Skip to content

Commit 4033bfe

Browse files
afiuneafiune
authored
Merge pull request #1299 from lacework/GROW-1336
chore(lwgenerate): deprecate force_destroy flags
2 parents 3a7c0d4 + aafcf3a commit 4033bfe

30 files changed

+121
-210
lines changed

‎cli/cmd/generate_aws.go‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ var (
2424
QuestionConsolidatedCloudtrail = "Use consolidated CloudTrail?"
2525
QuestionUseExistingCloudtrail = "Use an existing CloudTrail?"
2626
QuestionCloudtrailExistingBucketArn = "Specify an existing bucket ARN used for CloudTrail logs:"
27-
QuestionForceDestroyS3Bucket = "Should the new S3 bucket have force destroy enabled?"
2827
QuestionExistingIamRoleName = "Specify an existing IAM role name for CloudTrail access:"
2928
QuestionExistingIamRoleArn = "Specify an existing IAM role ARN for CloudTrail access:"
3029
QuestionExistingIamRoleExtID = "Specify the external ID to be used with the existing IAM role:"
@@ -129,10 +128,6 @@ See help output for more details on the parameter value(s) required for Terrafor
129128
aws.WithS3BucketNotification(GenerateAwsCommandState.S3BucketNotification),
130129
}
131130

132-
if GenerateAwsCommandState.ForceDestroyS3Bucket {
133-
mods = append(mods, aws.EnableForceDestroyS3Bucket())
134-
}
135-
136131
if GenerateAwsCommandState.ConsolidatedCloudtrail {
137132
mods = append(mods, aws.UseConsolidatedCloudtrail())
138133
}
@@ -393,11 +388,18 @@ func initGenerateAwsTfCommandFlags() {
393388
"consolidated_cloudtrail",
394389
false,
395390
"use consolidated trail")
391+
392+
// DEPRECATED
396393
generateAwsTfCommand.PersistentFlags().BoolVar(
397394
&GenerateAwsCommandState.ForceDestroyS3Bucket,
398395
"force_destroy_s3",
399-
false,
396+
true,
400397
"enable force destroy S3 bucket")
398+
errcheckWARN(generateAwsTfCommand.PersistentFlags().MarkDeprecated(
399+
"force_destroy_s3", "by default, force destroy is enabled.",
400+
))
401+
// ---
402+
401403
generateAwsTfCommand.PersistentFlags().StringSliceVar(
402404
&GenerateAwsCommandExtraState.AwsSubAccounts,
403405
"aws_subaccount",
@@ -513,14 +515,8 @@ func promptAwsCtQuestions(config *aws.GenerateAwsTfConfigurationArgs, extraState
513515
return err
514516
}
515517

516-
// If a new bucket is to be created; should the force destroy bit be set?
517518
newBucket := config.ExistingCloudtrailBucketArn == ""
518519
if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
519-
{
520-
Prompt: &survey.Confirm{Message: QuestionForceDestroyS3Bucket, Default: config.ForceDestroyS3Bucket},
521-
Response: &config.ForceDestroyS3Bucket,
522-
Checks: []*bool{&config.Cloudtrail, &newBucket},
523-
},
524520
// If new bucket created, allow user to optionally name the bucket
525521
{
526522
Prompt: &survey.Input{Message: QuestionBucketName, Default: config.BucketName},
@@ -857,7 +853,6 @@ func awsConfigIsEmpty(g *aws.GenerateAwsTfConfigurationArgs) bool {
857853
g.ExistingIamRole == nil &&
858854
g.ExistingSnsTopicArn == "" &&
859855
g.LaceworkProfile == "" &&
860-
!g.ForceDestroyS3Bucket &&
861856
g.SubAccounts == nil
862857
}
863858

‎cli/cmd/generate_aws_eks_audit.go‎

Lines changed: 20 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -28,19 +28,18 @@ var (
2828
QuestionEksAuditConfigureAdvanced = "Configure advanced integration options?"
2929

3030
// S3 Bucket Questions
31-
QuestionUseExistingBucket = "Use existing bucket?"
32-
QuestionExistingBucketArn = "Specify an existing bucket ARN used for EKS audit log:"
33-
EksAuditConfigureBucket = "Configure bucket settings"
34-
QuestionEksAuditBucketVersioning = "Enable access versioning on the new bucket?"
35-
QuestionEksAuditMfaDeleteS3Bucket = "Should MFA object deletion be required for the new bucket?"
36-
QuestionEksAuditForceDestroyS3Bucket = "Should force destroy be enabled for the new bucket?"
37-
QuestionEksAuditBucketLifecycle = "Specify the bucket lifecycle expiration days: (optional)"
38-
QuestionEksAuditBucketEncryption = "Enable encryption for the new bucket?"
39-
QuestionEksAuditBucketSseAlgorithm = "Specify the bucket SSE Algorithm: (optional)"
40-
QuestionEksAuditBucketExistingKey = "Use existing KMS key?"
41-
QuestionEksAuditBucketKeyArn = "Specify the bucket existing SSE KMS key ARN:"
42-
QuestionEksAuditKmsKeyRotation = "Should the KMS key have rotation enabled?"
43-
QuestionEksAuditKmsKeyDeletionDays = "Specify the KMS key deletion days: (optional)"
31+
QuestionUseExistingBucket = "Use existing bucket?"
32+
QuestionExistingBucketArn = "Specify an existing bucket ARN used for EKS audit log:"
33+
EksAuditConfigureBucket = "Configure bucket settings"
34+
QuestionEksAuditBucketVersioning = "Enable access versioning on the new bucket?"
35+
QuestionEksAuditMfaDeleteS3Bucket = "Should MFA object deletion be required for the new bucket?"
36+
QuestionEksAuditBucketLifecycle = "Specify the bucket lifecycle expiration days: (optional)"
37+
QuestionEksAuditBucketEncryption = "Enable encryption for the new bucket?"
38+
QuestionEksAuditBucketSseAlgorithm = "Specify the bucket SSE Algorithm: (optional)"
39+
QuestionEksAuditBucketExistingKey = "Use existing KMS key?"
40+
QuestionEksAuditBucketKeyArn = "Specify the bucket existing SSE KMS key ARN:"
41+
QuestionEksAuditKmsKeyRotation = "Should the KMS key have rotation enabled?"
42+
QuestionEksAuditKmsKeyDeletionDays = "Specify the KMS key deletion days: (optional)"
4443

4544
// SNS Topic Questions
4645
EksAuditConfigureSns = "Configure SNS settings"
@@ -149,10 +148,6 @@ See help output for more details on the parameter values required for Terraform
149148
mods = append(mods, aws_eks_audit.EnableBucketMfaDelete())
150149
}
151150

152-
if GenerateAwsEksAuditCommandState.BucketForceDestroy {
153-
mods = append(mods, aws_eks_audit.EnableBucketForceDestroy())
154-
}
155-
156151
// Create new struct
157152
data := aws_eks_audit.NewTerraform(mods...)
158153

@@ -353,11 +348,18 @@ func initGenerateAwsEksAuditTfCommandFlags() {
353348
"enable_encryption_s3",
354349
true,
355350
"enable encryption on s3 bucket")
351+
352+
// DEPRECATED
356353
generateAwsEksAuditTfCommand.PersistentFlags().BoolVar(
357354
&GenerateAwsEksAuditCommandState.BucketForceDestroy,
358355
"enable_force_destroy",
359-
false,
356+
true,
360357
"enable force destroy s3 bucket")
358+
errcheckWARN(generateAwsEksAuditTfCommand.PersistentFlags().MarkDeprecated(
359+
"enable_force_destroy", "by default, force destroy is enabled.",
360+
))
361+
// ---
362+
361363
generateAwsEksAuditTfCommand.PersistentFlags().IntVar(
362364
&GenerateAwsEksAuditCommandState.BucketLifecycleExpirationDays,
363365
"bucket_lifecycle_exp_days",
@@ -519,10 +521,6 @@ func promptAwsEksAuditBucketQuestions(config *aws_eks_audit.GenerateAwsEksAuditT
519521
Prompt: &survey.Confirm{Message: QuestionEksAuditMfaDeleteS3Bucket, Default: config.BucketEnableMfaDelete},
520522
Response: &config.BucketEnableMfaDelete,
521523
},
522-
{
523-
Prompt: &survey.Confirm{Message: QuestionEksAuditForceDestroyS3Bucket, Default: config.BucketForceDestroy},
524-
Response: &config.BucketForceDestroy,
525-
},
526524
{
527525
Prompt: &survey.Confirm{Message: QuestionEksAuditBucketEncryption,
528526
Default: config.BucketEnableEncryption},

‎cli/cmd/generate_gcp.go‎

Lines changed: 18 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -29,17 +29,16 @@ var (
2929
QuestionExistingServiceAccountName = "Specify an existing service account name:"
3030
QuestionExistingServiceAccountPrivateKey = "Specify an existing service account private key (base64 encoded):"
3131

32-
GcpAdvancedOptAuditLog = "Configure additional Audit Log options"
33-
QuestionGcpUseExistingBucket = "Use an existing bucket?"
34-
QuestionGcpExistingBucketName = "Specify an existing bucket name:"
35-
QuestionGcpConfigureNewBucket = "Configure settings for new bucket?"
36-
QuestionGcpBucketRegion = "Specify the bucket region: (optional)"
37-
QuestionGcpCustomBucketName = "Specify a custom bucket name: (optional)"
38-
QuestionGcpBucketLifecycle = "Specify the bucket lifecycle rule age: (optional)"
39-
QuestionGcpEnableUBLA = "Enable uniform bucket level access(UBLA)?"
40-
QuestionGcpEnableBucketForceDestroy = "Enable bucket force destroy?"
41-
QuestionGcpUseExistingSink = "Use an existing sink?"
42-
QuestionGcpExistingSinkName = "Specify the existing sink name"
32+
GcpAdvancedOptAuditLog = "Configure additional Audit Log options"
33+
QuestionGcpUseExistingBucket = "Use an existing bucket?"
34+
QuestionGcpExistingBucketName = "Specify an existing bucket name:"
35+
QuestionGcpConfigureNewBucket = "Configure settings for new bucket?"
36+
QuestionGcpBucketRegion = "Specify the bucket region: (optional)"
37+
QuestionGcpCustomBucketName = "Specify a custom bucket name: (optional)"
38+
QuestionGcpBucketLifecycle = "Specify the bucket lifecycle rule age: (optional)"
39+
QuestionGcpEnableUBLA = "Enable uniform bucket level access(UBLA)?"
40+
QuestionGcpUseExistingSink = "Use an existing sink?"
41+
QuestionGcpExistingSinkName = "Specify the existing sink name"
4342

4443
GcpAdvancedOptIntegrationName = "Customize integration name(s)"
4544
QuestionGcpConfigurationIntegrationName = "Specify a custom configuration integration name: (optional)"
@@ -127,10 +126,6 @@ See help output for more details on the parameter value(s) required for Terrafor
127126
mods = append(mods, gcp.WithOrganizationIntegration(GenerateGcpCommandState.OrganizationIntegration))
128127
}
129128

130-
if GenerateGcpCommandState.EnableForceDestroyBucket {
131-
mods = append(mods, gcp.WithEnableForceDestroyBucket())
132-
}
133-
134129
if len(GenerateGcpCommandState.FoldersToExclude) > 0 {
135130
mods = append(mods, gcp.WithIncludeRootProjects(GenerateGcpCommandState.IncludeRootProjects))
136131
}
@@ -366,11 +361,18 @@ func initGenerateGcpTfCommandFlags() {
366361
"existing_sink_name",
367362
"",
368363
"specify existing sink name")
364+
365+
// DEPRECATED
369366
generateGcpTfCommand.PersistentFlags().BoolVar(
370367
&GenerateGcpCommandState.EnableForceDestroyBucket,
371368
"enable_force_destroy_bucket",
372-
false,
369+
true,
373370
"enable force bucket destroy")
371+
errcheckWARN(generateGcpTfCommand.PersistentFlags().MarkDeprecated(
372+
"enable_force_destroy_bucket", "by default, force destroy is enabled.",
373+
))
374+
// ---
375+
374376
generateGcpTfCommand.PersistentFlags().BoolVar(
375377
&GenerateGcpCommandState.EnableUBLA,
376378
"enable_ubla",
@@ -562,12 +564,6 @@ func promptGcpBucketConfiguration(config *gcp.GenerateGcpTfConfigurationArgs, ex
562564
Required: true,
563565
Response: &config.EnableUBLA,
564566
},
565-
{
566-
Prompt: &survey.Confirm{Message: QuestionGcpEnableBucketForceDestroy, Default: config.EnableForceDestroyBucket},
567-
Checks: []*bool{&config.AuditLog, &newBucket, &extraState.UseExistingBucket, usePubSubActivityDisabled(config)},
568-
Required: true,
569-
Response: &config.EnableForceDestroyBucket,
570-
},
571567
}, config.AuditLog)
572568

573569
return err

‎cli/docs/lacework_generate_k8s_eks.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ lacework generate k8s eks [flags]
4545
--enable_bucket_versioning enable s3 bucket versioning (default true)
4646
--enable_encryption_s3 enable encryption on s3 bucket (default true)
4747
--enable_firehose_encryption enable firehose encryption (default true)
48-
--enable_force_destroy enable force destroy s3 bucket
4948
--enable_kms_key_rotation enable automatic kms key rotation (default true)
5049
--enable_mfa_delete_s3 enable mfa delete on s3 bucket. Requires bucket versioning.
5150
--enable_sns_topic_encryption enable encryption on the sns topic (default true)

‎integration/aws_eks_audit_generation_test.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ func TestGenerationEksSingleRegionAdvancedBucket(t *testing.T) {
9292
MsgRsp{cmd.QuestionUseExistingBucket, "n"},
9393
MsgRsp{cmd.QuestionEksAuditBucketVersioning, "y"},
9494
MsgRsp{cmd.QuestionEksAuditMfaDeleteS3Bucket, "y"},
95-
MsgRsp{cmd.QuestionEksAuditForceDestroyS3Bucket, "y"},
9695
MsgRsp{cmd.QuestionEksAuditBucketEncryption, "y"},
9796
MsgRsp{cmd.QuestionEksAuditBucketExistingKey, "n"},
9897
MsgRsp{cmd.QuestionEksAuditBucketSseAlgorithm, ""},
@@ -118,7 +117,6 @@ func TestGenerationEksSingleRegionAdvancedBucket(t *testing.T) {
118117
aws_eks_audit.WithParsedRegionClusterMap(regionClusterMap),
119118
aws_eks_audit.EnableBucketVersioning(true),
120119
aws_eks_audit.EnableBucketMfaDelete(),
121-
aws_eks_audit.EnableBucketForceDestroy(),
122120
aws_eks_audit.EnableBucketEncryption(true),
123121
aws_eks_audit.EnableKmsKeyRotation(true),
124122
aws_eks_audit.WithKmsKeyDeletionDays(30),
@@ -143,7 +141,6 @@ func TestGenerationEksSingleRegionAdvancedBucketExistingKey(t *testing.T) {
143141
MsgRsp{cmd.QuestionUseExistingBucket, "n"},
144142
MsgRsp{cmd.QuestionEksAuditBucketVersioning, "y"},
145143
MsgRsp{cmd.QuestionEksAuditMfaDeleteS3Bucket, "y"},
146-
MsgRsp{cmd.QuestionEksAuditForceDestroyS3Bucket, "y"},
147144
MsgRsp{cmd.QuestionEksAuditBucketEncryption, "y"},
148145
MsgRsp{cmd.QuestionEksAuditBucketExistingKey, "y"},
149146
MsgRsp{cmd.QuestionEksAuditBucketSseAlgorithm, ""},
@@ -168,7 +165,6 @@ func TestGenerationEksSingleRegionAdvancedBucketExistingKey(t *testing.T) {
168165
aws_eks_audit.WithParsedRegionClusterMap(regionClusterMap),
169166
aws_eks_audit.EnableBucketVersioning(true),
170167
aws_eks_audit.EnableBucketMfaDelete(),
171-
aws_eks_audit.EnableBucketForceDestroy(),
172168
aws_eks_audit.EnableBucketEncryption(true),
173169
aws_eks_audit.WithBucketSseKeyArn("arn:aws:kms:us-west-2:249446771485:key/2537e820-be82-4ded-8dca-504e199b0903"),
174170
aws_eks_audit.WithBucketLifecycleExpirationDays(30),

‎integration/aws_generation_test.go‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -197,8 +197,8 @@ func TestGenerationAwsAdvancedOptsDone(t *testing.T) {
197197
assert.Equal(t, buildTf, tfResult)
198198
}
199199

200-
// Test enabling consolidated trail and force destroy s3
201-
func TestGenerationAwsAdvancedOptsConsolidatedAndForceDestroy(t *testing.T) {
200+
// Test enabling consolidated trail
201+
func TestGenerationAwsAdvancedOptsConsolidated(t *testing.T) {
202202
os.Setenv("LW_NOCACHE", "true")
203203
defer os.Setenv("LW_NOCACHE", "")
204204
var final string
@@ -217,7 +217,6 @@ func TestGenerationAwsAdvancedOptsConsolidatedAndForceDestroy(t *testing.T) {
217217
MsgRsp{cmd.QuestionUseExistingCloudtrail, "n"},
218218
MsgRsp{cmd.QuestionCloudtrailName, ""},
219219
// S3 Bucket Questions
220-
MsgRsp{cmd.QuestionForceDestroyS3Bucket, "y"},
221220
MsgRsp{cmd.QuestionBucketName, ""},
222221
MsgRsp{cmd.QuestionBucketEnableEncryption, "y"},
223222
MsgRsp{cmd.QuestionBucketSseKeyArn, ""},
@@ -247,7 +246,6 @@ func TestGenerationAwsAdvancedOptsConsolidatedAndForceDestroy(t *testing.T) {
247246
// Create the TF directly with lwgenerate and validate same result via CLI
248247
buildTf, _ := aws.NewTerraform(region, true, true,
249248
aws.UseConsolidatedCloudtrail(),
250-
aws.EnableForceDestroyS3Bucket(),
251249
aws.WithBucketEncryptionEnabled(true),
252250
aws.WithSnsTopicEncryptionEnabled(true),
253251
aws.WithSqsEncryptionEnabled(true),
@@ -326,7 +324,6 @@ func TestGenerationAwsAdvancedOptsConsolidatedWithSubAccounts(t *testing.T) {
326324
MsgRsp{cmd.QuestionConsolidatedCloudtrail, "y"},
327325
MsgRsp{cmd.QuestionUseExistingCloudtrail, "n"},
328326
MsgRsp{cmd.QuestionCloudtrailName, ""},
329-
MsgRsp{cmd.QuestionForceDestroyS3Bucket, "n"},
330327
MsgRsp{cmd.QuestionBucketName, ""},
331328
MsgRsp{cmd.QuestionBucketEnableEncryption, "y"},
332329
MsgRsp{cmd.QuestionBucketSseKeyArn, ""},
@@ -592,7 +589,6 @@ func TestGenerationAwsAdvancedOptsCreateNewElements(t *testing.T) {
592589
MsgRsp{cmd.QuestionUseExistingCloudtrail, "n"},
593590
MsgRsp{cmd.QuestionCloudtrailName, trailName},
594591
// S3 Questions
595-
MsgRsp{cmd.QuestionForceDestroyS3Bucket, "y"},
596592
MsgRsp{cmd.QuestionBucketName, bucketName},
597593
MsgRsp{cmd.QuestionBucketEnableEncryption, "y"},
598594
MsgRsp{cmd.QuestionBucketSseKeyArn, kmsArn},
@@ -622,7 +618,6 @@ func TestGenerationAwsAdvancedOptsCreateNewElements(t *testing.T) {
622618
// Create the TF directly with lwgenerate and validate same result via CLI
623619
buildTf, _ := aws.NewTerraform(region, true, true,
624620
aws.WithCloudtrailName(trailName),
625-
aws.EnableForceDestroyS3Bucket(),
626621
aws.WithBucketName(bucketName),
627622
aws.WithBucketEncryptionEnabled(true),
628623
aws.WithBucketSSEKeyArn(kmsArn),
@@ -881,7 +876,6 @@ func TestGenerationAwsS3BucketNotificationInteractive(t *testing.T) {
881876
MsgRsp{cmd.QuestionUseExistingCloudtrail, ""},
882877
MsgRsp{cmd.QuestionCloudtrailName, ""},
883878
// S3 Questions
884-
MsgRsp{cmd.QuestionForceDestroyS3Bucket, ""},
885879
MsgRsp{cmd.QuestionBucketName, ""},
886880
MsgRsp{cmd.QuestionBucketEnableEncryption, ""},
887881
MsgRsp{cmd.QuestionBucketSseKeyArn, ""},

‎lwgenerate/aws/aws.go‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ type GenerateAwsTfConfigurationArgs struct {
9797
ConsolidatedCloudtrail bool
9898

9999
// Should we force destroy the bucket if it has stuff in it? (only relevant on new Cloudtrail creation)
100+
// DEPRECATED
100101
ForceDestroyS3Bucket bool
101102

102103
// Enable encryption of bucket if it is created
@@ -241,13 +242,6 @@ func UseConsolidatedCloudtrail() AwsTerraformModifier {
241242
}
242243
}
243244

244-
// EnableForceDestroyS3Bucket Set the S3 ForceDestroy parameter to true for newly created buckets
245-
func EnableForceDestroyS3Bucket() AwsTerraformModifier {
246-
return func(c *GenerateAwsTfConfigurationArgs) {
247-
c.ForceDestroyS3Bucket = true
248-
}
249-
}
250-
251245
// UseExistingIamRole Set an existing IAM role configuration to use with the created Terraform code
252246
func UseExistingIamRole(iamDetails *ExistingIamRoleDetails) AwsTerraformModifier {
253247
return func(c *GenerateAwsTfConfigurationArgs) {
@@ -525,9 +519,6 @@ func createCloudtrail(args *GenerateAwsTfConfigurationArgs) (*hclwrite.Block, er
525519
attributes["use_existing_cloudtrail"] = true
526520
attributes["bucket_arn"] = args.ExistingCloudtrailBucketArn
527521
} else {
528-
if args.ForceDestroyS3Bucket {
529-
attributes["bucket_force_destroy"] = true
530-
}
531522
if args.BucketName != "" {
532523
attributes["bucket_name"] = args.BucketName
533524
}

0 commit comments

Comments
 (0)