Skip to content

Commit d744f6b

Browse files
Karthikeyannhsrobbailiff2
Karthikeyannhs
and
robbailiff2
authored
ELI-154 - firehose , s3 audit setup (#192)
* firehose and audit bucket fixture * modified test to check if the data is written to audit * firehose terraform code * code clean up and fixes * Update Kinesis Firehose config * added env for stream name * fix * Add firehose to vpc endpoints * firehose endpoint * firehose cloudwatch logs * firehose kms key * audit kms s3 policy fix * kms encryption 🔐 for firehose & cleanup 🧹 * key name change * key name change * key name change * test * kms encryption * checkov * logs encruption * cleanup * checkov * checkov * checkov * checkov * lint * sonar fixed --------- Co-authored-by: Robert <[email protected]>
1 parent bfa9629 commit d744f6b

31 files changed

+600
-179
lines changed

‎infrastructure/modules/kinesis_firehose/data.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
data "aws_caller_identity" "current" {}

‎infrastructure/modules/kinesis_firehose/default_variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../_shared/default_variables.tf

‎infrastructure/modules/kinesis_firehose/kinesis_firehose_delivery_stream.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
resource "aws_kinesis_firehose_delivery_stream" "eligibility_audit_firehose_delivery_stream" {
2+
name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}-"}${var.project_name}-${var.environment}-${var.audit_firehose_delivery_stream_name}"
3+
destination = "extended_s3"
4+
5+
extended_s3_configuration {
6+
role_arn = var.audit_firehose_role_arn
7+
bucket_arn = var.s3_audit_bucket_arn
8+
9+
buffering_size = 1
10+
buffering_interval = 60
11+
compression_format = "UNCOMPRESSED"
12+
13+
kms_key_arn = aws_kms_key.firehose_cmk.arn
14+
15+
cloudwatch_logging_options {
16+
enabled = true
17+
log_group_name = var.kinesis_cloud_watch_log_group_name
18+
log_stream_name = var.kinesis_cloud_watch_log_stream
19+
}
20+
}
21+
22+
server_side_encryption {
23+
enabled = true
24+
key_arn = aws_kms_key.firehose_cmk.arn
25+
key_type = "CUSTOMER_MANAGED_CMK"
26+
}
27+
28+
tags = var.tags
29+
}

‎infrastructure/modules/kinesis_firehose/kms.tf‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
resource "aws_kms_key" "firehose_cmk" {
2+
description = "${terraform.workspace == "default" ? "" : "${terraform.workspace}-"}${var.audit_firehose_delivery_stream_name} Master Key"
3+
deletion_window_in_days = 14
4+
is_enabled = true
5+
enable_key_rotation = true
6+
tags = var.tags
7+
}
8+
9+
10+
resource "aws_kms_alias" "firehose_cmk" {
11+
name = "alias/${terraform.workspace == "default" ? "" : "${terraform.workspace}-"}${var.audit_firehose_delivery_stream_name}-cmk"
12+
target_key_id = aws_kms_key.firehose_cmk.key_id
13+
}
14+
15+
resource "aws_kms_key_policy" "firehose_key_policy" {
16+
key_id = aws_kms_key.firehose_cmk.id
17+
policy = data.aws_iam_policy_document.firehose_kms_key_policy.json
18+
}
19+
20+
21+
data "aws_iam_policy_document" "firehose_kms_key_policy" {
22+
#checkov:skip=CKV_AWS_111: Root user needs full KMS key management
23+
#checkov:skip=CKV_AWS_356: Root user needs full KMS key management
24+
#checkov:skip=CKV_AWS_109: Root user needs full KMS key management
25+
statement {
26+
sid = "EnableIamUserPermissions"
27+
effect = "Allow"
28+
principals {
29+
type = "AWS"
30+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
31+
}
32+
actions = ["kms:*"]
33+
resources = ["*"]
34+
}
35+
statement {
36+
sid = "EnableRootUserPermissions"
37+
effect = "Allow"
38+
39+
principals {
40+
type = "AWS"
41+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
42+
}
43+
44+
actions = ["kms:*"]
45+
resources = ["*"]
46+
}
47+
48+
# Your existing statements below...
49+
statement {
50+
sid = "AllowFirehoseAccess"
51+
effect = "Allow"
52+
principals {
53+
type = "Service"
54+
identifiers = ["firehose.amazonaws.com"]
55+
}
56+
actions = [
57+
"kms:Encrypt",
58+
"kms:Decrypt",
59+
"kms:GenerateDataKey*",
60+
"kms:DescribeKey"
61+
]
62+
resources = [aws_kms_key.firehose_cmk.arn]
63+
}
64+
65+
statement {
66+
sid = "AllowFirehoseRoleUsage"
67+
effect = "Allow"
68+
principals {
69+
type = "AWS"
70+
identifiers = [var.audit_firehose_role_arn]
71+
}
72+
actions = ["kms:*"]
73+
resources = [aws_kms_key.firehose_cmk.arn]
74+
}
75+
76+
statement {
77+
sid = "AllowCloudWatchLogsUseOfTheKey"
78+
effect = "Allow"
79+
principals {
80+
type = "Service"
81+
identifiers = ["logs.${var.region}.amazonaws.com"]
82+
}
83+
actions = [
84+
"kms:Encrypt",
85+
"kms:Decrypt",
86+
"kms:ReEncrypt*",
87+
"kms:GenerateDataKey*",
88+
"kms:DescribeKey"
89+
]
90+
resources = [aws_kms_key.firehose_cmk.arn]
91+
}
92+
}
93+
94+

‎infrastructure/modules/kinesis_firehose/outputs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "firehose_stream_name" {
2+
value = aws_kinesis_firehose_delivery_stream.eligibility_audit_firehose_delivery_stream.name
3+
}
4+
5+
output "kinesis_firehose_cmk_arn" {
6+
value = aws_kms_key.firehose_cmk.arn
7+
}

‎infrastructure/modules/kinesis_firehose/variables.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
variable "audit_firehose_delivery_stream_name" {
2+
description = "audit firehose delivery stream name"
3+
type = string
4+
}
5+
6+
variable "audit_firehose_role_arn" {
7+
description = "audit firehose role arn"
8+
type = string
9+
}
10+
11+
variable "s3_audit_bucket_arn" {
12+
description = "s3 audit bucket arn"
13+
type = string
14+
}
15+
16+
variable "kinesis_cloud_watch_log_group_name" {
17+
description = "kinesis cloud watch log group name"
18+
type = string
19+
}
20+
21+
variable "kinesis_cloud_watch_log_stream" {
22+
description = "kinesis cloud watch log stream"
23+
type = string
24+
}
25+
26+
27+

‎infrastructure/modules/lambda/kms.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,19 @@ resource "aws_kms_key_policy" "lambda_cmk" {
1717
}
1818

1919
data "aws_iam_policy_document" "lambda_cmk" {
20+
#checkov:skip=CKV_AWS_111: Root user needs full KMS key management
21+
#checkov:skip=CKV_AWS_356: Root user needs full KMS key management
22+
#checkov:skip=CKV_AWS_109: Root user needs full KMS key management
23+
statement {
24+
sid = "EnableIamUserPermissions"
25+
effect = "Allow"
26+
principals {
27+
type = "AWS"
28+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
29+
}
30+
actions = ["kms:*"]
31+
resources = ["*"]
32+
}
2033
statement {
2134
sid = "Enable IAM User Permissions for Lambda CMK"
2235
effect = "Allow"

‎infrastructure/modules/lambda/lambda.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,11 @@ resource "aws_lambda_function" "eligibility_signposting_lambda" {
1717

1818
environment {
1919
variables = {
20-
PERSON_TABLE_NAME = var.eligibility_status_table_name,
21-
RULES_BUCKET_NAME = var.eligibility_rules_bucket_name,
22-
ENV = var.environment
23-
LOG_LEVEL = var.log_level
20+
PERSON_TABLE_NAME = var.eligibility_status_table_name,
21+
RULES_BUCKET_NAME = var.eligibility_rules_bucket_name,
22+
KINESIS_AUDIT_STREAM_TO_S3 = var.kinesis_audit_stream_to_s3_name
23+
ENV = var.environment
24+
LOG_LEVEL = var.log_level
2425
}
2526
}
2627

‎infrastructure/modules/lambda/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ variable "eligibility_status_table_name" {
3838
type = string
3939
}
4040

41+
variable "kinesis_audit_stream_to_s3_name" {
42+
description = "kinesis audit stream to s3 name"
43+
type = string
44+
}
45+
4146
variable "log_level" {
4247
description = "log level"
4348
type = string

‎infrastructure/stacks/api-layer/api_gateway.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ resource "aws_api_gateway_deployment" "eligibility_signposting_api" {
4646
resource "aws_api_gateway_stage" "eligibility-signposting-api" {
4747
#checkov:skip=CKV2_AWS_51: mTLS is enforced at the custom domain, not at the stage level
4848
#checkov:skip=CKV_AWS_120: We're not enabling caching for this API Gateway, yet
49-
deployment_id = aws_api_gateway_deployment.eligibility_signposting_api.id
50-
rest_api_id = module.eligibility_signposting_api_gateway.rest_api_id
51-
stage_name = "${local.workspace}-eligibility-signposting-api-live"
49+
deployment_id = aws_api_gateway_deployment.eligibility_signposting_api.id
50+
rest_api_id = module.eligibility_signposting_api_gateway.rest_api_id
51+
stage_name = "${local.workspace}-eligibility-signposting-api-live"
5252
xray_tracing_enabled = true
5353

5454
access_log_settings {

0 commit comments

Comments
 (0)