Skip to content

Commit 84e10aa

Browse files
mfjarvismfjarvis
authored
VED-270: Terraform fixes. (#408)
* VED-270: WIP: Resolve duplication in infra terraform. * VED-270: WIP: Add removed blocks to prevent destruction of unmanaged resources. * VED-270: Only create environment-level sources bucket in prod. Make comments clearer. * VED-270: Move DynamoDB resources from infra to instance Terraform. * VED-270: Remove some data sources for managed resources. Some tidying up. * VED-270: Replace some of the longhand table / index ARNs. * VED-270: Format. * VED-270: More issues found. * VED-270: Move config and batch destination buckets to instance terraform. Add missing BatchGetItem permission for testing in non-prod. * VED-270: Rename environment in infra terraform for clarity. * VED-270: Remove old infra terraform. Move new infra terraform up a level. * VED-270: Inline some policy documents for clarity. * VED-270: Add more imports. * VED-270: Add mystery KMS key to non-prod KMS endpoint policy for now. * VED-270: Fix float serialisation issue. * VED-270: Look up prefix lists by name. * VED-270: Resolve some of the Sonar warnings. * VED-270: Resolve more Sonar warnings. Rename account id locals. * VED-270: Fix incorrect account in endpoint policies. Remove unused docker provider.
1 parent 301ddec commit 84e10aa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+1677
-2676
lines changed

‎infra/.terraform.lock.hcl‎

Lines changed: 47 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

infra/prod/endpoints.tf renamed to infra/endpoints.tf

Lines changed: 62 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
data "aws_ec2_managed_prefix_list" "egress" {
2+
for_each = toset([
3+
"com.amazonaws.global.cloudfront.origin-facing",
4+
"com.amazonaws.eu-west-2.dynamodb",
5+
"com.amazonaws.eu-west-2.s3"
6+
])
7+
8+
name = each.value
9+
}
10+
111
resource "aws_security_group" "lambda_redis_sg" {
212
vpc_id = data.aws_vpc.default.id
313
name = "immunisation-security-group"
@@ -12,22 +22,20 @@ resource "aws_security_group" "lambda_redis_sg" {
1222

1323
# Outbound rules to specific AWS services using prefix lists
1424
egress {
15-
from_port = 0
16-
to_port = 0
17-
protocol = "-1"
25+
from_port = 0
26+
to_port = 0
27+
protocol = "-1"
1828
prefix_list_ids = [
19-
"pl-7ca54015",
20-
"pl-93a247fa",
21-
"pl-b3a742da"
29+
for pl in data.aws_ec2_managed_prefix_list.egress : pl.id
2230
]
2331
}
2432

2533
# Egress rule to allow communication within the same security group
2634
egress {
27-
from_port = 0
28-
to_port = 0
29-
protocol = "-1"
30-
self = true
35+
from_port = 0
36+
to_port = 0
37+
protocol = "-1"
38+
self = true
3139
}
3240
}
3341

@@ -44,18 +52,16 @@ resource "aws_vpc_endpoint" "sqs_endpoint" {
4452
Version = "2012-10-17",
4553
Statement = [
4654
{
47-
Effect = "Allow"
55+
Effect = "Allow"
4856
Principal = {
49-
"AWS": [
50-
"*"
51-
]
57+
AWS = "arn:aws:iam::${local.immunisation_account_id}:root"
5258
},
53-
Action = [
59+
Action = [
5460
"sqs:SendMessage",
5561
"sqs:ReceiveMessage",
5662
"kms:Decrypt"
5763
]
58-
Resource = "*"
64+
Resource = "*"
5965
}
6066
]
6167
})
@@ -76,18 +82,18 @@ resource "aws_vpc_endpoint" "s3_endpoint" {
7682
Version = "2012-10-17",
7783
Statement = [
7884
{
79-
Effect = "Allow"
85+
Effect = "Allow"
8086
Principal = {
81-
"AWS": "*"
87+
AWS = "arn:aws:iam::${local.immunisation_account_id}:root"
8288
},
83-
Action = [
89+
Action = [
8490
"s3:GetObject",
8591
"s3:PutObject",
8692
"s3:ListBucket",
8793
"s3:CopyObject",
8894
"s3:DeleteObject"
8995
]
90-
Resource = "*"
96+
Resource = "*"
9197
}
9298
]
9399
})
@@ -110,7 +116,9 @@ resource "aws_vpc_endpoint" "kinesis_endpoint" {
110116
Statement = [
111117
{
112118
Effect = "Allow",
113-
Principal = "*",
119+
Principal = {
120+
AWS = "arn:aws:iam::${local.immunisation_account_id}:root"
121+
},
114122
Action = [
115123
"firehose:ListDeliveryStreams",
116124
"firehose:PutRecord",
@@ -137,18 +145,18 @@ resource "aws_vpc_endpoint" "dynamodb" {
137145
Version = "2012-10-17",
138146
Statement = [
139147
{
140-
"Effect": "Allow",
141-
"Principal": "*",
142-
"Action": "*",
143-
"Resource": "*"
148+
"Effect" : "Allow",
149+
"Principal" : {
150+
AWS = "arn:aws:iam::${local.immunisation_account_id}:root"
151+
},
152+
"Action" : "*",
153+
"Resource" : "*"
144154
}
145155
]
146156
})
147157
tags = {
148158
Name = "immunisation-dynamo-endpoint"
149159
}
150-
151-
152160
}
153161

154162

@@ -157,8 +165,8 @@ resource "aws_vpc_endpoint" "ecr_api" {
157165
service_name = "com.amazonaws.${var.aws_region}.ecr.api"
158166
vpc_endpoint_type = "Interface"
159167

160-
subnet_ids = data.aws_subnets.default.ids
161-
security_group_ids = [aws_security_group.lambda_redis_sg.id]
168+
subnet_ids = data.aws_subnets.default.ids
169+
security_group_ids = [aws_security_group.lambda_redis_sg.id]
162170
private_dns_enabled = true
163171
tags = {
164172
Name = "immunisation-ecr-api-endpoint"
@@ -170,8 +178,8 @@ resource "aws_vpc_endpoint" "ecr_dkr" {
170178
service_name = "com.amazonaws.${var.aws_region}.ecr.dkr"
171179
vpc_endpoint_type = "Interface"
172180

173-
subnet_ids = data.aws_subnets.default.ids
174-
security_group_ids = [aws_security_group.lambda_redis_sg.id]
181+
subnet_ids = data.aws_subnets.default.ids
182+
security_group_ids = [aws_security_group.lambda_redis_sg.id]
175183
private_dns_enabled = true
176184
tags = {
177185
Name = "immunisation-ecr-dkr-endpoint"
@@ -183,8 +191,8 @@ resource "aws_vpc_endpoint" "cloud_watch" {
183191
service_name = "com.amazonaws.${var.aws_region}.logs"
184192
vpc_endpoint_type = "Interface"
185193

186-
subnet_ids = data.aws_subnets.default.ids
187-
security_group_ids = [aws_security_group.lambda_redis_sg.id]
194+
subnet_ids = data.aws_subnets.default.ids
195+
security_group_ids = [aws_security_group.lambda_redis_sg.id]
188196
private_dns_enabled = true
189197
tags = {
190198
Name = "immunisation-cloud-watch-endpoint"
@@ -207,9 +215,7 @@ resource "aws_vpc_endpoint" "kinesis_stream_endpoint" {
207215
{
208216
Effect = "Allow",
209217
Principal = {
210-
"AWS":[
211-
"*"
212-
]
218+
AWS = "arn:aws:iam::${local.immunisation_account_id}:root"
213219
},
214220
Action = [
215221
"kinesis:ListShards",
@@ -226,6 +232,13 @@ resource "aws_vpc_endpoint" "kinesis_stream_endpoint" {
226232
}
227233
}
228234

235+
# TODO - remove and use the key we manage in this Terraform workspace
236+
data "aws_kms_key" "existing_lambda_env_encryption" {
237+
count = local.account != "prod" ? 1 : 0
238+
239+
key_id = "648c8c6f-54bf-4b79-ad72-0be6e8d72423"
240+
}
241+
229242
resource "aws_vpc_endpoint" "kms_endpoint" {
230243
vpc_id = data.aws_vpc.default.id
231244
service_name = "com.amazonaws.${var.aws_region}.kms"
@@ -240,19 +253,26 @@ resource "aws_vpc_endpoint" "kms_endpoint" {
240253
Statement = [
241254
{
242255
Effect = "Allow",
243-
Principal = "*",
256+
Principal = {
257+
AWS = "arn:aws:iam::${local.immunisation_account_id}:root"
258+
},
244259
Action = [
245260
"kms:Decrypt",
246261
"kms:Encrypt",
247262
"kms:GenerateDataKey*"
248263
],
249-
Resource = [
250-
"arn:aws:kms:eu-west-2:664418956997:key/4e643221-4cb8-49c5-9a78-ced991ff52ae",
251-
"arn:aws:kms:eu-west-2:664418956997:key/d7b3c213-3c05-4caf-bb95-fdb2a6e533b1"
264+
Resource = local.account == "prod" ? [
265+
aws_kms_key.lambda_env_encryption.arn,
266+
aws_kms_key.s3_shared_key.arn
267+
] : [
268+
aws_kms_key.lambda_env_encryption.arn,
269+
aws_kms_key.s3_shared_key.arn,
270+
data.aws_kms_key.existing_lambda_env_encryption[0].arn
252271
]
253272
}
254273
]
255274
})
275+
256276
tags = {
257277
Name = "immunisation-kms-endpoint"
258278
}
@@ -263,11 +283,10 @@ resource "aws_vpc_endpoint" "lambda_endpoint" {
263283
service_name = "com.amazonaws.${var.aws_region}.lambda"
264284
vpc_endpoint_type = "Interface"
265285

266-
subnet_ids = data.aws_subnets.default.ids
267-
security_group_ids = [aws_security_group.lambda_redis_sg.id]
286+
subnet_ids = data.aws_subnets.default.ids
287+
security_group_ids = [aws_security_group.lambda_redis_sg.id]
268288
private_dns_enabled = true
269289
tags = {
270290
Name = "immunisation-lambda-endpoint"
271291
}
272292
}
273-

infra/non-prod/kinesis_role.tf renamed to infra/kinesis_role.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ resource "aws_iam_role" "kinesis_role" {
44
assume_role_policy = jsonencode({
55
Version = "2012-10-17"
66
Statement = [{
7-
Effect = "Allow"
7+
Effect = "Allow"
88
Principal = {
99
Service = "kinesis.amazonaws.com"
1010
}
@@ -20,8 +20,8 @@ resource "aws_iam_policy" "kinesis_kms_policy" {
2020
policy = jsonencode({
2121
Version = "2012-10-17"
2222
Statement = [{
23-
Effect = "Allow"
24-
Action = [
23+
Effect = "Allow"
24+
Action = [
2525
"kms:Encrypt",
2626
"kms:Decrypt",
2727
"kms:GenerateDataKey*",

0 commit comments

Comments
 (0)