Provide initial functionality #6

dav3r · 2022-07-22T17:25:36Z

🗣 Description

This PR implements the initial functionality for this repository, namely Terraform to do the following:

Deploy a Lambda function, specifically cisagov/publish-egress-ip-lambda, and it's execution role/policy
Create the CloudWatch log group used by the Lambda
Schedule the Lambda to run every X minutes using a CloudWatch event
Create an S3 bucket to host the published files (objects) containing egress IP information
Deploy a CloudFront distribution to enable HTTPS access to the egress IP info in the S3 bucket
Create DNS records that point to the CloudFront distribution

💭 Motivation and context

We need a mechanism to publish egress IP info from a subset of our AWS accounts and this Terraform will allow us to deploy the infrastructure to do that.

This is part of the work for:

This PR is related to the following:

This PR resolves #5 (via f22ab6d).

🧪 Testing

I successfully applied all of this Terraform and confirmed that the Lambda was deployed, scheduled, and worked as expected. I also confirmed that I could cleanly destroy all of this Terraform.

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All future TODOs are captured in issues, which are referenced
in code comments.
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All relevant repo and/or project documentation has been updated
to reflect the changes in this PR.
All new and existing tests pass.

✅ Pre-merge checklist

Tear down and redeploy all Terraform to ensure it all applies cleanly.
Ensure that Provide initial functionality publish-egress-ip-lambda#4 has been approved and merged.

✅ Post-merge checklist

Confirm that all internal stakeholders are ready for this deployment
Deploy to Production

jsf9k

Nice work! I have one question before approving.

route53.tf

jsf9k

Powerful work!

mcdonnnj

Some suggestions/thoughts on my first pass. I think I have suggestions in variables.tf corresponding to all suggestions in README.md.

README.md

lambda.tf

lambda_assume_role_policy_doc.tf

variables.tf

README.md

lambda.tf

mcdonnnj

Thanks for your continued work on this. I have for your consideration some suggestions around the validation you added for the lambda_schedule_interval variable, correctly defining the rate provided to the schedule_expression argument, and then some miscellaneous capitalization/language suggestions.

lambda.tf

variables.tf

README.md

variables.tf

README.md

cloudfront.tf

lambda.tf

providers.tf

dav3r · 2022-08-01T15:38:16Z

I just added the blocked label on this PR so that I don't merge it until after cisagov/publish-egress-ip-lambda#4 has been approved and merged. I also added a Pre-merge checklist checkbox to the PR description above.

README.md

mcdonnnj

Quick reminder to enable these ignore directives:

publish-egress-ip-terraform/.github/dependabot.yml

Lines 24 to 36 in d1c0a29

    
           - package-ecosystem: "terraform" 
        
             directory: "/" 
        
             schedule: 
        
               interval: "weekly" 
        
             # ignore: 
        
             #   - dependency-name: "hashicorp/aws" 
        
           - package-ecosystem: "terraform" 
        
             directory: "/examples/basic_usage" 
        
             schedule: 
        
               interval: "weekly" 
        
             # ignore: 
        
             #   - dependency-name: "hashicorp/aws"

dav3r · 2022-09-19T18:24:19Z

Quick reminder to enable these ignore directives

Thanks @mcdonnnj for the reminder! Done in 3d83004.

…leton

The ZIP file is created with http://github.com/cisagov/publish-egress-ip-lambda Also: * Define the CloudWatch log group used by the Lambda * Schedule the Lambda function to run every X minutes using a CloudWatch event (configured via var.lambda_schedule_interval)

These are no longer needed now that we have moved to version 4.x of the Terraform AWS provider.

…tandard name

Using the current default runtime (nodejs14.x) of this module results in this error: "The runtime parameter of nodejs14.x is no longer supported for creating or updating AWS Lambda functions. We recommend you use the new runtime (nodejs20.x) while creating or updating functions." Using the AWS-recommended runtime of nodejs20.x results in this error: "expected runtime to be one of [nodejs nodejs4.3 nodejs6.10 nodejs8.10 nodejs10.x nodejs12.x nodejs14.x nodejs16.x java8 java8.al2 java11 python2.7 python3.6 python3.7 python3.8 python3.9 dotnetcore1.0 dotnetcore2.0 dotnetcore2.1 dotnetcore3.1 dotnet6 nodejs4.3-edge go1.x ruby2.5 ruby2.7 provided provided.al2 nodejs18.x python3.10 java17], got nodejs20.x" As best I can tell, this is because the Terraform AWS provider that we are currently pinned to (~> 4.9) does not support nodejs20.x. Given all of the info above, I chose to set the runtime to nodejs18.x and everything is working.

…ss bucket Things have changed a bit with how AWS does public bucket access since this code was initially created, so we must change with the times.

10 minutes was not long enough to iterate through all of our AWS accounts.

jsf9k

I have one suggested language tweak, but nothing that should hold up this PR.

variables.tf

README.md

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

s3.tf

…Front to read the bucket contents This is a more secure bucket configuration, since there is no direct public access to the bucket. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

mcdonnnj

This looks pretty solid. Some minor items for your consideration. I didn't want to go wild with the formatting changes until we codify it in the development guide but left the two suggestions I'd already done.

README.md

lambda_policy.tf

route53.tf

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

This is a recently agreed upon change to how our team should format Terraform. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Note that some of these changes were overlooked at the end of PR #6.

dav3r added documentation This issue or pull request improves or adds to documentation improvement This issue or pull request will add or improve functionality, maintainability, or ease of use labels Jul 22, 2022

dav3r requested review from felddy, jsf9k and mcdonnnj as code owners July 22, 2022 17:25

dav3r self-assigned this Jul 22, 2022

jsf9k reviewed Jul 22, 2022

View reviewed changes

route53.tf Outdated Show resolved Hide resolved

jsf9k approved these changes Jul 25, 2022

View reviewed changes

mcdonnnj reviewed Jul 26, 2022

View reviewed changes

dav3r commented Jul 26, 2022

View reviewed changes

lambda.tf Outdated Show resolved Hide resolved

dav3r requested a review from mcdonnnj July 26, 2022 19:47

mcdonnnj approved these changes Jul 29, 2022

View reviewed changes

dav3r added the blocked This issue or pull request is awaiting the outcome of another issue or pull request label Aug 1, 2022

mcdonnnj reviewed Aug 3, 2022

View reviewed changes

README.md Outdated Show resolved Hide resolved

dav3r mentioned this pull request Aug 3, 2022

Provide initial functionality cisagov/publish-egress-ip-lambda#4

Merged

9 tasks

mcdonnnj reviewed Sep 19, 2022

View reviewed changes

dav3r added the hacktoberfest-accepted Pull request that should count toward Hacktoberfest participation label Oct 5, 2022

dav3r mentioned this pull request Dec 28, 2023

Update the security header Lambda's runtime to Node 18 cisagov/cyhy_amis#738

Merged

6 tasks

dav3r added 10 commits May 6, 2024 10:15

Remove unneeded files inherited from skeleton

7ef247b

Define initial set of variables and remove unneded variables from ske…

508a2e5

…leton

Define providers

901ee32

Define Terraform backend

3eb46fc

Define Terraform remote states

f98b238

Define useful locals

cc23748

Create S3 bucket where published file(s) will be stored

ec85d81

Define Terraform output and remove skeleton outputs

cb836cc

Add IAM policy and role used by the publish-egress-ip Lambda

d601a21

dav3r added 2 commits May 6, 2024 14:20

Alphabetize resource arguments

a24ece3

Update README with latest output from terraform-docs

0e0f8b9

dav3r mentioned this pull request May 6, 2024

Resource cannot be applied cisagov/cool-dns-cyber.dhs.gov#79

Closed

dav3r added 3 commits May 6, 2024 15:34

Remove lifecycle blocks

f22ab6d

These are no longer needed now that we have moved to version 4.x of the Terraform AWS provider.

Modify name of expected Lambda deployment file to match our current s…

7bb9d3a

…tandard name

Remove a file that was inherited from the skeleton

20a45bb

dav3r mentioned this pull request May 17, 2024

Add two additional permissions to ProvisionPublishEgressIP policy cisagov/cool-accounts#144

Merged

6 tasks

dav3r added 3 commits May 17, 2024 15:19

Update the mechanism for defining public read-only access to the egre…

82763f1

…ss bucket Things have changed a bit with how AWS does public bucket access since this code was initially created, so we must change with the times.

Increase lambda timeout from 10 to 15 minutes

23f8e69

10 minutes was not long enough to iterate through all of our AWS accounts.

dav3r requested review from jsf9k and mcdonnnj May 20, 2024 15:03

jsf9k approved these changes May 20, 2024

View reviewed changes

variables.tf Outdated Show resolved Hide resolved

dav3r commented May 20, 2024

View reviewed changes

README.md Outdated Show resolved Hide resolved

Improve a variable description

4f66701

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

mcdonnnj requested changes May 24, 2024

View reviewed changes

s3.tf Outdated Show resolved Hide resolved

Replace bucket "public-read" ACL with a policy that only allows Cloud…

bc3338e

…Front to read the bucket contents This is a more secure bucket configuration, since there is no direct public access to the bucket. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

dav3r mentioned this pull request May 28, 2024

Add CloudFront Origin Access Controls permissions to ProvisionPublishEgressIP policy cisagov/cool-accounts#145

Merged

6 tasks

dav3r requested a review from mcdonnnj May 29, 2024 13:44

mcdonnnj approved these changes May 30, 2024

View reviewed changes

README.md Outdated Show resolved Hide resolved

lambda_policy.tf Outdated Show resolved Hide resolved

route53.tf Outdated Show resolved Hide resolved

route53.tf Outdated Show resolved Hide resolved

dav3r and others added 5 commits May 30, 2024 10:19

Specify hcl formatting in tfvars example

a22e100

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Remove now-unneeded ACL-related permissions

a748918

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Move TF configuration blocks to be after TF arguments in resources

a9feac5

This is a recently agreed upon change to how our team should format Terraform. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Alphabetically order TF arguments in a resource

333fed7

Adjust some newlines for readability

3d297df

dav3r removed the blocked This issue or pull request is awaiting the outcome of another issue or pull request label May 31, 2024

dav3r merged commit 0ba1733 into develop May 31, 2024
4 checks passed

dav3r deleted the first-commits branch May 31, 2024 18:50

dav3r added a commit that referenced this pull request Jun 3, 2024

Update README with current output from terraform-docs

5afdf06

Note that some of these changes were overlooked at the end of PR #6.

dav3r mentioned this pull request Jun 5, 2024

Code in terraform_egress_pub directory does not publish COOL IPs cisagov/cyhy_amis#284

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Provide initial functionality #6

Provide initial functionality #6

dav3r commented Jul 22, 2022 •

edited

Loading

jsf9k left a comment

jsf9k left a comment

mcdonnnj left a comment •

edited

Loading

mcdonnnj left a comment

dav3r commented Aug 1, 2022

mcdonnnj left a comment

dav3r commented Sep 19, 2022

jsf9k left a comment

mcdonnnj left a comment

	- package-ecosystem: "terraform"
	directory: "/"
	schedule:
	interval: "weekly"
	# ignore:
	# - dependency-name: "hashicorp/aws"

	- package-ecosystem: "terraform"
	directory: "/examples/basic_usage"
	schedule:
	interval: "weekly"
	# ignore:
	# - dependency-name: "hashicorp/aws"

Provide initial functionality #6

Provide initial functionality #6

Conversation

dav3r commented Jul 22, 2022 • edited Loading

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

✅ Pre-merge checklist

✅ Post-merge checklist

jsf9k left a comment

Choose a reason for hiding this comment

jsf9k left a comment

Choose a reason for hiding this comment

mcdonnnj left a comment • edited Loading

Choose a reason for hiding this comment

mcdonnnj left a comment

Choose a reason for hiding this comment

dav3r commented Aug 1, 2022

mcdonnnj left a comment

Choose a reason for hiding this comment

dav3r commented Sep 19, 2022

jsf9k left a comment

Choose a reason for hiding this comment

mcdonnnj left a comment

Choose a reason for hiding this comment

dav3r commented Jul 22, 2022 •

edited

Loading

mcdonnnj left a comment •

edited

Loading