Skip to content

Commit 0709447

Browse files
evanvolgasEvan Volgas
evanvolgas
and
Evan Volgas
authored
[GH Issue 85] Support Audit Logging (#86)
Co-authored-by: Evan Volgas <[email protected]>
1 parent f43c13c commit 0709447

20 files changed

+421
-53
lines changed

‎.github/CODEOWNERS

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Use this file to define individuals or teams that are responsible for code in a repository.
22
# Read more: <https://help.github.com/articles/about-codeowners/>
33
#
4-
# Order is important: the last matching pattern takes the most precedence
4+
# Order is important: the last matching pattern has the highest precedence
55

66
# These owners will be the default owners for everything
77
* @cloudposse/engineering @cloudposse/contributors
@@ -13,5 +13,12 @@
1313
# Cloud Posse must review any changes to GitHub actions
1414
.github/* @cloudposse/engineering
1515

16-
# Cloud Posse must review any changes to standard context definition
17-
**/context.tf @cloudposse/engineering
16+
# Cloud Posse must review any changes to standard context definition,
17+
# but some changes can be rubber-stamped.
18+
**/context.tf @cloudposse/engineering @cloudposse/approvers
19+
README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
20+
docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
21+
22+
# Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration
23+
.github/mergify.yml @cloudposse/admins
24+
.github/CODEOWNERS @cloudposse/admins

‎.github/auto-release.yml

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,35 @@ version-template: '$MAJOR.$MINOR.$PATCH'
44
version-resolver:
55
major:
66
labels:
7-
- 'major'
7+
- 'major'
88
minor:
99
labels:
10-
- 'minor'
11-
- 'enhancement'
10+
- 'minor'
11+
- 'enhancement'
1212
patch:
1313
labels:
14-
- 'patch'
15-
- 'fix'
16-
- 'bugfix'
17-
- 'bug'
18-
- 'hotfix'
14+
- 'auto-update'
15+
- 'patch'
16+
- 'fix'
17+
- 'bugfix'
18+
- 'bug'
19+
- 'hotfix'
1920
default: 'minor'
2021

2122
categories:
22-
- title: '🚀 Enhancements'
23-
labels:
24-
- 'enhancement'
25-
- title: '🐛 Bug Fixes'
26-
labels:
27-
- 'fix'
28-
- 'bugfix'
29-
- 'bug'
30-
- 'hotfix'
23+
- title: '🚀 Enhancements'
24+
labels:
25+
- 'enhancement'
26+
- 'patch'
27+
- title: '🐛 Bug Fixes'
28+
labels:
29+
- 'fix'
30+
- 'bugfix'
31+
- 'bug'
32+
- 'hotfix'
33+
- title: '🤖 Automatic Updates'
34+
labels:
35+
- 'auto-update'
3136

3237
change-template: |
3338
<details>

‎.github/mergify.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
pull_request_rules:
2+
- name: "approve automated PRs that have passed checks"
3+
conditions:
4+
- "check-success~=test/bats"
5+
- "check-success~=test/readme"
6+
- "check-success~=test/terratest"
7+
- "base=master"
8+
- "author=cloudpossebot"
9+
- "head~=auto-update/.*"
10+
actions:
11+
review:
12+
type: "APPROVE"
13+
bot_account: "cloudposse-mergebot"
14+
message: "We've automatically approved this PR because the checks from the automated Pull Request have passed."
15+
16+
- name: "merge automated PRs when approved and tests pass"
17+
conditions:
18+
- "check-success~=test/bats"
19+
- "check-success~=test/readme"
20+
- "check-success~=test/terratest"
21+
- "base=master"
22+
- "head~=auto-update/.*"
23+
- "#approved-reviews-by>=1"
24+
- "#changes-requested-reviews-by=0"
25+
- "#commented-reviews-by=0"
26+
- "base=master"
27+
- "author=cloudpossebot"
28+
actions:
29+
merge:
30+
method: "squash"
31+
32+
- name: "delete the head branch after merge"
33+
conditions:
34+
- "merged"
35+
actions:
36+
delete_head_branch: {}
37+
38+
- name: "ask to resolve conflict"
39+
conditions:
40+
- "conflict"
41+
actions:
42+
comment:
43+
message: "This pull request is now in conflict. Could you fix it @{{author}}? 🙏"
44+
45+
- name: "remove outdated reviews"
46+
conditions:
47+
- "base=master"
48+
actions:
49+
dismiss_reviews:
50+
changes_requested: true
51+
approved: true
52+
message: "This Pull Request has been updated, so we're dismissing all reviews."

‎.github/workflows/auto-context.yml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: "auto-context"
2+
on:
3+
schedule:
4+
# Update context.tf nightly
5+
- cron: '0 3 * * *'
6+
7+
jobs:
8+
update:
9+
if: github.event_name == 'schedule'
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v2
13+
14+
- name: Update context.tf
15+
shell: bash
16+
id: update
17+
env:
18+
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
19+
run: |
20+
if [[ -f context.tf ]]; then
21+
echo "Discovered existing context.tf! Fetching most recent version to see if there is an update."
22+
curl -o context.tf -fsSL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf
23+
if git diff --no-patch --exit-code context.tf; then
24+
echo "No changes detected! Exiting the job..."
25+
else
26+
echo "context.tf file has changed. Update examples and rebuild README.md."
27+
make init
28+
make github/init/context.tf
29+
make readme/build
30+
echo "::set-output name=create_pull_request=true"
31+
fi
32+
else
33+
echo "This module has not yet been updated to support the context.tf pattern! Please update in order to support automatic updates."
34+
fi
35+
36+
- name: Create Pull Request
37+
if: steps.update.outputs.create_pull_request == 'true'
38+
uses: cloudposse/actions/github/[email protected]
39+
with:
40+
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
41+
commit-message: Update context.tf from origin source
42+
title: Update context.tf
43+
body: |-
44+
## what
45+
This is an auto-generated PR that updates the `context.tf` file to the latest version from `cloudposse/terraform-null-label`
46+
47+
## why
48+
To support all the features of the `context` interface.
49+
50+
branch: auto-update/context.tf
51+
base: master
52+
delete-branch: true
53+
labels: |
54+
auto-update
55+
context

‎.github/workflows/auto-readme.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: "auto-readme"
2+
on:
3+
schedule:
4+
# Update README.md nightly
5+
- cron: '0 4 * * *'
6+
7+
jobs:
8+
update:
9+
if: github.event_name == 'schedule'
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v2
13+
14+
- name: Update readme
15+
shell: bash
16+
id: update
17+
env:
18+
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
19+
run: |
20+
make init
21+
make readme/build
22+
23+
- name: Create Pull Request
24+
uses: cloudposse/actions/github/[email protected]
25+
with:
26+
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
27+
commit-message: Update README.md and docs
28+
title: Update README.md and docs
29+
body: |-
30+
## what
31+
This is an auto-generated PR that updates the README.md and docs
32+
33+
## why
34+
To have most recent changes of README.md and doc from origin templates
35+
36+
branch: auto-update/readme
37+
base: master
38+
delete-branch: true
39+
labels: |
40+
auto-update
41+
readme

‎.github/workflows/auto-release.yml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,17 @@ name: auto-release
33
on:
44
push:
55
branches:
6-
- master
6+
- master
77

88
jobs:
99
semver:
1010
runs-on: ubuntu-latest
1111
steps:
12-
# Drafts your next Release notes as Pull Requests are merged into "master"
13-
- uses: release-drafter/release-drafter@v5
14-
with:
15-
publish: true
16-
prerelease: false
17-
config-name: auto-release.yml
18-
env:
19-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12+
# Drafts your next Release notes as Pull Requests are merged into "master"
13+
- uses: release-drafter/release-drafter@v5
14+
with:
15+
publish: true
16+
prerelease: false
17+
config-name: auto-release.yml
18+
env:
19+
GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}

‎.github/workflows/chatops.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
steps:
1010
- uses: actions/checkout@v2
1111
- name: "Handle common commands"
12-
uses: cloudposse/actions/github/slash-command-dispatch@0.16.0
12+
uses: cloudposse/actions/github/slash-command-dispatch@0.22.0
1313
with:
1414
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
1515
reaction-token: ${{ secrets.GITHUB_TOKEN }}
@@ -24,7 +24,7 @@ jobs:
2424
- name: "Checkout commit"
2525
uses: actions/checkout@v2
2626
- name: "Run tests"
27-
uses: cloudposse/actions/github/slash-command-dispatch@0.16.0
27+
uses: cloudposse/actions/github/slash-command-dispatch@0.22.0
2828
with:
2929
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
3030
reaction-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/validate-codeowners.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Validate Codeowners
2+
on:
3+
pull_request:
4+
5+
jobs:
6+
validate-codeowners:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- name: "Checkout source code at current commit"
10+
uses: actions/checkout@v2
11+
- uses: mszostok/[email protected]
12+
if: github.event.pull_request.head.repo.full_name == github.repository
13+
name: "Full check of CODEOWNERS"
14+
with:
15+
# For now, remove "files" check to allow CODEOWNERS to specify non-existent
16+
# files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos
17+
# checks: "files,syntax,owners,duppatterns"
18+
checks: "syntax,owners,duppatterns"
19+
# GitHub access token is required only if the `owners` check is enabled
20+
github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
21+
- uses: mszostok/[email protected]
22+
if: github.event.pull_request.head.repo.full_name != github.repository
23+
name: "Syntax check of CODEOWNERS"
24+
with:
25+
checks: "syntax,duppatterns"

‎README.md

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1+
<!-- markdownlint-disable -->
12
# terraform-aws-elasticsearch [![Codefresh Build Status](https://g.codefresh.io/api/badges/pipeline/cloudposse/terraform-modules%2Fterraform-aws-elasticsearch?type=cf-1)](https://g.codefresh.io/public/accounts/cloudposse/pipelines/5d22bfe5a7e22ea3b67ea820) [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-elasticsearch.svg)](https://github.com/cloudposse/terraform-aws-elasticsearch/releases/latest) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
3+
<!-- markdownlint-restore -->
24

35
[![README Header][readme_header_img]][readme_header_link]
46

@@ -75,14 +77,23 @@ If you don't enable zone awareness, Amazon ES places an endpoint into only one s
7577
## Usage
7678

7779

78-
**IMPORTANT:** The `master` branch is used in `source` just as an example. In your code, do not pin to `master` because there may be breaking changes between releases.
79-
Instead pin to the release tag (e.g. `?ref=tags/x.y.z`) of one of our [latest releases](https://github.com/cloudposse/terraform-aws-elasticsearch/releases).
80+
**IMPORTANT:** We do not pin modules to versions in our examples because of the
81+
difficulty of keeping the versions in the documentation in sync with the latest released versions.
82+
We highly recommend that in your code you pin the version to the exact version you are
83+
using so that your infrastructure remains stable, and update versions in a
84+
systematic way so that they do not catch you by surprise.
85+
86+
Also, because of a bug in the Terraform registry ([hashicorp/terraform#21417](https://github.com/hashicorp/terraform/issues/21417)),
87+
the registry shows many of our inputs as required when in fact they are optional.
88+
The table below correctly indicates which inputs are required.
8089

8190

8291

8392
```hcl
8493
module "elasticsearch" {
85-
source = "git::https://github.com/cloudposse/terraform-aws-elasticsearch.git?ref=master"
94+
source = "cloudposse/elasticsearch/aws"
95+
# Cloud Posse recommends pinning every module to a specific version
96+
# version = "x.x.x"
8697
namespace = "eg"
8798
stage = "dev"
8899
name = "es"
@@ -136,7 +147,7 @@ Available targets:
136147

137148
| Name | Version |
138149
|------|---------|
139-
| terraform | >= 0.12.0 |
150+
| terraform | >= 0.12.26 |
140151
| aws | >= 2.0 |
141152
| null | >= 2.0 |
142153
| template | >= 2.0 |
@@ -200,6 +211,8 @@ Available targets:
200211
| label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
201212
| log\_publishing\_application\_cloudwatch\_log\_group\_arn | ARN of the CloudWatch log group to which log for ES\_APPLICATION\_LOGS needs to be published | `string` | `""` | no |
202213
| log\_publishing\_application\_enabled | Specifies whether log publishing option for ES\_APPLICATION\_LOGS is enabled or not | `bool` | `false` | no |
214+
| log\_publishing\_audit\_cloudwatch\_log\_group\_arn | ARN of the CloudWatch log group to which log for AUDIT\_LOGS needs to be published | `string` | `""` | no |
215+
| log\_publishing\_audit\_enabled | Specifies whether log publishing option for AUDIT\_LOGS is enabled or not | `bool` | `false` | no |
203216
| log\_publishing\_index\_cloudwatch\_log\_group\_arn | ARN of the CloudWatch log group to which log for INDEX\_SLOW\_LOGS needs to be published | `string` | `""` | no |
204217
| log\_publishing\_index\_enabled | Specifies whether log publishing option for INDEX\_SLOW\_LOGS is enabled or not | `bool` | `false` | no |
205218
| log\_publishing\_search\_cloudwatch\_log\_group\_arn | ARN of the CloudWatch log group to which log for SEARCH\_SLOW\_LOGS needs to be published | `string` | `""` | no |
@@ -382,8 +395,10 @@ Check out [our other projects][github], [follow us on twitter][twitter], [apply
382395

383396
### Contributors
384397

398+
<!-- markdownlint-disable -->
385399
| [![Erik Osterman][osterman_avatar]][osterman_homepage]<br/>[Erik Osterman][osterman_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] | [![Igor Rodionov][goruha_avatar]][goruha_homepage]<br/>[Igor Rodionov][goruha_homepage] | [![Sarkis Varozian][sarkis_avatar]][sarkis_homepage]<br/>[Sarkis Varozian][sarkis_homepage] | [![Marcin Brański][3h4x_avatar]][3h4x_homepage]<br/>[Marcin Brański][3h4x_homepage] |
386400
|---|---|---|---|---|
401+
<!-- markdownlint-restore -->
387402

388403
[osterman_homepage]: https://github.com/osterman
389404
[osterman_avatar]: https://img.cloudposse.com/150x150/https://github.com/osterman.png

‎README.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,9 @@ usage: |-
5757
5858
```hcl
5959
module "elasticsearch" {
60-
source = "git::https://github.com/cloudposse/terraform-aws-elasticsearch.git?ref=master"
60+
source = "cloudposse/elasticsearch/aws"
61+
# Cloud Posse recommends pinning every module to a specific version
62+
# version = "x.x.x"
6163
namespace = "eg"
6264
stage = "dev"
6365
name = "es"

0 commit comments

Comments
 (0)