } +variable "api_id" {} +variable "integration_id" {} diff --git a/api-gateway-v2/jwt-authorized-route/main.tf b/api-gateway-v2/jwt-auth-any-route/main.tf similarity index 100% rename from api-gateway-v2/jwt-authorized-route/main.tf rename to api-gateway-v2/jwt-auth-any-route/main.tf diff --git a/api-gateway-v2/jwt-authorized-route/variables.tf b/api-gateway-v2/jwt-auth-any-route/variables.tf similarity index 100% rename from api-gateway-v2/jwt-authorized-route/variables.tf rename to api-gateway-v2/jwt-auth-any-route/variables.tf diff --git a/api-gateway-v2/jwt-auth-route-with-options/main.tf b/api-gateway-v2/jwt-auth-route-with-options/main.tf new file mode 100644 index 0000000..2685649 --- /dev/null +++ b/api-gateway-v2/jwt-auth-route-with-options/main.tf @@ -0,0 +1,15 @@ +resource "aws_apigatewayv2_route" "auth_on" { + for_each = toset(var.method) + api_id = var.api_id + route_key = "${each.key} ${var.path}" + target = "integrations/${var.integration_id}" + authorization_scopes = var.authorization_scopes + authorizer_id = var.authorizer_id + authorization_type = "JWT" +} + +resource "aws_apigatewayv2_route" "auth_off" { + api_id = var.api_id + route_key = "OPTIONS ${var.path}" + target = "integrations/${var.integration_id}" +} diff --git a/api-gateway-v2/jwt-auth-route-with-options/variables.tf b/api-gateway-v2/jwt-auth-route-with-options/variables.tf new file mode 100644 index 0000000..af8087a --- /dev/null +++ b/api-gateway-v2/jwt-auth-route-with-options/variables.tf @@ -0,0 +1,16 @@ +variable "path" {} +variable "method"{ + type = list + default = [ + "GET","POST","DELETE","HEAD","PATCH","PUT" + ] +} +variable "api_id" {} +variable "integration_id" {} +variable "authorizer_id" {} +variable "authorization_scopes" { + type = list + default = [ + "aws.cognito.signin.user.admin", + ] +} diff --git a/api-gateway-v2/websocket/main.tf b/api-gateway-v2/websocket/main.tf index 8fc9d11..3f4e9f0 100644 --- a/api-gateway-v2/websocket/main.tf +++ b/api-gateway-v2/websocket/main.tf @@ -31,6 +31,8 @@ resource "aws_apigatewayv2_route" "connect" { route_key = "$connect" operation_name = "ConnectRoute" target = "integrations/${aws_apigatewayv2_integration.connect.id}" + throttling_burst_limit = var.throttling_burst_limit + throttling_rate_limit = var.throttling_rate_limit } resource "aws_apigatewayv2_integration" "disconnect" { @@ -48,6 +50,8 @@ resource "aws_apigatewayv2_route" "disconnect" { route_key = "$disconnect" operation_name = "DisconnectRoute" target = "integrations/${aws_apigatewayv2_integration.disconnect.id}" + throttling_burst_limit = var.throttling_burst_limit + throttling_rate_limit = var.throttling_rate_limit } resource "aws_apigatewayv2_stage" "main" { diff --git a/api-gateway-v2/websocket/variables.tf b/api-gateway-v2/websocket/variables.tf index 9e5d7f1..5f09c60 100644 --- a/api-gateway-v2/websocket/variables.tf +++ b/api-gateway-v2/websocket/variables.tf @@ -6,3 +6,5 @@ variable "disconnect_lambda_invoke_arn" {} variable "domain_name" {} variable "dns_zone_id" {} variable "certificate_arn" {} +variable "throttling_burst_limit" {} +variable "throttling_rate_limit" {} diff --git a/api-gateway/alerts/api_alerts.tf b/api-gateway/alerts/api_alerts.tf new file mode 100644 index 0000000..31ea043 --- /dev/null +++ b/api-gateway/alerts/api_alerts.tf @@ -0,0 +1,44 @@ +variable "notifications_sns_topic_arn" { default = "" } +variable "api_name" { default = "" } +variable "threshold" {default = 10} +variable "period" {default = 60} +variable "evaluation_periods" {default = 1} +variable "alarm_name" {default = ""} + +resource "aws_cloudwatch_metric_alarm" "api-4xx" { + alarm_name = "api-gateway-4xx-response.${var.alarm_name}" + alarm_description = "This alarm monitors api 4xx response" + comparison_operator = "GreaterThanThreshold" + evaluation_periods = var.evaluation_periods + metric_name = "4XXError" + namespace = "AWS/ApiGateway" + period = var.period + statistic = "Sum" + threshold = var.threshold + treat_missing_data = "ignore" + alarm_actions = [var.notifications_sns_topic_arn] + ok_actions = [var.notifications_sns_topic_arn] + dimensions = { + ApiName = var.api_name + } +} + +resource "aws_cloudwatch_metric_alarm" "api-5xx" { + alarm_name = "api-gateway-5xx-response.${var.alarm_name}" + alarm_description = "This alarm monitors api 5xx response" + comparison_operator = "GreaterThanThreshold" + evaluation_periods = var.evaluation_periods + metric_name = "5XXError" + namespace = "AWS/ApiGateway" + period = var.period + statistic = "Sum" + threshold = var.threshold + treat_missing_data = "ignore" + alarm_actions = [var.notifications_sns_topic_arn] + ok_actions = [var.notifications_sns_topic_arn] + dimensions = { + ApiName = var.api_name + } +} + + diff --git a/api-gateway/base/output.tf b/api-gateway/base/output.tf index c1bdab4..2e4879f 100644 --- a/api-gateway/base/output.tf +++ b/api-gateway/base/output.tf @@ -13,3 +13,7 @@ output "stage_name" { output "invoke_url" { value = aws_api_gateway_deployment.deployment.invoke_url } + +output "api_name" { + value = var.name +} \ No newline at end of file diff --git a/api-gateway/lambda-single/output.tf b/api-gateway/lambda-single/output.tf index c1bdab4..ab91874 100644 --- a/api-gateway/lambda-single/output.tf +++ b/api-gateway/lambda-single/output.tf @@ -6,6 +6,10 @@ output "root_resource_id" { value = aws_api_gateway_rest_api.api.root_resource_id } +output "proxy_resource_id" { + value = aws_api_gateway_resource.lambda.id +} + output "stage_name" { value = var.stage_name } @@ -13,3 +17,7 @@ output "stage_name" { output "invoke_url" { value = aws_api_gateway_deployment.deployment.invoke_url } + +output "api_name" { + value = var.name +} diff --git a/ci/account/variables.tf b/ci/account/variables.tf index 2fc5fc3..f6c2c49 100644 --- a/ci/account/variables.tf +++ b/ci/account/variables.tf @@ -5,9 +5,7 @@ variable "deployer_additional_principals" { } variable "provisioner_additional_principals" { type = list - default = [ - "arn:aws:iam::492614697882:root", - ] + default = [] } variable "deployer_policy" { default = < Assuming role on master" ROLE_ARN="arn:${data.aws_partition.current.partition}:iam::$MASTER_ACCOUNT_ID:role/ci-provisioner" -curl -s -o assume-role.sh https://gitlab.com/luktom/ci/-/raw/master/scripts/assume-role.sh && . assume-role.sh +curl -s -o assume-role.sh https://raw.githubusercontent.com/pragmaticcoders/terraform-modules/master/scripts/assume-role.sh && . assume-role.sh echo "==> Assuming role on $SLAVE_ACCOUNT_NAME" ROLE_ARN="arn:${data.aws_partition.current.partition}:iam::$SLAVE_ACCOUNT_ID:role/OrganizationAccountAccessRole" -curl -s -o assume-role.sh https://gitlab.com/luktom/ci/-/raw/master/scripts/assume-role.sh && . assume-role.sh +curl -s -o assume-role.sh https://raw.githubusercontent.com/pragmaticcoders/terraform-modules/master/scripts/assume-role.sh && . assume-role.sh echo "==> Checking if provisioner role exists" diff --git a/rds/postgres/main.tf b/rds/postgres/main.tf index 3b38b98..2a97cee 100644 --- a/rds/postgres/main.tf +++ b/rds/postgres/main.tf @@ -4,6 +4,8 @@ module "database" { identifier = var.name name = var.name + parameter_group_name = var.name + parameter_group_use_name_prefix = false engine = "postgres" engine_version = "11" diff --git a/scripts/assume-role.sh b/scripts/assume-role.sh new file mode 100644 index 0000000..27305e6 --- /dev/null +++ b/scripts/assume-role.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +if [[ -z "$ROLE_ARN" ]]; then + echo "==> skipping assume role as no role specified" + return +fi + +echo "==> assuming role $ROLE_ARN" +output=$(aws sts assume-role --role-arn "$ROLE_ARN" --role-session-name "assumed-role") + +echo "==> role $ROLE_ARN assumed" +export AWS_ACCESS_KEY_ID=$(echo $output | jq -c '.Credentials.AccessKeyId' | tr -d '"' | tr -d ' ') +export AWS_SECRET_ACCESS_KEY=$(echo $output | jq -c '.Credentials.SecretAccessKey' | tr -d '"' | tr -d ' ') +export AWS_SESSION_TOKEN=$(echo $output | jq -c '.Credentials.SessionToken' | tr -d '"' | tr -d ' ') \ No newline at end of file diff --git a/security/cloudtrail/main.tf b/security/cloudtrail/main.tf index 7bc19dc..feb7914 100644 --- a/security/cloudtrail/main.tf +++ b/security/cloudtrail/main.tf @@ -51,7 +51,7 @@ resource "aws_cloudtrail" "organization" { # sns_topic_name = "${data.terraform_remote_state.master.cloudtrail_events_sns_topic_arn}" enable_log_file_validation = true # kms_key_id = "${data.terraform_remote_state.master.kms_cloudtrail_arn["${var.account_name}"]}" - cloud_watch_logs_group_arn = aws_cloudwatch_log_group.cloudtrail.arn + cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail.arn}:*" cloud_watch_logs_role_arn = module.role.iam_role_arn depends_on = [ diff --git a/security/vpc-flow-logs/main.tf b/security/vpc-flow-logs/main.tf new file mode 100644 index 0000000..5cc93e7 --- /dev/null +++ b/security/vpc-flow-logs/main.tf @@ -0,0 +1,40 @@ +variable "tenant" {} + +module "bucket" { + source = "../../s3/simple-bucket" + + bucket = "${var.tenant}-vpc-flow-logs" + versioning_enabled = true + + policy = <