terrafying-components 1.12.1 → 1.12.2
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 3ee4ef1e375d1463668c95f8020490686c1e066a1e3ae8adf145fd31bff0d383
|
4
|
+
data.tar.gz: 825119c10b497586f15f81017da4168b4bdac7e46951f726baad037c3c1ee75e
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: bbad728eb96c2d90c52ecce53870dee22a4035d6f491e7b25270f79ebc06e9d34bc8c57d30bfa488742f97104e6408a39726aad02dc034a4f753680d89ca913e
|
7
|
+
data.tar.gz: b7903fbac4e3fde558751ba49033251ca5389e091708dde92729b44248454fc066e609bc3b8ae6115da4a4113348580d1c2942f0951cccf3035585217fb64f71
|
@@ -2,6 +2,8 @@
|
|
2
2
|
|
3
3
|
require 'terrafying/components/security/config'
|
4
4
|
require 'terrafying/components/security/config_aggregator'
|
5
|
+
require 'terrafying/components/security/iam'
|
5
6
|
require 'terrafying/components/security/pagerduty_topic'
|
6
7
|
require 'terrafying/components/security/store'
|
7
8
|
require 'terrafying/components/security/trail'
|
9
|
+
require 'terrafying/components/security/vpc'
|
@@ -0,0 +1,58 @@
|
|
1
|
+
|
2
|
+
require 'terrafying'
|
3
|
+
|
4
|
+
module Terrafying
|
5
|
+
|
6
|
+
module Components
|
7
|
+
|
8
|
+
module Security
|
9
|
+
|
10
|
+
class IAM < Terrafying::Context
|
11
|
+
|
12
|
+
def self.create(*args)
|
13
|
+
IAM.new.create(*args)
|
14
|
+
end
|
15
|
+
|
16
|
+
def create(
|
17
|
+
support_assume_policy:
|
18
|
+
)
|
19
|
+
|
20
|
+
# 1.5 Ensure IAM password policy requires at least one uppercase letter
|
21
|
+
# 1.6 Ensure IAM password policy require at least one lowercase letter
|
22
|
+
# 1.7 Ensure IAM password policy require at least one symbol
|
23
|
+
# 1.8 Ensure IAM password policy require at least one number
|
24
|
+
# 1.9 Ensure IAM password policy requires minimum length of 14 or greater
|
25
|
+
# 1.10 Ensure IAM password policy prevents password reuse
|
26
|
+
# 1.11 Ensure IAM password policy expires passwords within 90 days or less
|
27
|
+
resource :aws_iam_account_password_policy, "strict", {
|
28
|
+
require_uppercase_characters: true,
|
29
|
+
require_lowercase_characters: true,
|
30
|
+
require_symbols: true,
|
31
|
+
require_numbers: true,
|
32
|
+
minimum_password_length: 14,
|
33
|
+
allow_users_to_change_password: true,
|
34
|
+
password_reuse_prevention: true,
|
35
|
+
max_password_age: 90,
|
36
|
+
}
|
37
|
+
|
38
|
+
# 1.20 Ensure a support role has been created to manage incidents with AWS Support
|
39
|
+
support_role = resource :aws_iam_role, "support", {
|
40
|
+
name: "support",
|
41
|
+
assume_role_policy: support_assume_policy,
|
42
|
+
}
|
43
|
+
|
44
|
+
resource :aws_iam_role_policy_attachment, "support_policy", {
|
45
|
+
role: support_role,
|
46
|
+
policy_arn: "arn:aws:iam::aws:policy/AWSSupportAccess",
|
47
|
+
}
|
48
|
+
|
49
|
+
self
|
50
|
+
end
|
51
|
+
|
52
|
+
end
|
53
|
+
|
54
|
+
end
|
55
|
+
|
56
|
+
end
|
57
|
+
|
58
|
+
end
|
@@ -10,7 +10,7 @@ module Terrafying
|
|
10
10
|
|
11
11
|
class Store < Terrafying::Context
|
12
12
|
|
13
|
-
attr_reader :name, :key_arn
|
13
|
+
attr_reader :name, :arn, :key_arn
|
14
14
|
|
15
15
|
def self.create(*args)
|
16
16
|
Store.new.create(*args)
|
@@ -54,6 +54,8 @@ module Terrafying
|
|
54
54
|
}
|
55
55
|
}
|
56
56
|
|
57
|
+
@arn = @bucket["arn"]
|
58
|
+
|
57
59
|
self
|
58
60
|
end
|
59
61
|
|
@@ -0,0 +1,110 @@
|
|
1
|
+
|
2
|
+
require 'terrafying'
|
3
|
+
|
4
|
+
module Terrafying
|
5
|
+
|
6
|
+
module Components
|
7
|
+
|
8
|
+
module Security
|
9
|
+
|
10
|
+
class VPC < Terrafying::Context
|
11
|
+
|
12
|
+
def self.create(*args)
|
13
|
+
VPC.new.create(*args)
|
14
|
+
end
|
15
|
+
|
16
|
+
def self.bucket_statements(bucket_name)
|
17
|
+
[
|
18
|
+
{
|
19
|
+
Sid: "FlowLogsAclCheck",
|
20
|
+
Effect: "Allow",
|
21
|
+
Principal: {
|
22
|
+
Service: "delivery.logs.amazonaws.com"
|
23
|
+
},
|
24
|
+
Action: "s3:GetBucketAcl",
|
25
|
+
Resource: "arn:aws:s3:::#{bucket_name}"
|
26
|
+
},
|
27
|
+
{
|
28
|
+
Sid: "FlowLogsWrite",
|
29
|
+
Effect: "Allow",
|
30
|
+
Principal: {
|
31
|
+
Service: "delivery.logs.amazonaws.com"
|
32
|
+
},
|
33
|
+
Action: "s3:PutObject",
|
34
|
+
Resource: "arn:aws:s3:::#{bucket_name}/flow-logs/*",
|
35
|
+
Condition: {
|
36
|
+
StringEquals: {
|
37
|
+
"s3:x-amz-acl" => "bucket-owner-full-control"
|
38
|
+
}
|
39
|
+
}
|
40
|
+
}
|
41
|
+
]
|
42
|
+
end
|
43
|
+
|
44
|
+
def self.key_statements
|
45
|
+
[
|
46
|
+
{
|
47
|
+
Sid: "Allow Flow logs to encrypt logs",
|
48
|
+
Effect: "Allow",
|
49
|
+
Principal: {"Service": ["delivery.logs.amazonaws.com"]},
|
50
|
+
Action: "kms:GenerateDataKey*",
|
51
|
+
Resource: "*",
|
52
|
+
},
|
53
|
+
]
|
54
|
+
end
|
55
|
+
|
56
|
+
|
57
|
+
def create(
|
58
|
+
region:,
|
59
|
+
provider:,
|
60
|
+
store:
|
61
|
+
)
|
62
|
+
|
63
|
+
ident = tf_safe("default-vpc-#{region}")
|
64
|
+
|
65
|
+
default_vpc = resource :aws_default_vpc, ident, {
|
66
|
+
provider: provider,
|
67
|
+
tags: { Name: "Default VPC" },
|
68
|
+
}
|
69
|
+
|
70
|
+
resource :aws_default_route_table, ident, {
|
71
|
+
provider: provider,
|
72
|
+
default_route_table_id: default_vpc["default_route_table_id"],
|
73
|
+
tags: { Name: "Default Route Table" },
|
74
|
+
}
|
75
|
+
|
76
|
+
resource :aws_default_network_acl, ident, {
|
77
|
+
provider: provider,
|
78
|
+
lifecycle: {
|
79
|
+
ignore_changes: [ "subnet_ids"],
|
80
|
+
},
|
81
|
+
|
82
|
+
default_network_acl_id: default_vpc["default_network_acl_id"],
|
83
|
+
|
84
|
+
tags: { Name: "Default Network ACL" },
|
85
|
+
}
|
86
|
+
|
87
|
+
resource :aws_default_security_group, ident, {
|
88
|
+
provider: provider,
|
89
|
+
vpc_id: default_vpc["id"],
|
90
|
+
tags: { Name: "Default Security Group" },
|
91
|
+
}
|
92
|
+
|
93
|
+
resource :aws_flow_log, ident, {
|
94
|
+
provider: provider,
|
95
|
+
vpc_id: default_vpc["id"],
|
96
|
+
traffic_type: "ALL",
|
97
|
+
log_destination: "#{store.arn}/flow-logs/",
|
98
|
+
log_destination_type: "s3",
|
99
|
+
}
|
100
|
+
|
101
|
+
self
|
102
|
+
end
|
103
|
+
|
104
|
+
end
|
105
|
+
|
106
|
+
end
|
107
|
+
|
108
|
+
end
|
109
|
+
|
110
|
+
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: terrafying-components
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.12.
|
4
|
+
version: 1.12.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- uSwitch Limited
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2019-05-
|
11
|
+
date: 2019-05-24 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -118,9 +118,11 @@ files:
|
|
118
118
|
- lib/terrafying/components/security.rb
|
119
119
|
- lib/terrafying/components/security/config.rb
|
120
120
|
- lib/terrafying/components/security/config_aggregator.rb
|
121
|
+
- lib/terrafying/components/security/iam.rb
|
121
122
|
- lib/terrafying/components/security/pagerduty_topic.rb
|
122
123
|
- lib/terrafying/components/security/store.rb
|
123
124
|
- lib/terrafying/components/security/trail.rb
|
125
|
+
- lib/terrafying/components/security/vpc.rb
|
124
126
|
- lib/terrafying/components/selfsignedca.rb
|
125
127
|
- lib/terrafying/components/service.rb
|
126
128
|
- lib/terrafying/components/staticset.rb
|