Skip to content

Commit fab7367

Browse files
hugoalmeida264boldlinksig
andauthored
fix: add nlb support to module and complete example and idle_timeout to the alb (#34)
* fix: add nlb support to module and complete example * fix: Add the checkov exceptions * fix: remove unused code and fix complete example * nostory: fix outputs and add notes to readme complete example * fix: remove unused account_id * fix: remove unused account_id datasource * [Boldlinksig]: Pre-commit auto updated files on 08-11-2023 16:23:14. * chore: add line to release on changelog * fix: allowing admins to access logs bucket * [Boldlinksig]: Pre-commit auto updated files on 09-11-2023 20:38:13. --------- Co-authored-by: boldlinksig <boldlinksig@boldlink.io>
1 parent 682bc5b commit fab7367

File tree

15 files changed

+306
-91
lines changed

15 files changed

+306
-91
lines changed

.checkov.yml

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@ evaluate-variables: true
55
external-modules-download-path: .external_modules
66
framework: all
77
skip-check:
8-
- CKV_AWS_260 #Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
9-
- CKV_AWS_336 #Ensure ECS containers are limited to read-only access to root filesystems
10-
- CKV_AWS_338 #Ensure CloudWatch log groups retains logs for at least 1 year
11-
- CKV2_AWS_5 #Ensure that Security Groups are attached to another
12-
- CKV_AWS_150 #Ensure that Load Balancer has deletion protection enabled
13-
- CKV_TF_1 #Ensure Terraform module sources use a commit hash
14-
- CKV2_AWS_28 #Ensure public facing ALB are protected by WAF
8+
- CKV_AWS_260 # Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
9+
- CKV_AWS_336 # Ensure ECS containers are limited to read-only access to root filesystems
10+
- CKV_AWS_338 # Ensure CloudWatch log groups retains logs for at least 1 year
11+
- CKV2_AWS_5 # Ensure that Security Groups are attached to another
12+
- CKV_AWS_150 # Ensure that Load Balancer has deletion protection enabled
13+
- CKV_TF_1 # Ensure Terraform module sources use a commit hash
14+
- CKV2_AWS_28 # Ensure public facing ALB are protected by WAF
15+
- CKV_AWS_152 # Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled
16+
- CKV2_AWS_20 # Ensure that ALB redirects HTTP requests into HTTPS ones
17+
- CKV_AWS_261 # Ensure HTTP HTTPS Target group defines Healthcheck

CHANGELOG.md

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

77
## [Unreleased]
8+
- major: Remove the WAF KMS and ALB/NLB resources from the module and use external modules to provide these configurations.
89
- fix: CKV_AWS_260 Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
910
- fix: CKV_AWS_336 Ensure ECS containers are limited to read-only access to root filesystems
1011
- fix: CKV_AWS_338 Ensure CloudWatch log groups retains logs for at least 1 year
1112
- fix: CKV2_AWS_5 Ensure that Security Groups are attached to another
1213
- fix: CKV_AWS_150 Ensure that Load Balancer has deletion protection enabled
13-
- fix: CKV_TF_1:Ensure Terraform module sources use a commit hash
14+
- fix: CKV_AWS_152 Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled
15+
- fix: CKV2_AWS_20 Ensure that ALB redirects HTTP requests into HTTPS ones
16+
- fix: CKV_AWS_261 Ensure HTTP HTTPS Target group defines Healthcheck
1417
- feat: showcase load balancer protection using WAF
1518
- feat: more than one security group for ecs service
1619
- feat: Add EC2 usage example
@@ -23,6 +26,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
2326
- feat: Add missing aws_ecs_task_definition arguments and showcase them in examples
2427
- feat: expand volume block of the task definition as it has more configuration
2528

29+
## [1.7.0] - 2023-12-03
30+
### Changes
31+
- feat: add complete example for alb and nlb service
32+
- feat: Enable ALB idle timeout configuration - this feature only works with ALB and not NLB.
33+
- fix: Separate listeners and target groups according to the `load_balancer_type = "application/network"`.
34+
- fix: Change the complete example s3 bucket policy and acl to support alb+nlb log delivery
35+
- fix: Force the s3 bucket encryption to be `AES256` since nlb only support AES256 or CMK kms encryption.
36+
- feat: Configure the nlb listerner to use TLS by default, note the current complete example doesnt implement end-to-end encyrption.
37+
2638
## [1.6.0] - 2023-10-26
2739
### Changes
2840
- fix: confusing names for assume role policies for both the task role and task execution role
@@ -130,8 +142,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
130142
- feat: feature update.
131143
- feat: initial code commit
132144

133-
[Unreleased]: https://github.com/boldlink/terraform-aws-ecs-service/compare/1.5.3...HEAD
145+
[Unreleased]: https://github.com/boldlink/terraform-aws-ecs-service/compare/1.7.0...HEAD
134146

147+
[1.7.0]: https://github.com/boldlink/terraform-aws-ecs-service/releases/tag/1.7.0
135148
[1.6.0]: https://github.com/boldlink/terraform-aws-ecs-service/releases/tag/1.6.0
136149
[1.5.3]: https://github.com/boldlink/terraform-aws-ecs-service/releases/tag/1.5.3
137150
[1.5.2]: https://github.com/boldlink/terraform-aws-ecs-service/releases/tag/1.5.2

README.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ module "ecs_service" {
186186

187187
| Name | Version |
188188
|------|---------|
189-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.23.1 |
189+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.24.0 |
190190
| <a name="provider_tls"></a> [tls](#provider\_tls) | 4.0.4 |
191191

192192
## Modules
@@ -211,7 +211,9 @@ No modules.
211211
| [aws_lb.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb) | resource |
212212
| [aws_lb_listener.http_redirect](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
213213
| [aws_lb_listener.https](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
214-
| [aws_lb_target_group.main_tg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
214+
| [aws_lb_listener.nlb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
215+
| [aws_lb_target_group.main_alb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
216+
| [aws_lb_target_group.main_nlb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
215217
| [aws_security_group.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
216218
| [aws_security_group.service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
217219
| [aws_security_group_rule.lb_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
@@ -255,6 +257,7 @@ No modules.
255257
| <a name="input_family"></a> [family](#input\_family) | (Required) A unique name for your task definition. | `string` | `null` | no |
256258
| <a name="input_force_new_deployment"></a> [force\_new\_deployment](#input\_force\_new\_deployment) | Enable to force a new task deployment of the service. This can be used to update tasks to use a newer Docker image with same image/tag combination (e.g., myimage:latest), roll Fargate tasks onto a newer platform version, or immediately deploy ordered\_placement\_strategy and placement\_constraints updates. | `bool` | `false` | no |
257259
| <a name="input_healthy_threshold"></a> [healthy\_threshold](#input\_healthy\_threshold) | (Optional) Number of consecutive health checks successes required before considering an unhealthy target healthy. Defaults to 3. | `number` | `3` | no |
260+
| <a name="input_idle_timeout"></a> [idle\_timeout](#input\_idle\_timeout) | (Optional) The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type application. Default: 60 | `number` | `60` | no |
258261
| <a name="input_internal"></a> [internal](#input\_internal) | (Optional) If true, the LB will be internal. | `bool` | `false` | no |
259262
| <a name="input_interval"></a> [interval](#input\_interval) | (Optional) Approximate amount of time, in seconds, between health checks of an individual target. The range is 5-300. For lambda target groups, it needs to be greater than the timeout of the underlying lambda. Defaults to 30. | `number` | `30` | no |
260263
| <a name="input_key_deletion_window_in_days"></a> [key\_deletion\_window\_in\_days](#input\_key\_deletion\_window\_in\_days) | The number of days before the key is deleted | `number` | `7` | no |
@@ -265,7 +268,7 @@ No modules.
265268
| <a name="input_listener_protocol"></a> [listener\_protocol](#input\_listener\_protocol) | (Required) The protocol to listen on. Valid values are HTTP, HTTPS, TCP, or SSL | `string` | `"HTTP"` | no |
266269
| <a name="input_load_balancer"></a> [load\_balancer](#input\_load\_balancer) | (Optional) Configuration block for load balancers | `any` | `[]` | no |
267270
| <a name="input_load_balancer_type"></a> [load\_balancer\_type](#input\_load\_balancer\_type) | (Optional) The type of load balancer to create. Possible values are application, gateway, or network. The default value is application. | `string` | `"application"` | no |
268-
| <a name="input_matcher"></a> [matcher](#input\_matcher) | (May be required) Response codes to use when checking for a healthy responses from a target. You can specify multiple values (for example, 200,202 for HTTP(s)) | `string` | `"200,202"` | no |
271+
| <a name="input_matcher"></a> [matcher](#input\_matcher) | (May be required) Response codes to use when checking for a healthy responses from a target. You can specify multiple values (for example, 200,202 for HTTP(s)) | `string` | `null` | no |
269272
| <a name="input_max_capacity"></a> [max\_capacity](#input\_max\_capacity) | (Required) The max capacity of the scalable target. | `number` | `2` | no |
270273
| <a name="input_memory"></a> [memory](#input\_memory) | Amount (in MiB) of memory used by the task. If the requires\_compatibilities is FARGATE this field is required. | `number` | `1024` | no |
271274
| <a name="input_metric_aggregation_type"></a> [metric\_aggregation\_type](#input\_metric\_aggregation\_type) | (Optional) The aggregation type for the policy's metrics. Valid values are `Minimum`, `Maximum`, and `Average`. Without a value, AWS will treat the aggregation type as `Average`. | `string` | `"Maximum"` | no |

examples/complete/README.md

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
- Add HTTPS inbound rule to load balancer security group for HTTPS to work
1818
- For this example `deletion_protection` is enabled for the load balancer. Change the argument ` enable_deletion_protection = true` to ` enable_deletion_protection = false` or delete it to disable this feature. Terraform will not be able to delete the resource if this feature is not enabled.
1919
- Ensure that traffic on port `5000` is allowed in the ALB security group. This example uses an image that is configured to listen on port `5000`. If you are using your own image, make sure to allow traffic for the port that your application is configured to.
20+
- This example also contains now a NLB configuration, no SSL/TLS is specified for the NLB, so it will be created as a TCP NLB. If you want to use a HTTP NLB, you need to specify a certificate for the NLB. See the [NLB documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html) for more information.
21+
- SSL/TLS support is enabled at the alb/nlb endpoint not end-to-end encryption, the certificate used is a self-signed certificate for testing and example purposes.
2022

2123
## Testing the deployment
2224
To test the deployment, follow these steps:
@@ -37,19 +39,21 @@ To test the deployment, follow these steps:
3739

3840
| Name | Version |
3941
|------|---------|
40-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.23.1 |
42+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.24.0 |
4143

4244
## Modules
4345

4446
| Name | Source | Version |
4547
|------|--------|---------|
46-
| <a name="module_access_logs_bucket"></a> [access\_logs\_bucket](#module\_access\_logs\_bucket) | boldlink/s3/aws | 2.2.0 |
47-
| <a name="module_ecs_service_lb"></a> [ecs\_service\_lb](#module\_ecs\_service\_lb) | ../../ | n/a |
48+
| <a name="module_access_logs_bucket"></a> [access\_logs\_bucket](#module\_access\_logs\_bucket) | boldlink/s3/aws | 2.3.1 |
49+
| <a name="module_ecs_service_alb"></a> [ecs\_service\_alb](#module\_ecs\_service\_alb) | ../../ | n/a |
50+
| <a name="module_ecs_service_nlb"></a> [ecs\_service\_nlb](#module\_ecs\_service\_nlb) | ../../ | n/a |
4851

4952
## Resources
5053

5154
| Name | Type |
5255
|------|------|
56+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
5357
| [aws_ecs_cluster.ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecs_cluster) | data source |
5458
| [aws_elb_service_account.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
5559
| [aws_iam_policy_document.access_logs_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -69,6 +73,7 @@ To test the deployment, follow these steps:
6973
| Name | Description | Type | Default | Required |
7074
|------|-------------|------|---------|:--------:|
7175
| <a name="input_access_logs_enabled"></a> [access\_logs\_enabled](#input\_access\_logs\_enabled) | Whether to enable access logs for the lb | `bool` | `true` | no |
76+
| <a name="input_alb_ingress_rules"></a> [alb\_ingress\_rules](#input\_alb\_ingress\_rules) | Incoming traffic configuration for the load balancer security group | `list(any)` | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": "Allow traffic to load balancer on port 443",<br> "from_port": 443,<br> "protocol": "tcp",<br> "to_port": 443<br> },<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": "Allow traffic to alb load balancer on port 80",<br> "from_port": 80,<br> "protocol": "tcp",<br> "to_port": 80<br> }<br>]</pre> | no |
7277
| <a name="input_containerport"></a> [containerport](#input\_containerport) | Specify container port | `number` | `5000` | no |
7378
| <a name="input_cpu"></a> [cpu](#input\_cpu) | The number of cpu units to allocate | `number` | `10` | no |
7479
| <a name="input_create_load_balancer"></a> [create\_load\_balancer](#input\_create\_load\_balancer) | Whether to create a load balancer for ecs. | `bool` | `true` | no |
@@ -80,10 +85,10 @@ To test the deployment, follow these steps:
8085
| <a name="input_force_new_deployment"></a> [force\_new\_deployment](#input\_force\_new\_deployment) | Enable to force a new task deployment of the service. This can be used to update tasks to use a newer Docker image with same image/tag combination (e.g., myimage:latest), roll Fargate tasks onto a newer platform version, or immediately deploy ordered\_placement\_strategy and placement\_constraints updates. | `bool` | `true` | no |
8186
| <a name="input_hostport"></a> [hostport](#input\_hostport) | Specify host port | `number` | `5000` | no |
8287
| <a name="input_image"></a> [image](#input\_image) | Name of image to pull from dockerhub | `string` | `"boldlink/flaskapp:latest"` | no |
83-
| <a name="input_lb_ingress_rules"></a> [lb\_ingress\_rules](#input\_lb\_ingress\_rules) | Incoming traffic configuration for the load balancer security group | `list(any)` | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": "Allow traffic to load balancer on port 443",<br> "from_port": 443,<br> "protocol": "tcp",<br> "to_port": 443<br> },<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": "Allow traffic to load balancer on port 80",<br> "from_port": 80,<br> "protocol": "tcp",<br> "to_port": 80<br> }<br>]</pre> | no |
8488
| <a name="input_memory"></a> [memory](#input\_memory) | The size of memory to allocate in MiBs | `number` | `512` | no |
8589
| <a name="input_name"></a> [name](#input\_name) | Name of the stack | `string` | `"complete-ecs-example"` | no |
8690
| <a name="input_network_mode"></a> [network\_mode](#input\_network\_mode) | Docker networking mode to use for the containers in the task. Valid values are none, bridge, awsvpc, and host. | `string` | `"awsvpc"` | no |
91+
| <a name="input_nlb_ingress_rules"></a> [nlb\_ingress\_rules](#input\_nlb\_ingress\_rules) | Incoming traffic configuration for the NLB load balancer security group | `list(any)` | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": "Allow traffic to nlb load balancer on port 5000",<br> "from_port": 5000,<br> "protocol": "tcp",<br> "to_port": 5000<br> }<br>]</pre> | no |
8792
| <a name="input_path"></a> [path](#input\_path) | Destination for the health check request. Required for HTTP/HTTPS ALB and HTTP NLB. Only applies to HTTP/HTTPS. | `string` | `"/healthz"` | no |
8893
| <a name="input_requires_compatibilities"></a> [requires\_compatibilities](#input\_requires\_compatibilities) | Set of launch types required by the task. The valid values are EC2 and FARGATE. | `list(string)` | <pre>[<br> "FARGATE"<br>]</pre> | no |
8994
| <a name="input_retention_in_days"></a> [retention\_in\_days](#input\_retention\_in\_days) | Number of days you want to retain log events in the specified log group. | `number` | `1` | no |
@@ -97,10 +102,8 @@ To test the deployment, follow these steps:
97102

98103
| Name | Description |
99104
|------|-------------|
100-
| <a name="output_lb_arn"></a> [lb\_arn](#output\_lb\_arn) | The load balancer arn/id |
101-
| <a name="output_lb_sg_id"></a> [lb\_sg\_id](#output\_lb\_sg\_id) | The ID of the load balancer security group |
102-
| <a name="output_service_sg_id"></a> [service\_sg\_id](#output\_service\_sg\_id) | The ID of the service security group |
103-
| <a name="output_task_definition_arn"></a> [task\_definition\_arn](#output\_task\_definition\_arn) | The task definition arn |
105+
| <a name="output_alb_service_url"></a> [alb\_service\_url](#output\_alb\_service\_url) | The task definition arn |
106+
| <a name="output_nlb_service_url"></a> [nlb\_service\_url](#output\_nlb\_service\_url) | The task definition arn |
104107
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
105108

106109
## Third party software

0 commit comments

Comments
 (0)