From 545c38414ebb41b2898131bbfe5705cc9424ec48 Mon Sep 17 00:00:00 2001 From: tomarv2 Date: Tue, 4 Apr 2023 04:54:35 +0000 Subject: [PATCH 1/2] Sync from management repo --- .pre-commit-config.yaml | 34 +++++++-------- README.md | 63 +++++++++------------------ examples/with_ip_set_and_rule/main.tf | 6 +-- providers.tf | 2 +- 4 files changed, 41 insertions(+), 64 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c261675..17fe1fe 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,24 +1,24 @@ repos: - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.76.0 + rev: v1.77.1 hooks: - id: terraform_fmt - id: terraform_tflint args: - - '--args=--only=terraform_deprecated_interpolation' - - '--args=--only=terraform_deprecated_index' - - '--args=--only=terraform_unused_declarations' - - '--args=--only=terraform_comment_syntax' - - '--args=--only=terraform_documented_outputs' - - '--args=--only=terraform_documented_variables' - - '--args=--only=terraform_typed_variables' - - '--args=--only=terraform_naming_convention' - - '--args=--only=terraform_required_providers' - - '--args=--only=terraform_standard_module_structure' - - '--args=--only=terraform_workspace_remote' + - "--args=--only=terraform_deprecated_interpolation" + - "--args=--only=terraform_deprecated_index" + - "--args=--only=terraform_unused_declarations" + - "--args=--only=terraform_comment_syntax" + - "--args=--only=terraform_documented_outputs" + - "--args=--only=terraform_documented_variables" + - "--args=--only=terraform_typed_variables" + - "--args=--only=terraform_naming_convention" + - "--args=--only=terraform_required_providers" + - "--args=--only=terraform_standard_module_structure" + - "--args=--only=terraform_workspace_remote" - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.3.0 + rev: v4.4.0 hooks: - id: trailing-whitespace - id: end-of-file-fixer @@ -30,8 +30,8 @@ repos: - id: requirements-txt-fixer - repo: https://github.com/bridgecrewio/checkov.git - rev: '2.1.280' + rev: "2.1.280" hooks: - - id: checkov - verbose: true - args: [-d, '.', --framework,'terraform'] + - id: checkov + verbose: true + args: [-d, ".", --framework, "terraform"] diff --git a/README.md b/README.md index 62d862c..ee8cced 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ - AWS provider version [4.35](https://registry.terraform.io/providers/hashicorp/aws/latest). - `main` branch: Provider versions not pinned to keep up with Terraform releases. - `tags` releases: Tags are pinned with versions (use - in your releases). + in your releases). ### Usage @@ -33,23 +33,27 @@ terraform plan -var='teamid=tryme' -var='prjid=project1' terraform apply -var='teamid=tryme' -var='prjid=project1' terraform destroy -var='teamid=tryme' -var='prjid=project1' ``` + **Note:** With this option please take care of remote state storage #### Option 2: -##### Recommended method (stores remote state in remote backend(S3, Azure storage, or Google bucket) using `prjid` and `teamid` to create directory structure): +##### Recommended method (stores remote state in remote backend(S3, Azure storage, or Google bucket) using `prjid` and `teamid` to create directory structure): - Create python 3.8+ virtual environment + ``` python3 -m venv ``` - Install package: + ``` pip install tfremote --upgrade ``` - Set below environment variables: + ``` export TF_AWS_BUCKET= export TF_AWS_BUCKET_REGION=us-west-2 @@ -59,6 +63,7 @@ export TF_AWS_PROFILE= or - Set below environment variables: + ``` export TF_AWS_BUCKET= export TF_AWS_BUCKET_REGION=us-west-2 @@ -69,16 +74,19 @@ export AWS_SECRET_ACCESS_KEY= - Updated `examples` directory with required values. - Run and verify the output before deploying: + ``` tf -c=aws plan -var='teamid=foo' -var='prjid=bar' ``` - Run below to deploy: + ``` tf -c=aws apply -var='teamid=foo' -var='prjid=bar' ``` - Run below to destroy: + ``` tf -c=aws destroy -var='teamid=foo' -var='prjid=bar' ``` @@ -86,12 +94,13 @@ tf -c=aws destroy -var='teamid=foo' -var='prjid=bar' **Note:** Read more on [tfremote](https://github.com/tomarv2/tfremote) ##### WAF with custom IP and `AND` rule + ``` terraform { required_version = ">= 1.0.1" required_providers { aws = { - version = "~> 4.35" + version = "~> 4.61" } } } @@ -101,7 +110,7 @@ provider "aws" { } module "common" { - source = "git::git@github.com:tomarv2/terraform-global.git//common?ref=v0.0.1" + source = "github.com/tomarv2/terraform-global.git//common?ref=v0.0.1" } ##### @@ -188,18 +197,14 @@ module "waf" { Please refer to examples directory [link](examples) for references. + ## Requirements -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.0.1 | -| [aws](#requirement\_aws) | ~> 4.35 | +No requirements. ## Providers -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | ~> 4.35 | +No providers. ## Modules @@ -207,42 +212,14 @@ No modules. ## Resources -| Name | Type | -|------|------| -| [aws_wafv2_web_acl.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl) | resource | -| [aws_wafv2_web_acl_association.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_association) | resource | +No resources. ## Inputs -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [alb\_arn](#input\_alb\_arn) | Application Load Balancer ARN | `string` | `null` | no | -| [allow\_default\_action](#input\_allow\_default\_action) | Set to `true` for WAF to allow requests by default. Set to `false` for WAF to block requests by default. | `bool` | `false` | no | -| [create\_alb\_association](#input\_create\_alb\_association) | Whether to create alb association with WAF web acl | `bool` | `true` | no | -| [create\_logging\_configuration](#input\_create\_logging\_configuration) | Whether to create logging configuration in order start logging from a WAFv2 Web ACL to Amazon Kinesis Data Firehose. | `bool` | `false` | no | -| [description](#input\_description) | A friendly description of the WebACL | `string` | `null` | no | -| [enabled](#input\_enabled) | Whether to create the resources. Set to `false` to prevent the module from creating any resources | `bool` | `true` | no | -| [extra\_tags](#input\_extra\_tags) | Additional tags to associate | `map(string)` | `{}` | no | -| [log\_destination\_configs](#input\_log\_destination\_configs) | The Amazon Kinesis Data Firehose Amazon Resource Name (ARNs) that you want to associate with the web ACL. Currently, only 1 ARN is supported. | `list(string)` | `[]` | no | -| [logging\_filter](#input\_logging\_filter) | A configuration block that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation. | `any` | `{}` | no | -| [name](#input\_name) | Name used to create resources. | `string` | `null` | no | -| [prjid](#input\_prjid) | Name of the project/stack e.g: mystack, nifieks, demoaci. Should not be changed after running 'tf apply' | `any` | n/a | yes | -| [redacted\_fields](#input\_redacted\_fields) | The parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported. | `any` | `[]` | no | -| [rules](#input\_rules) | List of WAF rules. | `any` | `[]` | no | -| [scope](#input\_scope) | Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are CLOUDFRONT or REGIONAL. To work with CloudFront, you must also specify the region us-east-1 (N. Virginia) on the AWS provider. | `string` | `"REGIONAL"` | no | -| [teamid](#input\_teamid) | Name of the team/group e.g. devops, dataengineering. Should not be changed after running 'tf apply' | `any` | n/a | yes | -| [visibility\_config](#input\_visibility\_config) | Visibility config for WAFv2 web acl. https://www.terraform.io/docs/providers/aws/r/wafv2_web_acl.html#visibility-configuration | `map(string)` | `{}` | no | +No inputs. ## Outputs -| Name | Description | -|------|-------------| -| [web\_acl\_arn](#output\_web\_acl\_arn) | The ARN of the WAFv2 WebACL. | -| [web\_acl\_assoc\_acl\_arn](#output\_web\_acl\_assoc\_acl\_arn) | The ARN of the Web ACL attached to the Web ACL Association | -| [web\_acl\_assoc\_id](#output\_web\_acl\_assoc\_id) | The ID of the Web ACL Association | -| [web\_acl\_assoc\_resource\_arn](#output\_web\_acl\_assoc\_resource\_arn) | The ARN of the ALB attached to the Web ACL Association | -| [web\_acl\_capacity](#output\_web\_acl\_capacity) | The web ACL capacity units (WCUs) currently being used by this web ACL. | -| [web\_acl\_id](#output\_web\_acl\_id) | The ID of the WAFv2 WebACL. | -| [web\_acl\_name](#output\_web\_acl\_name) | The name of the WAFv2 WebACL. | -| [web\_acl\_rule\_names](#output\_web\_acl\_rule\_names) | List of created rule names | +No outputs. + diff --git a/examples/with_ip_set_and_rule/main.tf b/examples/with_ip_set_and_rule/main.tf index c510eca..20288ed 100644 --- a/examples/with_ip_set_and_rule/main.tf +++ b/examples/with_ip_set_and_rule/main.tf @@ -2,7 +2,7 @@ terraform { required_version = ">= 1.0.1" required_providers { aws = { - version = "~> 4.35" + version = "~> 4.61" } } } @@ -12,7 +12,7 @@ provider "aws" { } module "common" { - source = "git::git@github.com:tomarv2/terraform-global.git//common?ref=v0.0.1" + source = "github.com/tomarv2/terraform-global.git//common?ref=v0.0.1" } ##### @@ -116,4 +116,4 @@ module "waf" { ] teamid = var.teamid prjid = var.prjid -} \ No newline at end of file +} diff --git a/providers.tf b/providers.tf index 6c0e9ed..dbf0906 100644 --- a/providers.tf +++ b/providers.tf @@ -2,7 +2,7 @@ terraform { required_version = ">= 1.0.1" required_providers { aws = { - version = "~> 4.35" + version = "~> 4.61" } } } From c83090008700e47ce7b5c836cec6584bbdb0a5cd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 4 Apr 2023 04:58:29 +0000 Subject: [PATCH 2/2] terraform-docs: automated action --- README.md | 46 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index ee8cced..c39441e 100644 --- a/README.md +++ b/README.md @@ -197,14 +197,18 @@ module "waf" { Please refer to examples directory [link](examples) for references. - ## Requirements -No requirements. +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.0.1 | +| [aws](#requirement\_aws) | ~> 4.61 | ## Providers -No providers. +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | ~> 4.61 | ## Modules @@ -212,14 +216,42 @@ No modules. ## Resources -No resources. +| Name | Type | +|------|------| +| [aws_wafv2_web_acl.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl) | resource | +| [aws_wafv2_web_acl_association.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_association) | resource | ## Inputs -No inputs. +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [alb\_arn](#input\_alb\_arn) | Application Load Balancer ARN | `string` | `null` | no | +| [allow\_default\_action](#input\_allow\_default\_action) | Set to `true` for WAF to allow requests by default. Set to `false` for WAF to block requests by default. | `bool` | `false` | no | +| [create\_alb\_association](#input\_create\_alb\_association) | Whether to create alb association with WAF web acl | `bool` | `true` | no | +| [create\_logging\_configuration](#input\_create\_logging\_configuration) | Whether to create logging configuration in order start logging from a WAFv2 Web ACL to Amazon Kinesis Data Firehose. | `bool` | `false` | no | +| [description](#input\_description) | A friendly description of the WebACL | `string` | `null` | no | +| [enabled](#input\_enabled) | Whether to create the resources. Set to `false` to prevent the module from creating any resources | `bool` | `true` | no | +| [extra\_tags](#input\_extra\_tags) | Additional tags to associate | `map(string)` | `{}` | no | +| [log\_destination\_configs](#input\_log\_destination\_configs) | The Amazon Kinesis Data Firehose Amazon Resource Name (ARNs) that you want to associate with the web ACL. Currently, only 1 ARN is supported. | `list(string)` | `[]` | no | +| [logging\_filter](#input\_logging\_filter) | A configuration block that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation. | `any` | `{}` | no | +| [name](#input\_name) | Name used to create resources. | `string` | `null` | no | +| [prjid](#input\_prjid) | Name of the project/stack e.g: mystack, nifieks, demoaci. Should not be changed after running 'tf apply' | `any` | n/a | yes | +| [redacted\_fields](#input\_redacted\_fields) | The parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported. | `any` | `[]` | no | +| [rules](#input\_rules) | List of WAF rules. | `any` | `[]` | no | +| [scope](#input\_scope) | Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are CLOUDFRONT or REGIONAL. To work with CloudFront, you must also specify the region us-east-1 (N. Virginia) on the AWS provider. | `string` | `"REGIONAL"` | no | +| [teamid](#input\_teamid) | Name of the team/group e.g. devops, dataengineering. Should not be changed after running 'tf apply' | `any` | n/a | yes | +| [visibility\_config](#input\_visibility\_config) | Visibility config for WAFv2 web acl. https://www.terraform.io/docs/providers/aws/r/wafv2_web_acl.html#visibility-configuration | `map(string)` | `{}` | no | ## Outputs -No outputs. - +| Name | Description | +|------|-------------| +| [web\_acl\_arn](#output\_web\_acl\_arn) | The ARN of the WAFv2 WebACL. | +| [web\_acl\_assoc\_acl\_arn](#output\_web\_acl\_assoc\_acl\_arn) | The ARN of the Web ACL attached to the Web ACL Association | +| [web\_acl\_assoc\_id](#output\_web\_acl\_assoc\_id) | The ID of the Web ACL Association | +| [web\_acl\_assoc\_resource\_arn](#output\_web\_acl\_assoc\_resource\_arn) | The ARN of the ALB attached to the Web ACL Association | +| [web\_acl\_capacity](#output\_web\_acl\_capacity) | The web ACL capacity units (WCUs) currently being used by this web ACL. | +| [web\_acl\_id](#output\_web\_acl\_id) | The ID of the WAFv2 WebACL. | +| [web\_acl\_name](#output\_web\_acl\_name) | The name of the WAFv2 WebACL. | +| [web\_acl\_rule\_names](#output\_web\_acl\_rule\_names) | List of created rule names |