Skip to content

Commit 834c795

Browse files
ElsevierAlexElsevierAlex
authored
upgrade cloud custodian versions + make S3 bucket creation optional i… (#9)
1 parent 596bc38 commit 834c795

File tree

30 files changed

+267
-144
lines changed

30 files changed

+267
-144
lines changed

‎examples/cloudtrail/main.tf‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ locals {
77
}
88

99
module "cloud_custodian_s3" {
10+
count = var.create_bucket ? 1 : 0
1011
source = "terraform-aws-modules/s3-bucket/aws"
1112

1213
bucket = "${local.prefix}cloudtrail-${local.account_id}"
@@ -39,15 +40,17 @@ resource "aws_iam_role_policy" "custodian" {
3940
}
4041

4142
data "aws_iam_policy_document" "custodian" {
42-
statement {
43-
44-
actions = [
45-
"s3:PutObject",
46-
]
47-
48-
resources = [
49-
"${module.cloud_custodian_s3.s3_bucket_arn}/*",
50-
]
43+
dynamic "statement" {
44+
for_each = var.create_bucket ? ["${module.cloud_custodian_s3[0].s3_bucket_arn}/*"] : []
45+
content {
46+
actions = [
47+
"s3:PutObject",
48+
]
49+
50+
resources = [
51+
statement.value
52+
]
53+
}
5154
}
5255

5356
statement {
@@ -79,15 +82,16 @@ module "cloud_custodian_lambda" {
7982

8083
regions = [local.region]
8184

82-
execution_options = {
85+
execution_options = var.create_bucket ? {
8386
# Not really required but if you run custodian run you need to specify -s/--output-dir you'd then have execution-options
8487
# as part of the config.json with the output_dir that was specified
8588
"output_dir" = "s3://${local.prefix}cloudtrail-${local.account_id}/output?region=${local.region}"
86-
}
89+
} : {}
8790

8891
policies = templatefile("${path.module}/templates/policy.yaml.tpl", {
89-
prefix = local.prefix
90-
account_id = local.account_id
92+
prefix = local.prefix
93+
account_id = local.account_id
94+
create_bucket = var.create_bucket
9195
})
9296

9397
depends_on = [

‎examples/cloudtrail/templates/policy.yaml.tpl‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,11 @@ policies:
88
metrics_enabled: true
99
dryrun: false
1010
log_group: "/cloud-custodian/policies"
11-
output_dir: s3://${prefix}cloudtrail-${account_id}/output
12-
cache_dir: s3://${prefix}cloudtrail-${account_id}/cache
11+
%{ if create_bucket ~}
12+
output_dir: s3://$${prefix}cloudtrail-$${account_id}/output
13+
cache_dir: s3://$${prefix}cloudtrail-$${account_id}/cache
1314
cache_period: 15
15+
%{ endif ~}
1416
role: arn:aws:iam::${account_id}:role/${prefix}cloudtrail-lambda
1517
events:
1618
- source: ec2.amazonaws.com

‎examples/cloudtrail/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
variable "create_bucket" {
2+
description = "Whether to create the S3 bucket for Cloud Custodian results"
3+
type = bool
4+
default = true
5+
}

‎examples/config-rule/main.tf‎

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ locals {
77
}
88

99
module "cloud_custodian_s3" {
10+
count = var.create_bucket ? 1 : 0
1011
source = "terraform-aws-modules/s3-bucket/aws"
1112

1213
bucket = "${local.prefix}config-rule-${local.account_id}"
@@ -39,15 +40,17 @@ resource "aws_iam_role_policy" "custodian" {
3940
}
4041

4142
data "aws_iam_policy_document" "custodian" {
42-
statement {
43-
44-
actions = [
45-
"s3:PutObject",
46-
]
43+
dynamic "statement" {
44+
for_each = var.create_bucket ? ["${module.cloud_custodian_s3[0].s3_bucket_arn}/*"] : []
45+
content {
46+
actions = [
47+
"s3:PutObject",
48+
]
4749

48-
resources = [
49-
"${module.cloud_custodian_s3.s3_bucket_arn}/*",
50-
]
50+
resources = [
51+
statement.value
52+
]
53+
}
5154
}
5255

5356
statement {
@@ -103,11 +106,11 @@ module "cloud_custodian_lambda" {
103106

104107
regions = [local.region]
105108

106-
execution_options = {
109+
execution_options = var.create_bucket ? {
107110
# Not really required but if you run custodian run you need to specify -s/--output-dir you'd then have execution-options
108111
# as part of the config.json with the output_dir that was specified
109112
"output_dir" = "s3://${local.prefix}config-rule-${local.account_id}/output?region=${local.region}"
110-
}
113+
} : {}
111114
policies = <<EOF
112115
{
113116
"policies": [
@@ -116,14 +119,18 @@ module "cloud_custodian_lambda" {
116119
"mode": {
117120
"type": "config-rule",
118121
"function-prefix": "${local.prefix}",
119-
"execution-options": {
120-
"metrics_enabled": true,
121-
"dryrun": false,
122-
"log_group": "/cloud-custodian/policies",
123-
"output_dir": "s3://${local.prefix}config-rule-${local.account_id}/output",
124-
"cache_dir": "s3://${local.prefix}config-rule-${local.account_id}/cache",
125-
"cache_period": 15
126-
},
122+
"execution-options": ${jsonencode(merge(
123+
{
124+
metrics_enabled = true
125+
dryrun = false
126+
log_group = "/cloud-custodian/policies"
127+
},
128+
var.create_bucket ? {
129+
output_dir = "s3://${local.prefix}config-rule-${local.account_id}/output"
130+
cache_dir = "s3://${local.prefix}config-rule-${local.account_id}/cache"
131+
cache_period = 15
132+
} : {}
133+
))},
127134
"role": "arn:aws:iam::${local.account_id}:role/${local.prefix}config-rule-lambda"
128135
},
129136
"resource": "ec2",

‎examples/config-rule/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
variable "create_bucket" {
2+
description = "Whether to create the S3 bucket for Cloud Custodian results"
3+
type = bool
4+
default = true
5+
}

‎examples/ec2-instance-state/main.tf‎

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ locals {
77
}
88

99
module "cloud_custodian_s3" {
10+
count = var.create_bucket ? 1 : 0
1011
source = "terraform-aws-modules/s3-bucket/aws"
1112

1213
bucket = "${local.prefix}ec2-instance-state-${local.account_id}"
@@ -39,15 +40,17 @@ resource "aws_iam_role_policy" "custodian" {
3940
}
4041

4142
data "aws_iam_policy_document" "custodian" {
42-
statement {
43-
44-
actions = [
45-
"s3:PutObject",
46-
]
47-
48-
resources = [
49-
"${module.cloud_custodian_s3.s3_bucket_arn}/*",
50-
]
43+
dynamic "statement" {
44+
for_each = var.create_bucket ? ["${module.cloud_custodian_s3[0].s3_bucket_arn}/*"] : []
45+
content {
46+
actions = [
47+
"s3:PutObject",
48+
]
49+
50+
resources = [
51+
statement.value
52+
]
53+
}
5154
}
5255

5356
statement {
@@ -78,11 +81,11 @@ module "cloud_custodian_lambda" {
7881

7982
regions = [local.region]
8083

81-
execution_options = {
84+
execution_options = var.create_bucket ? {
8285
# Not really required but if you run custodian run you need to specify -s/--output-dir you'd then have execution-options
8386
# as part of the config.json with the output_dir that was specified
8487
"output_dir" = "s3://${local.prefix}ec2-instance-state-${local.account_id}/output?region=${local.region}"
85-
}
88+
} : {}
8689

8790
force_deploy = var.force_deploy
8891

@@ -94,14 +97,18 @@ module "cloud_custodian_lambda" {
9497
"mode": {
9598
"type": "ec2-instance-state",
9699
"function-prefix": "${local.prefix}",
97-
"execution-options": {
98-
"metrics_enabled": true,
99-
"dryrun": false,
100-
"log_group": "/cloud-custodian/policies",
101-
"output_dir": "s3://${local.prefix}ec2-instance-state-${local.account_id}/output",
102-
"cache_dir": "s3://${local.prefix}ec2-instance-state-${local.account_id}/cache",
103-
"cache_period": 15
104-
},
100+
"execution-options": ${jsonencode(merge(
101+
{
102+
metrics_enabled = true
103+
dryrun = false
104+
log_group = "/cloud-custodian/policies"
105+
},
106+
var.create_bucket ? {
107+
output_dir = "s3://${local.prefix}ec2-instance-state-${local.account_id}/output"
108+
cache_dir = "s3://${local.prefix}ec2-instance-state-${local.account_id}/cache"
109+
cache_period = 15
110+
} : {}
111+
))},
105112
"role": "arn:aws:iam::${local.account_id}:role/${local.prefix}ec2-instance-state-lambda",
106113
"events": [
107114
"terminated"

‎examples/ec2-instance-state/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
variable "create_bucket" {
2+
description = "Whether to create the S3 bucket for Cloud Custodian results"
3+
type = bool
4+
default = true
5+
}
6+
17
variable "force_deploy" {
28
description = <<EOT
39
Force redeployment of Lambda functions by updating a deployment timestamp tag.

‎examples/multi-policies/main.tf‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ locals {
66
}
77

88
module "cloud_custodian_s3" {
9+
count = var.create_bucket ? 1 : 0
910
source = "terraform-aws-modules/s3-bucket/aws"
1011

1112
bucket = "${local.prefix}multi-policies-${local.account_id}"
@@ -38,15 +39,17 @@ resource "aws_iam_role_policy" "custodian" {
3839
}
3940

4041
data "aws_iam_policy_document" "custodian" {
41-
statement {
42-
43-
actions = [
44-
"s3:PutObject",
45-
]
46-
47-
resources = [
48-
"${module.cloud_custodian_s3.s3_bucket_arn}/*",
49-
]
42+
dynamic "statement" {
43+
for_each = var.create_bucket ? ["${module.cloud_custodian_s3[0].s3_bucket_arn}/*"] : []
44+
content {
45+
actions = [
46+
"s3:PutObject",
47+
]
48+
49+
resources = [
50+
statement.value
51+
]
52+
}
5053
}
5154

5255
statement {
@@ -113,9 +116,16 @@ data "aws_iam_policy_document" "scheduler" {
113116
module "custodian_policies" {
114117
source = "../../modules/cloud-custodian-lambda-policies"
115118

119+
execution_options = var.create_bucket ? {
120+
# Not really required but if you run custodian run you need to specify -s/--output-dir you'd then have execution-options
121+
# as part of the config.json with the output_dir that was specified
122+
"output_dir" = "s3://${local.prefix}multi-policies-${local.account_id}/output"
123+
} : {}
124+
116125
policies = templatefile("${path.module}/templates/policies.yaml.tpl", {
117-
prefix = local.prefix
118-
account_id = local.account_id
126+
prefix = local.prefix
127+
account_id = local.account_id
128+
create_bucket = var.create_bucket
119129
})
120130
regions = var.regions
121131

‎examples/multi-policies/templates/policies.yaml.tpl‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,11 @@ policies:
1212
metrics_enabled: true
1313
dryrun: false
1414
log_group: "/cloud-custodian/policies"
15-
output_dir: s3://${prefix}multi-policies-${account_id}/output
16-
cache_dir: s3://${prefix}multi-policies-${account_id}/cache
15+
%{ if create_bucket ~}
16+
output_dir: s3://$${prefix}multi-policies-$${account_id}/output
17+
cache_dir: s3://$${prefix}multi-policies-$${account_id}/cache
1718
cache_period: 15
19+
%{ endif ~}
1820
schedule: cron(0 11 ? * 3 *)
1921
timezone: Europe/London
2022
scheduler-role: ${prefix}multi-policies-scheduler
@@ -31,9 +33,11 @@ policies:
3133
metrics_enabled: true
3234
dryrun: false
3335
log_group: "/cloud-custodian/policies"
34-
output_dir: s3://${prefix}multi-policies-${account_id}/output
35-
cache_dir: s3://${prefix}multi-policies-${account_id}/cache
36+
%{ if create_bucket ~}
37+
output_dir: s3://$${prefix}multi-policies-$${account_id}/output
38+
cache_dir: s3://$${prefix}multi-policies-$${account_id}/cache
3639
cache_period: 15
40+
%{ endif ~}
3741
schedule: cron(0 11 ? * 3 *)
3842
timezone: Europe/London
3943
scheduler-role: ${prefix}multi-policies-scheduler
@@ -51,9 +55,11 @@ policies:
5155
metrics_enabled: true
5256
dryrun: false
5357
log_group: "/cloud-custodian/policies"
54-
output_dir: s3://${prefix}multi-policies-${account_id}/output
55-
cache_dir: s3://${prefix}multi-policies-${account_id}/cache
58+
%{ if create_bucket ~}
59+
output_dir: s3://$${prefix}multi-policies-$${account_id}/output
60+
cache_dir: s3://$${prefix}multi-policies-$${account_id}/cache
5661
cache_period: 15
62+
%{ endif ~}
5763
role: "${prefix}multi-policies-lambda"
5864
events:
5965
- pending

‎examples/multi-policies/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
variable "create_bucket" {
2+
description = "Whether to create the S3 bucket for Cloud Custodian results"
3+
type = bool
4+
default = true
5+
}
6+
17
variable "regions" {
28
description = "Regions to deploy the policy to"
39
type = list(string)

0 commit comments

Comments
 (0)