Skip to content
This repository was archived by the owner on Jul 31, 2024. It is now read-only.

Commit 80f798f

Browse files
cdanilukcdaniluk
committed
demo project
1 parent cae9b34 commit 80f798f

33 files changed

+293
-30
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,5 @@ override.tf.json
2828

2929
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
3030
# example: *tfplan*
31+
32+
*.zip

‎account/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../Makefile

‎account/backend-setup.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module "backend" {
2-
source = "git::ssh://[email protected]/rhythmictech/terraform-aws-backend?ref=v1.2.0"
2+
source = "git::ssh://[email protected]/rhythmictech/terraform-aws-backend?ref=v2.0.0"
33
bucket = var.bucket
44
table = var.dynamodb_table
55
region = var.region

‎account/backend.auto.tfvars

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
bucket = "012345678912-us-east-1-tf-state"
1+
bucket = "028266382041-us-east-1-tf-state"
22
key = "account.tfstate"
33
dynamodb_table = "tf-locktable"
44
region = "us-east-1"

‎account/default.tfvars

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
env = "default"
2+
iam_master_account = "092882053733"
3+
iam_role_prefix = "RhythmicOps-"
4+
5+
# Storing these in external env vars.
6+
#alert_webhook = "https://hooks.slack.com/services/"
7+
#notify_webhook = "https://hooks.slack.com/services/"
8+
#ticket_webhook = "https://hooks.slack.com/services/"
9+
slack_channel = "alerts"

‎account/main.tf

+13-15
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,45 @@
11
module "tags" {
2-
source = "git::https://github.com/rhythmictech/terraform-terraform-tags.git?ref=v0.0.2"
2+
source = "git::https://github.com/rhythmictech/terraform-terraform-tags.git?ref=v1.0.0"
33

44
names = [
55
"account",
66
var.env,
77
var.namespace
88
]
99

10-
tags = {
10+
tags = merge(var.tags, {
1111
"Env" = var.env,
1212
"Namespace" = var.namespace,
1313
"Owner" = var.owner
14-
}
14+
})
1515
}
1616

17-
module "rhythmic-iam-roles" {
18-
source = "git::https://github.com/rhythmictech/terraform-aws-rhythmic-iam-roles.git?ref=v1.0.0"
19-
role_prefix = var.iam_role_prefix
20-
master_account = var.iam_master_account
17+
locals {
18+
tags = module.tags.tags_no_name
2119
}
2220

2321
module "s3logging-bucket" {
24-
source = "git::https://github.com/rhythmictech/terraform-aws-s3logging-bucket?ref=v1.0.0"
22+
source = "git::https://github.com/rhythmictech/terraform-aws-s3logging-bucket?ref=v1.0.1"
2523
bucket_suffix = "account"
2624
region = var.region
27-
tags = module.tags.tags_no_name
25+
tags = local.tags
2826
}
2927

3028
module "cloudtrail-bucket" {
31-
source = "git::https://github.com/rhythmictech/terraform-aws-cloudtrail-bucket?ref=v1.0.0"
29+
source = "git::https://github.com/rhythmictech/terraform-aws-cloudtrail-bucket?ref=v1.2.0"
3230
logging_bucket = module.s3logging-bucket.s3logging_bucket_name
3331
region = var.region
34-
tags = module.tags.tags_no_name
32+
tags = local.tags
3533

3634
}
3735

3836
module "cloudtrail-logging" {
39-
source = "git::https://github.com/rhythmictech/terraform-aws-cloudtrail-logging?ref=v1.0.0"
40-
region = var.region
41-
cloudtrail_bucket = module.cloudtrail-bucket.bucket_name
37+
source = "git::https://github.com/rhythmictech/terraform-aws-cloudtrail-logging?ref=v1.1.0"
38+
cloudtrail_bucket = module.cloudtrail-bucket.s3_bucket_name
4239
kms_key_id = module.cloudtrail-bucket.kms_key_id
40+
region = var.region
4341
}
4442

4543
module "iam-password-policy" {
46-
source = "git::ssh://git@github.com/rhythmictech/terraform-aws-iam-password-policy?ref=v1.0.0"
44+
source = "git::https://github.com/rhythmictech/terraform-aws-iam-password-policy?ref=v1.0.0"
4745
}

‎account/monitoring.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
module "monitoring" {
3+
source = "git::https://github.com/rhythmictech/terraform-aws-rhythmic-monitoring?ref=demo"
4+
5+
name = "SecurityAutomationDemo-Monitoring"
6+
alert_webhook = var.alert_webhook
7+
notify_webhook = var.notify_webhook
8+
slack_channel = var.slack_channel
9+
tags = local.tags
10+
}

‎account/outputs.tf

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
########################################
2+
# Monitoring Outputs
3+
########################################
4+
output "sns_topic_alert_arn" {
5+
description = "Alert Topic ARN"
6+
value = module.monitoring.sns_topic_alert_arn
7+
}
8+
9+
output "sns_topic_notify_arn" {
10+
description = "Notification Topic ARN"
11+
value = module.monitoring.sns_topic_notify_arn
12+
}
13+
14+
output "sns_topic_ticket_arn" {
15+
description = "Ticketing Topic ARN"
16+
value = module.monitoring.sns_topic_ticket_arn
17+
}
18+
19+
########################################
20+
# Security Outputs
21+
########################################
22+
23+
output "cloudtrail_log_group" {
24+
description = "CloudTrail CloudWatch log group"
25+
value = module.cloudtrail-logging.cloudwatch_loggroup_name
26+
}
27+
28+
output "s3_bucket_access_logging" {
29+
description = "S3 bucket to receive S3 bucket access logs"
30+
value = module.s3logging-bucket.s3logging_bucket_name
31+
}

‎account/setup/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ provider "aws" {
33
}
44

55
module "backend" {
6-
source = "git::ssh://[email protected]/rhythmictech/terraform-aws-backend?ref=v1.2.0"
6+
source = "git::ssh://[email protected]/rhythmictech/terraform-aws-backend?ref=v2.0.0"
77
bucket = var.bucket
88
table = var.dynamodb_table
99
region = var.region

‎account/terraform.tfvars

-3
This file was deleted.

‎account/variables.tf

+27-9
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
########################################
2+
# General Vars
3+
########################################
4+
15
variable "iam_master_account" {
26
type = string
37
}
@@ -6,17 +10,31 @@ variable "iam_role_prefix" {
610
type = string
711
}
812

9-
variable "namespace" {
10-
description = "Project name"
11-
type = string
13+
variable "tags" {
14+
type = map(string)
15+
default = {}
1216
}
1317

14-
variable "owner" {
15-
description = "Owner of this infrastructure"
16-
type = string
18+
########################################
19+
# Monitoring Vars
20+
########################################
21+
22+
variable "alert_webhook" {
23+
description = "Webhook to send alerts to"
24+
type = string
1725
}
1826

19-
variable "tags" {
20-
type = map(string)
21-
default = {}
27+
variable "notify_webhook" {
28+
description = "Webhook to send notifications to"
29+
type = string
2230
}
31+
32+
variable "slack_channel" {
33+
description = "Channel to send notifications to"
34+
type = string
35+
}
36+
37+
variable "ticket_webhook" {
38+
description = "Webhook to send tickets to"
39+
type = string
40+
}

‎common/common.tf

+10
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,13 @@ variable "key" {
4848
description = "Key that tfstate is stored in"
4949
type = string
5050
}
51+
52+
variable "namespace" {
53+
description = "Namespace to associate resources in this account with"
54+
type = string
55+
}
56+
57+
variable "owner" {
58+
description = "Team/person responsible for this account"
59+
type = string
60+
}

‎demo/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include ../Makefile

‎demo/README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# demo
2+
3+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4+
## Inputs
5+
6+
| Name | Description | Type | Default | Required |
7+
|------|-------------|:----:|:-----:|:-----:|
8+
9+
## Outputs
10+
11+
| Name | Description |
12+
|------|-------------|
13+
14+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎demo/backend.auto.tfvars

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
bucket = "028266382041-us-east-1-tf-state"
2+
key = "demo.tfstate"
3+
dynamodb_table = "tf-locktable"
4+
region = "us-east-1"

‎demo/common.tf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../common/common.tf

‎demo/default.tfvars

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
env = "default"

‎demo/global.auto.tfvars

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../common/global.auto.tfvars

‎demo/logSadThings.py

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
from __future__ import print_function
2+
3+
import random
4+
import os
5+
6+
print('Loading function')
7+
8+
thingsToSay = [
9+
"INVALID AUTHENTICATION ATTEMPT",
10+
"SUCCESSFUL AUTHENTICATION ATTEMPT",
11+
"USER LOGGED OUT",
12+
"USER WANTS A HAIRCUT"
13+
]
14+
15+
def handler(event, context):
16+
17+
print("Received request.")
18+
print(random.choice(thingsToSay))
19+
20+

‎demo/main.tf

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
resource "aws_iam_group" "billing_group" {
2+
name = "BillingUsers"
3+
4+
}
5+
6+
resource "aws_iam_group_policy_attachment" "test-attach" {
7+
group = aws_iam_group.billing_group.name
8+
policy_arn = "arn:aws:iam::aws:policy/job-function/Billing"
9+
}
10+
11+
resource "aws_iam_user" "simple_user" {
12+
name = "TheAccountant"
13+
}
14+
15+
resource "aws_iam_group_membership" "team" {
16+
name = aws_iam_group.billing_group.name
17+
group = aws_iam_group.billing_group.name
18+
users = [aws_iam_user.simple_user.name]
19+
}
20+
21+
# A Lambda to log random strings
22+
data "archive_file" "lambda" {
23+
type = "zip"
24+
source_file = "logSadThings.py"
25+
output_path = "${path.module}/tmp/logSadThing.zip"
26+
}
27+
28+
data "aws_iam_policy_document" "assume" {
29+
statement {
30+
actions = [
31+
"sts:AssumeRole",
32+
]
33+
34+
principals {
35+
type = "Service"
36+
identifiers = ["lambda.amazonaws.com"]
37+
}
38+
}
39+
}
40+
41+
resource "aws_iam_role" "role" {
42+
assume_role_policy = data.aws_iam_policy_document.assume.json
43+
}
44+
45+
resource "aws_iam_role_policy_attachment" "role" {
46+
role = aws_iam_role.role.name
47+
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
48+
}
49+
50+
resource "aws_lambda_function" "log_sad_things" {
51+
filename = data.archive_file.lambda.output_path
52+
function_name = "logSadThings"
53+
role = aws_iam_role.role.arn
54+
handler = "logSadThings.handler"
55+
runtime = "python3.6"
56+
57+
lifecycle {
58+
ignore_changes = [
59+
filename,
60+
last_modified,
61+
]
62+
}
63+
64+
source_code_hash = data.archive_file.lambda.output_base64sha256
65+
}
66+

‎demo/outputs.tf

Whitespace-only changes.

‎demo/variables.tf

Whitespace-only changes.

‎security/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include ../Makefile

‎security/README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# security
2+
3+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4+
## Inputs
5+
6+
| Name | Description | Type | Default | Required |
7+
|------|-------------|:----:|:-----:|:-----:|
8+
9+
## Outputs
10+
11+
| Name | Description |
12+
|------|-------------|
13+
14+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎security/awsconfig.tf

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
module "awsconfig" {
2+
source = "git::https://github.com/rhythmictech/terraform-aws-config.git?ref=v0.0.2"
3+
logging_bucket = data.terraform_remote_state.account.outputs.s3_bucket_access_logging
4+
region = var.region
5+
sns_topic_arn = data.terraform_remote_state.account.outputs.sns_topic_ticket_arn
6+
}

‎security/backend.auto.tfvars

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
bucket = "028266382041-us-east-1-tf-state"
2+
key = "security.tfstate"
3+
dynamodb_table = "tf-locktable"
4+
region = "us-east-1"

‎security/common.tf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../common/common.tf

‎security/default.tfvars

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
env = "default"

‎security/global.auto.tfvars

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../common/global.auto.tfvars

0 commit comments

Comments
 (0)