-
Notifications
You must be signed in to change notification settings - Fork 8
/
main.tf
342 lines (294 loc) · 10.9 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
data "aws_availability_zones" "available" {
state = "available"
}
data "aws_route53_zone" "public_zone" {
count = var.use_existing_route53_zone ? 1 : 0
name = local.domain_name
private_zone = false
}
module "snykbroker_vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "3.14.3"
name = "snykbroker_vpc"
cidr = var.vpc_cidr
# select the first grouping of specified number of service_azs
azs = chunklist(data.aws_availability_zones.available.names, var.service_azs)[0]
# split half cidr for private, half for public and then subdivide each by number of service availability zones
private_subnets = [for x in range(var.service_azs) : cidrsubnet(cidrsubnet(var.vpc_cidr, 1, 0), 3, x)]
public_subnets = [for x in range(var.service_azs) : cidrsubnet(cidrsubnet(var.vpc_cidr, 1, 1), 3, x)]
# One NAT Gateway per subnet (default)
enable_nat_gateway = true
enable_dns_hostnames = true
enable_dns_support = true
tags = var.tags
}
module "snykbroker_lb_security_group" {
source = "terraform-aws-modules/security-group/aws"
version = "4.13.0"
name = "snykbroker_lb"
description = "Security group for SnykBroker load balancer"
vpc_id = module.snykbroker_vpc.vpc_id
# allow ingress of https from SCM webhooks
ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_rules = var.broker_protocol == "https" ? ["https-443-tcp"] : []
ingress_with_cidr_blocks = var.broker_protocol == "http" ? [
{
from_port = local.broker_port
to_port = local.broker_port
protocol = "tcp"
description = "SnykBroker Client HTTP port"
cidr_blocks = "0.0.0.0/0"
}
] : []
# allow egress of broker client container security group
computed_egress_with_source_security_group_id = [
{
from_port = local.broker_port
to_port = local.broker_port
protocol = "tcp"
description = "SnykBroker client port for webhook access"
source_security_group_id = module.snykbroker_security_group.security_group_id
}
]
number_of_computed_egress_with_source_security_group_id = 1
}
module "snykbroker_security_group" {
source = "terraform-aws-modules/security-group/aws"
version = "4.13.0"
name = "snykbroker_service"
description = "Security group for SnykBroker fargate service"
vpc_id = module.snykbroker_vpc.vpc_id
# allow ingress from its public facing load balancer
computed_ingress_with_source_security_group_id = [
{
from_port = local.broker_port
to_port = local.broker_port
protocol = "tcp"
description = "SnykBroker client port for webhook access"
source_security_group_id = module.snykbroker_lb_security_group.security_group_id
}
]
number_of_computed_ingress_with_source_security_group_id = 1
egress_cidr_blocks = ["0.0.0.0/0"]
egress_rules = ["https-443-tcp"]
egress_with_source_security_group_id = local.attach_config ? [
{
rule = "nfs-tcp"
source_security_group_id = module.snykbroker_efs[0].sg_id
}
] : []
tags = var.tags
}
module "snykbroker_log_group" {
source = "terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "3.3.0"
name = var.cloudwatch_log_group_name
kms_key_id = module.snykbroker_kms.key_arn
retention_in_days = var.cloudwatch_log_retention_days
}
module "snykbroker_ecs_cluster" {
source = "terraform-aws-modules/ecs/aws"
version = "4.1.1"
cluster_name = "snykbroker_ecs_fargate"
cluster_configuration = {
execute_command_configuration = {
kms_key_id = module.snykbroker_kms.key_arn
logging = "OVERRIDE"
log_configuration = {
cloud_watch_encryption_enabled = true
cloud_watch_log_group_name = module.snykbroker_log_group.cloudwatch_log_group_name
}
}
}
fargate_capacity_providers = {
FARGATE = {
default_capacity_provider_strategy = {
base = var.fargate_capacity_base
weight = var.fargate_capacity_weight
}
}
FARGATE_SPOT = {
default_capacity_provider_strategy = {
base = var.fargate_spot_capacity_base
weight = var.fargate_spot_capacity_weight
}
}
}
tags = var.tags
}
module "snykbroker_ecs_task_definition" {
source = "umotif-public/ecs-fargate-task-definition/aws"
version = "2.1.2"
enabled = true
name_prefix = var.service_name
# use custom image if specified, otherwise an official snyk dockerhub image based on integration type
task_container_image = var.image != null ? var.image : local.image
container_name = var.container_name
task_container_port = local.broker_port
task_host_port = local.broker_port
task_definition_cpu = var.cpu
task_definition_memory = var.memory
cloudwatch_log_group_name = module.snykbroker_log_group.cloudwatch_log_group_name
create_repository_credentials_iam_policy = true
repository_credentials_kms_key = module.snykbroker_kms.key_id
repository_credentials = module.snykbroker_secrets.secret_arns["dockerhub_r"]
task_container_environment = local.broker_env_vars
task_container_secrets = [for t in aws_ssm_parameter.tokens : tomap({"name" = t.description, "valueFrom" = t.arn})]
task_stop_timeout = 90
task_mount_points = local.attach_config ? [
{
sourceVolume = var.service_name
containerPath = local.mount_path
readOnly = true
}
] : []
# volume name corresponds to sourceVolume which will contain a cert directory with cert injected by a lambda function
volume = local.attach_config ? [
{
name = var.service_name
efs_volume_configuration = [
{
file_system_id = module.snykbroker_efs[0].efs_id
# root_directory = "/cert omitted with access point use"
transit_encryption = "ENABLED"
authorization_config = {
access_point_id = aws_efs_access_point.snykbroker_cert_access_point[0].id
iam = "ENABLED"
}
}
]
}
] : []
tags = var.tags
}
module "snykbroker_lb" {
source = "terraform-aws-modules/alb/aws"
version = "7.0.0"
name = var.service_name
# launch external facing ALB that accepts http/https traffic from webhook requests of cloud-hosted SCMs
load_balancer_type = "application"
internal = false
vpc_id = module.snykbroker_vpc.vpc_id
subnets = module.snykbroker_vpc.public_subnets
security_groups = [module.snykbroker_lb_security_group.security_group_id]
enable_cross_zone_load_balancing = true
# turn on alb access logging to s3 bucket if bucket name provided
access_logs = var.log_bucket_name != null ? {
bucket = var.log_bucket_name
} : {}
target_groups = [
{
name_prefix = "snyk-"
backend_protocol = var.private_ssl_cert ? "HTTPS" : "HTTP"
backend_port = local.broker_port
target_type = "ip"
health_check = {
enabled = true
interval = 30
path = "/healthcheck"
port = "traffic-port"
healthy_threshold = 3
unhealthy_threshold = 3
timeout = 10
protocol = var.private_ssl_cert ? "HTTPS" : "HTTP"
matcher = "200-299"
}
}
]
https_listeners = var.broker_protocol == "https" ? [
{
port = 443
protocol = upper(var.broker_protocol)
certificate_arn = module.snykbroker_acm.acm_certificate_arn
target_group_index = 0
}
] : []
http_tcp_listeners = var.broker_protocol == "http" ? [
{
port = local.broker_port
protocol = upper(var.broker_protocol)
target_group_index = 0
}
] : []
tags = var.tags
}
module "snykbroker_efs" {
count = local.attach_config ? 1 : 0
source = "terraform-iaac/efs/aws"
version = "2.0.4"
# insert the 5 required variables here
name = var.service_name
vpc_id = module.snykbroker_vpc.vpc_id
subnet_ids = module.snykbroker_vpc.private_subnets
encrypted = true
kms_key_id = module.snykbroker_kms.key_arn
# allowed ingress from private subnets cidr
whitelist_cidr = module.snykbroker_vpc.private_subnets_cidr_blocks
tags = var.tags
}
# umotif-public/terraform-aws-ecs-fargate module v6.5.2 is not used because it does not parameterize a hardened security group
resource "aws_ecs_service" "snykbroker_service" {
name = var.service_name
cluster = module.snykbroker_ecs_cluster.cluster_id
task_definition = module.snykbroker_ecs_task_definition.task_definition_arn
desired_count = var.service_desired_count
launch_type = var.launch_type
scheduling_strategy = var.scheduling_strategy
force_new_deployment = true
network_configuration {
subnets = module.snykbroker_vpc.private_subnets
security_groups = [module.snykbroker_security_group.security_group_id]
assign_public_ip = false
}
load_balancer {
target_group_arn = module.snykbroker_lb.target_group_arns[0]
container_name = var.container_name
container_port = local.broker_port
}
tags = var.tags
depends_on = [aws_lambda_invocation.snykbroker_lambda_invocation]
}
# creates <public_domain_name> public hosted zone if non-existent
module "public_route53_zone" {
count = !var.use_existing_route53_zone ? 1 : 0
source = "terraform-aws-modules/route53/aws//modules/zones"
version = "2.9.0"
zones = {
(local.domain_name) = {
comment = "Public ${local.domain_name} hosted zone"
# force destroy for repeated iac testing
force_destroy = true
}
}
tags = var.tags
}
# create load balancer route53 record "<broker_hostname>.<public_domain_name>"
# this requires AWS Route53 to manage DNS on a public hosted zone defined by its public domain name
module "snykbroker_lb_route53_record" {
source = "terraform-aws-modules/route53/aws//modules/records"
version = "2.9.0"
zone_name = local.domain_name
records = [
{
name = var.broker_hostname
type = "A"
alias = {
name = module.snykbroker_lb.lb_dns_name
zone_id = module.snykbroker_lb.lb_zone_id
evaluate_target_health = true
}
}
]
# in case of creating the public hosted zone
depends_on = [module.public_route53_zone]
}
# creates a default Route53 DNS validated public certificate for the load balancer use
module "snykbroker_acm" {
source = "terraform-aws-modules/acm/aws"
version = "4.0.1"
create_certificate = var.broker_protocol == "https" ? true : false
domain_name = format("%s.%s", var.broker_hostname, local.domain_name)
zone_id = coalescelist(data.aws_route53_zone.public_zone.*.zone_id, try(values(module.public_route53_zone[0].route53_zone_zone_id), []))[0]
wait_for_validation = true
tags = var.tags
}