skip: update autotest for network, qldb, sagemaker

epam · May 31, 2024 · c8283ec · c8283ec
1 parent e419a0f
commit c8283ec
Show file tree

Hide file tree

Showing 9 changed files with 41 additions and 48 deletions.
diff --git a/.github/workflows/tf_testing.yml b/.github/workflows/tf_testing.yml
@@ -22,7 +22,7 @@ env:
   CORE_TESTING_FOLDER: ${{ github.workspace }}
   OUTPUT_DIR: ${{ github.workspace }}/auto_policy_testing/output
   AWS_DEFAULT_REGION: ${{ vars.AWS_REGION }}
-  resource_priority_list: 'kafka'
+  resource_priority_list: 'network,qldb,sagemaker'
   RED: '\033[0;31m'
 
 jobs:

diff --git a/auto_policy_testing/green/network/network.tf b/auto_policy_testing/green/network/network.tf
@@ -1,13 +1,22 @@
 resource "aws_network_acl" "this" {
-  vpc_id             = data.terraform_remote_state.common.outputs.vpc_id
-  subnet_ids         = [data.terraform_remote_state.common.outputs.vpc_subnet_1_id]
+  vpc_id     = data.terraform_remote_state.common.outputs.vpc_id
+  subnet_ids = [data.terraform_remote_state.common.outputs.vpc_subnet_1_id]
+  tags = {
+    Name = "${module.naming.resource_prefix.nacl}"
+  }
 }
 
 resource "aws_eip" "this" {
   instance = aws_instance.this.id
+  tags = {
+    Name = "${module.naming.resource_prefix.eip}"
+  }
 }
 
 resource "aws_instance" "this" {
   ami           = data.aws_ami.this.id
   instance_type = "t2.micro"
+  tags = {
+    Name = "${module.naming.resource_prefix.ec2_instance}"
+  }
 }
diff --git a/auto_policy_testing/green/qldb/qldb.tf b/auto_policy_testing/green/qldb/qldb.tf
@@ -1,5 +1,18 @@
 resource "aws_qldb_ledger" "this" {
-  name                = "${module.naming.resource_prefix.qldb}"
+  name                = module.naming.resource_prefix.qldb
   permissions_mode    = "STANDARD"
-  # deletion_protection = true
+  deletion_protection = true
 }
+
+resource "null_resource" "this" {
+  triggers = {
+    qldb = aws_qldb_ledger.this.id
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "aws qldb update-ledger --name ${self.triggers.qldb} --no-deletion-protection"
+  }
+
+  depends_on = [aws_qldb_ledger.this]
+}
diff --git a/auto_policy_testing/green/sagemaker/sagemaker.tf b/auto_policy_testing/green/sagemaker/sagemaker.tf
@@ -21,6 +21,7 @@ resource "aws_sagemaker_model" "this" {
 }
 
 resource "aws_iam_role" "this" {
+  name = "${module.naming.resource_prefix.sagemaker_notebook}"
   assume_role_policy = data.aws_iam_policy_document.this.json
 }
 
@@ -35,25 +36,6 @@ resource "aws_sagemaker_notebook_instance" "this" {
   root_access            = "Disabled"
 }
 
-resource "aws_iam_role" "this2" {
-  name = "${module.naming.resource_prefix.sagemaker_notebook}"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {
-                "Service": "sagemaker.amazonaws.com"
-            },
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
-}
-
 resource "aws_security_group" "this" {
   name   = "${module.naming.resource_prefix.sagemaker_notebook}"
   vpc_id = data.terraform_remote_state.common.outputs.vpc_id

diff --git a/auto_policy_testing/red/network/network.tf b/auto_policy_testing/red/network/network.tf
@@ -1,7 +1,11 @@
 resource "aws_network_acl" "this" {
-  vpc_id   = data.terraform_remote_state.common.outputs.vpc_id
   provider = aws.provider2
+  vpc_id   = data.terraform_remote_state.common.outputs.vpc_id
 }
 
-resource "aws_eip" "this" { }
+resource "aws_eip" "this" {
+  tags = {
+    Name = "${module.naming.resource_prefix.eip}"
+  }
+}
 
diff --git a/auto_policy_testing/red/qldb/qldb.tf b/auto_policy_testing/red/qldb/qldb.tf
@@ -1,6 +1,6 @@
 resource "aws_qldb_ledger" "this" {
+  provider            = aws.provider2
   name                = "${module.naming.resource_prefix.qldb}"
   permissions_mode    = "ALLOW_ALL"
   deletion_protection = false
-  provider            = aws.provider2
 }
diff --git a/auto_policy_testing/red/sagemaker/sagemaker.tf b/auto_policy_testing/red/sagemaker/sagemaker.tf
@@ -20,33 +20,16 @@ resource "aws_sagemaker_model" "this" {
 }
 
 resource "aws_iam_role" "this" {
+  name = "${module.naming.resource_prefix.sagemaker_notebook}"
   assume_role_policy = data.aws_iam_policy_document.this.json
 }
 
 resource "aws_sagemaker_notebook_instance" "this" {
+  provider               = aws.provider2
   name                   = "${module.naming.resource_prefix.sagemaker_notebook}"
   role_arn               = aws_iam_role.this.arn
   instance_type          = "ml.t2.medium"
   direct_internet_access = "Enabled"
   root_access            = "Enabled"
-  provider               = aws.provider2
-}
-
-resource "aws_iam_role" "this2" {
-  name = "${module.naming.resource_prefix.sagemaker_notebook}"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {
-                "Service": "sagemaker.amazonaws.com"
-            },
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
+
 }
diff --git a/auto_policy_testing/scripts/aws_map_report_fields.json b/auto_policy_testing/scripts/aws_map_report_fields.json
@@ -71,7 +71,7 @@
   "network-acl": ["NetworkAclId"],
   "network-addr": ["AllocationId"],
   "peering-connection": ["VpcPeeringConnectionId"],
-  "qldb": ["EnvironmentArn"],
+  "qldb": ["Arn"],
   "r53domain": ["DomainName"],
   "rds": ["DBInstanceArn"],
   "rds-cluster": ["DBClusterArn"],

diff --git a/auto_policy_testing/shared_tf_modules/naming/outputs.tf b/auto_policy_testing/shared_tf_modules/naming/outputs.tf
@@ -53,6 +53,8 @@ output "resource_prefix" {
     ebs_snapshot      = "${local.suffix}_${var.resource_type}_snap_${local.compliance_status}"
     security_group    = "${local.suffix}_${var.resource_type}_sg_${local.compliance_status}"
     vpc               = "${local.suffix}_${var.resource_type}_vpc_${local.compliance_status}"
+    nacl              = "${local.suffix}_${var.resource_type}-nacl-${local.compliance_status}"
+    eip               = "${local.suffix}_${var.resource_type}-eip-${local.compliance_status}"
     ecr_repository    = "${local.suffix}_${var.resource_type}_repo_${local.compliance_status}"
     lambda_function   = "${local.suffix}_${var.resource_type}_fun_${local.compliance_status}"
     iam_role          = "${local.suffix}_${var.resource_type}_role_${local.compliance_status}"