Skip to content

Commit 82b7da8

Browse files
bryantbiggsbryantbiggs
committed
chore: update examples to be more secure and follow recommended practices
1 parent e772bec commit 82b7da8

File tree

5 files changed

+97
-27
lines changed

5 files changed

+97
-27
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: git://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.50.0
3+
rev: v1.51.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_docs

‎examples/complete/README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,18 @@ Note that this example may create resources which will incur monetary charges on
3030

3131
| Name | Version |
3232
|------|---------|
33-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0 |
34-
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
33+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 3.59.0 |
34+
| <a name="provider_random"></a> [random](#provider\_random) | 3.1.0 |
3535

3636
## Modules
3737

3838
| Name | Source | Version |
3939
|------|--------|---------|
4040
| <a name="module_default"></a> [default](#module\_default) | ../../ | n/a |
41-
| <a name="module_log_bucket_1"></a> [log\_bucket\_1](#module\_log\_bucket\_1) | terraform-aws-modules/s3-bucket/aws | ~> 2.6 |
42-
| <a name="module_log_bucket_2"></a> [log\_bucket\_2](#module\_log\_bucket\_2) | terraform-aws-modules/s3-bucket/aws | ~> 2.6 |
43-
| <a name="module_security_group"></a> [security\_group](#module\_security\_group) | terraform-aws-modules/security-group/aws | ~> 4.3 |
44-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.2 |
41+
| <a name="module_log_bucket_1"></a> [log\_bucket\_1](#module\_log\_bucket\_1) | terraform-aws-modules/s3-bucket/aws | ~> 2 |
42+
| <a name="module_log_bucket_2"></a> [log\_bucket\_2](#module\_log\_bucket\_2) | terraform-aws-modules/s3-bucket/aws | ~> 2 |
43+
| <a name="module_security_group"></a> [security\_group](#module\_security\_group) | terraform-aws-modules/security-group/aws | ~> 4 |
44+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3 |
4545
| <a name="module_vpc_endpoints"></a> [vpc\_endpoints](#module\_vpc\_endpoints) | terraform-aws-modules/vpc/aws//modules/vpc-endpoints | ~> 3.2 |
4646

4747
## Resources

‎examples/complete/main.tf

Lines changed: 76 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ provider "aws" {
99

1010
locals {
1111
name = "datadog-forwarders-complete-example"
12+
13+
tags = {
14+
Example = local.name
15+
Environment = "dev"
16+
}
1217
}
1318

1419
# Note: you will need to create this secret manually prior to running
@@ -35,6 +40,8 @@ resource "aws_kms_key" "datadog" {
3540
description = "Datadog KMS CMK"
3641
enable_key_rotation = true
3742
policy = data.aws_iam_policy_document.datadog_cmk.json
43+
44+
tags = local.tags
3845
}
3946

4047
data "aws_iam_policy_document" "datadog_cmk" {
@@ -58,7 +65,7 @@ resource "aws_kms_alias" "datadog" {
5865

5966
module "vpc" {
6067
source = "terraform-aws-modules/vpc/aws"
61-
version = "~> 3.2"
68+
version = "~> 3"
6269

6370
name = local.name
6471
cidr = "10.0.0.0/16"
@@ -67,12 +74,26 @@ module "vpc" {
6774
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
6875
public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
6976

70-
enable_nat_gateway = true
71-
single_nat_gateway = true
77+
enable_nat_gateway = false # not required, using private VPC endpoint
78+
single_nat_gateway = true
79+
map_public_ip_on_launch = false
80+
81+
manage_default_security_group = true
82+
default_security_group_ingress = []
83+
default_security_group_egress = []
84+
85+
enable_flow_log = true
86+
flow_log_destination_type = "cloud-watch-logs"
87+
create_flow_log_cloudwatch_log_group = true
88+
create_flow_log_cloudwatch_iam_role = true
89+
flow_log_max_aggregation_interval = 60
90+
flow_log_log_format = "$${version} $${account-id} $${interface-id} $${srcaddr} $${dstaddr} $${srcport} $${dstport} $${protocol} $${packets} $${bytes} $${start} $${end} $${action} $${log-status} $${vpc-id} $${subnet-id} $${instance-id} $${tcp-flags} $${type} $${pkt-srcaddr} $${pkt-dstaddr} $${region} $${az-id} $${sublocation-type} $${sublocation-id}"
7291

7392
# Required for VPC Endpoints
7493
enable_dns_hostnames = true
7594
enable_dns_support = true
95+
96+
tags = local.tags
7697
}
7798

7899
module "vpc_endpoints" {
@@ -92,11 +113,13 @@ module "vpc_endpoints" {
92113
subnet_ids = module.vpc.private_subnets
93114
},
94115
}
116+
117+
tags = local.tags
95118
}
96119

97120
module "security_group" {
98121
source = "terraform-aws-modules/security-group/aws"
99-
version = "~> 4.3"
122+
version = "~> 4"
100123

101124
name = local.name
102125
description = "Example security group"
@@ -121,27 +144,62 @@ module "security_group" {
121144

122145
egress_cidr_blocks = ["0.0.0.0/0"]
123146
egress_rules = ["all-all"]
124-
}
125147

148+
tags = local.tags
149+
}
126150

127151
module "log_bucket_1" {
128152
source = "terraform-aws-modules/s3-bucket/aws"
129-
version = "~> 2.6"
153+
version = "~> 2"
154+
155+
bucket = "logs-1-${random_pet.this.id}"
156+
force_destroy = true
130157

131-
bucket = "logs-1-${random_pet.this.id}"
132-
acl = "log-delivery-write"
133-
force_destroy = true
134-
attach_elb_log_delivery_policy = true
158+
acl = "log-delivery-write"
159+
attach_elb_log_delivery_policy = true
160+
attach_deny_insecure_transport_policy = true
161+
162+
block_public_acls = true
163+
block_public_policy = true
164+
ignore_public_acls = true
165+
restrict_public_buckets = true
166+
167+
server_side_encryption_configuration = {
168+
rule = {
169+
apply_server_side_encryption_by_default = {
170+
sse_algorithm = "AES256"
171+
}
172+
}
173+
}
174+
175+
tags = local.tags
135176
}
136177

137178
module "log_bucket_2" {
138179
source = "terraform-aws-modules/s3-bucket/aws"
139-
version = "~> 2.6"
180+
version = "~> 2"
181+
182+
bucket = "logs-2-${random_pet.this.id}"
183+
force_destroy = true
184+
185+
acl = "log-delivery-write"
186+
attach_elb_log_delivery_policy = true
187+
attach_deny_insecure_transport_policy = true
188+
189+
block_public_acls = true
190+
block_public_policy = true
191+
ignore_public_acls = true
192+
restrict_public_buckets = true
193+
194+
server_side_encryption_configuration = {
195+
rule = {
196+
apply_server_side_encryption_by_default = {
197+
sse_algorithm = "AES256"
198+
}
199+
}
200+
}
140201

141-
bucket = "logs-2-${random_pet.this.id}"
142-
acl = "log-delivery-write"
143-
force_destroy = true
144-
attach_elb_log_delivery_policy = true
202+
tags = local.tags
145203
}
146204

147205
################################################################################
@@ -192,8 +250,9 @@ resource "aws_iam_policy" "custom" {
192250
name = "custom-datadog-log-forwarder"
193251
path = "/"
194252
description = "Lambda function to push logs, metrics, and traces to Datadog"
253+
policy = data.aws_iam_policy_document.custom.json
195254

196-
policy = data.aws_iam_policy_document.custom.json
255+
tags = local.tags
197256
}
198257

199258
module "default" {
@@ -309,5 +368,5 @@ module "default" {
309368
traces_vpce_security_group_ids = [module.security_group.security_group_id]
310369
traces_vpce_tags = { TracesVpcEndpoint = true }
311370

312-
tags = { Environment = "test" }
371+
tags = local.tags
313372
}

‎examples/simple/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ Note that this example may create resources which will incur monetary charges on
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0 |
30-
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 3.59.0 |
30+
| <a name="provider_random"></a> [random](#provider\_random) | 3.1.0 |
3131

3232
## Modules
3333

‎examples/simple/main.tf

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,15 @@ provider "aws" {
66
# Data Sources
77
################################################################################
88

9+
locals {
10+
name = "datadog-forwarders-simple-example"
11+
12+
tags = {
13+
Example = local.name
14+
Environment = "dev"
15+
}
16+
}
17+
918
# Note: you will need to create this secret manually prior to running
1019
# This avoids having to pass the key to Terraform in plaintext
1120
data "aws_secretsmanager_secret" "datadog_api_key" {
@@ -26,6 +35,8 @@ resource "aws_kms_key" "datadog" {
2635
description = "Datadog KMS CMK"
2736
enable_key_rotation = true
2837
policy = data.aws_iam_policy_document.datadog_cmk.json
38+
39+
tags = local.tags
2940
}
3041

3142
data "aws_iam_policy_document" "datadog_cmk" {
@@ -57,5 +68,5 @@ module "default" {
5768
kms_alias = aws_kms_alias.datadog.name
5869
dd_api_key_secret_arn = data.aws_secretsmanager_secret.datadog_api_key.arn
5970

60-
tags = { Environment = "test" }
71+
tags = local.tags
6172
}

0 commit comments

Comments
 (0)