Revert "Feature | build.env to tf 1.0.9 + configs updated to .tfvars …

…=> leverage cli 1.1.0 + deactivate cf-s3-www.binbash.com.ar"
binbashar · Oct 28, 2021 · 0725927 · 0725927
1 parent 6bd6c1b
commit 0725927
Show file tree

Hide file tree

Showing 97 changed files with 246 additions and 107 deletions.
diff --git a/.gitignore b/.gitignore
@@ -21,7 +21,12 @@
 ############
 id_rsa
 id_dsa
-*keys/
+keys/
+!/apps-devstg/base-identities/keys/
+!/apps-prd/base-identities/keys/
+!/security/base-identities/keys/
+!/shared/base-identities/keys/
+!/root/base-identities/keys/
 
 # OS generated files #
 ######################
@@ -93,7 +98,7 @@ Thumbs.db
 #
 # Config Files
 #
-*common.tfvars
+*common.config
 #
 # Scripts and Makefiles
 #

diff --git a/apps-devstg/config/account.tfvars → apps-devstg/config/account.config b/apps-devstg/config/account.tfvars → apps-devstg/config/account.config
diff --git a/apps-devstg/config/backend.tfvars → apps-devstg/config/backend.config b/apps-devstg/config/backend.tfvars → apps-devstg/config/backend.config
diff --git a/...tg/us-east-1/cdn-s3-frontend --/config.tf → ...evstg/us-east-1/cdn-s3-frontend/config.tf b/...tg/us-east-1/cdn-s3-frontend --/config.tf → ...evstg/us-east-1/cdn-s3-frontend/config.tf
@@ -2,6 +2,7 @@
 # AWS Provider Settings       #
 #=============================#
 provider "aws" {
+  version                 = "~> 3.0"
   region                  = var.region
   profile                 = var.profile
   shared_credentials_file = "~/.aws/${var.project}/config"
@@ -13,9 +14,9 @@ provider "aws" {
 # binbash-shared route53 cross-account ACM dns validation update
 #
 provider "aws" {
+  version                 = "~> 3.0"
   region                  = var.region
-  profile                 = "${var.project}-shared-devops"
-//  profile                 = var.profile_shared
+  profile                 = var.profile_shared
   shared_credentials_file = "~/.aws/${var.project}/config"
   alias                   = "shared-route53"
 }
@@ -24,11 +25,7 @@ provider "aws" {
 # Backend Config (partial)    #
 #=============================#
 terraform {
-  required_version = ">= 0.14.11"
-
-  required_providers {
-    aws = "~> 3.0"
-  }
+  required_version = ">= 0.13.2"
 
   backend "s3" {
     key = "apps-devstg/cdn-s3/terraform.tfstate"

diff --git a/...-s3-frontend --/dev.aws.binbash.com.ar.tf → ...cdn-s3-frontend/dev.aws.binbash.com.ar.tf b/...-s3-frontend --/dev.aws.binbash.com.ar.tf → ...cdn-s3-frontend/dev.aws.binbash.com.ar.tf
@@ -2,7 +2,7 @@
 # Statics S3 Bucket + CloudFront CDN for moderncare.com
 #
 module "dev_aws_binbash_com_ar" {
-  source = "github.com/binbashar/terraform-aws-cloudfront-s3-cdn.git?ref=0.75.0"
+  source = "github.com/binbashar/terraform-aws-cloudfront-s3-cdn.git?ref=0.35.0"
 
   # Common: bucket naming convention is "bb-apps-devstg-frontend-[DOMAIN_NAME]-origin"
   namespace = "${var.project}-${var.environment}-frontend"
@@ -33,7 +33,6 @@ module "dev_aws_binbash_com_ar" {
   minimum_protocol_version = "TLSv1"
   encryption_enabled       = true
   additional_bucket_policy = data.aws_iam_policy_document.additional_bucket_policy.json
-  versioning_enabled       = true
 
   logging_enabled     = true
   log_expiration_days = 90 # N° of days after which to expunge the objects

diff --git a/...tg/us-east-1/cdn-s3-frontend --/locals.tf → ...evstg/us-east-1/cdn-s3-frontend/locals.tf b/...tg/us-east-1/cdn-s3-frontend --/locals.tf → ...evstg/us-east-1/cdn-s3-frontend/locals.tf
diff --git a/...us-east-1/cdn-s3-frontend --/variables.tf → ...tg/us-east-1/cdn-s3-frontend/variables.tf b/...us-east-1/cdn-s3-frontend --/variables.tf → ...tg/us-east-1/cdn-s3-frontend/variables.tf
@@ -91,16 +91,6 @@ variable "appsprd_account_id" {
   description = "Account: Prod Modules & Libs"
 }
 
-variable "vault_address" {
-  type        = string
-  description = "Vault Address"
-}
-
-variable "vault_token" {
-  type        = string
-  description = "Vault Token"
-}
-
 #=============================#
 # CDN DNS variables           #
 #=============================#

diff --git a/apps-prd/config/account.tfvars → apps-prd/config/account.config b/apps-prd/config/account.tfvars → apps-prd/config/account.config
diff --git a/apps-prd/config/backend.tfvars → apps-prd/config/backend.config b/apps-prd/config/backend.tfvars → apps-prd/config/backend.config
diff --git a/...rd/us-east-1/cdn-s3-frontend --/config.tf → apps-prd/us-east-1/cdn-s3-frontend/config.tf b/...rd/us-east-1/cdn-s3-frontend --/config.tf → apps-prd/us-east-1/cdn-s3-frontend/config.tf
@@ -14,8 +14,7 @@ provider "aws" {
 #
 provider "aws" {
   region                  = var.region
-  profile                 = "${var.project}-shared-devops"
-//  profile                 = var.profile_shared
+  profile                 = var.profile_shared
   shared_credentials_file = "~/.aws/${var.project}/config"
   alias                   = "shared-route53"
 }

diff --git a/...rd/us-east-1/cdn-s3-frontend --/locals.tf → apps-prd/us-east-1/cdn-s3-frontend/locals.tf b/...rd/us-east-1/cdn-s3-frontend --/locals.tf → apps-prd/us-east-1/cdn-s3-frontend/locals.tf
diff --git a/...d/us-east-1/cdn-s3-frontend --/statics.tf → ...-prd/us-east-1/cdn-s3-frontend/statics.tf b/...d/us-east-1/cdn-s3-frontend --/statics.tf → ...-prd/us-east-1/cdn-s3-frontend/statics.tf
@@ -2,7 +2,7 @@
 # Statics S3 Bucket + CloudFront CDN for moderncare.com
 #
 module "www_binbash_com_ar_statics" {
-  source = "github.com/binbashar/terraform-aws-cloudfront-s3-cdn.git?ref=0.75.0"
+  source = "github.com/binbashar/terraform-aws-cloudfront-s3-cdn.git?ref=0.69.0"
 
   # Common: bucket naming convention is "[PROJECT]-[ENV]-statics-[DOMAIN_NAME]"
   namespace = "${var.project}-${var.environment}-statics"

diff --git a/...us-east-1/cdn-s3-frontend --/variables.tf → ...rd/us-east-1/cdn-s3-frontend/variables.tf b/...us-east-1/cdn-s3-frontend --/variables.tf → ...rd/us-east-1/cdn-s3-frontend/variables.tf
@@ -91,16 +91,6 @@ variable "appsprd_account_id" {
   description = "Account: Prod Modules & Libs"
 }
 
-variable "vault_address" {
-  type        = string
-  description = "Vault Address"
-}
-
-variable "vault_token" {
-  type        = string
-  description = "Vault Token"
-}
-
 #=============================#
 # CDN DNS variables           #
 #=============================#

diff --git a/.../cdn-s3-frontend --/www.binbash.com.ar.tf → ...t-1/cdn-s3-frontend/www.binbash.com.ar.tf b/.../cdn-s3-frontend --/www.binbash.com.ar.tf → ...t-1/cdn-s3-frontend/www.binbash.com.ar.tf
@@ -2,7 +2,7 @@
 # Statics S3 Bucket + CloudFront CDN for moderncare.com
 #
 module "www_binbash_com_ar" {
-  source = "github.com/binbashar/terraform-aws-cloudfront-s3-cdn.git?ref=0.75.0"
+  source = "github.com/binbashar/terraform-aws-cloudfront-s3-cdn.git?ref=0.69.0"
 
   # Common: bucket naming convention is "bb-apps-prd-frontend-[DOMAIN_NAME]-origin"
   namespace            = "${var.project}-${var.environment}-frontend"

diff --git a/build.env b/build.env
@@ -6,6 +6,6 @@ MFA_ENABLED=true
 
 # Terraform
 TERRAFORM_IMAGE_NAME=binbash/terraform-awscli-slim
-TERRAFORM_IMAGE_TAG=1.0.9
+TERRAFORM_IMAGE_TAG=0.14.11
 TERRAFORM_ENTRYPOINT=/bin/terraform
 TERRAFORM_MFA_ENTRYPOINT=/root/scripts/aws-mfa/aws-mfa-entrypoint.sh
diff --git a/config/common.tfvars.example → config/common.config.example b/config/common.tfvars.example → config/common.config.example
diff --git a/config/common.tfvars b/config/common.tfvars
diff --git a/network/global/base-identities/account.tf → network/base-identities/account.tf b/network/global/base-identities/account.tf → network/base-identities/account.tf
diff --git a/network/global/base-identities/config.tf → network/base-identities/config.tf b/network/global/base-identities/config.tf → network/base-identities/config.tf
diff --git a/network/global/base-identities/groups.tf → network/base-identities/groups.tf b/network/global/base-identities/groups.tf → network/base-identities/groups.tf
diff --git a/network/global/base-identities/locals.tf → network/base-identities/locals.tf b/network/global/base-identities/locals.tf → network/base-identities/locals.tf
diff --git a/network/global/base-identities/outputs.tf → network/base-identities/outputs.tf b/network/global/base-identities/outputs.tf → network/base-identities/outputs.tf
diff --git a/network/global/base-identities/policies.tf → network/base-identities/policies.tf b/network/global/base-identities/policies.tf → network/base-identities/policies.tf
diff --git a/network/global/base-identities/roles.tf → network/base-identities/roles.tf b/network/global/base-identities/roles.tf → network/base-identities/roles.tf
diff --git a/...l/base-identities/service_linked_roles.tf → ...k/base-identities/service_linked_roles.tf b/...l/base-identities/service_linked_roles.tf → ...k/base-identities/service_linked_roles.tf
diff --git a/network/global/base-identities/users.tf → network/base-identities/users.tf b/network/global/base-identities/users.tf → network/base-identities/users.tf
diff --git a/network/global/base-identities/variables.tf → network/base-identities/variables.tf b/network/global/base-identities/variables.tf → network/base-identities/variables.tf
diff --git a/network/us-east-1/base-network/README.md → network/base-network/README.md b/network/us-east-1/base-network/README.md → network/base-network/README.md
diff --git a/network/us-east-1/base-network/account.tf → network/base-network/account.tf b/network/us-east-1/base-network/account.tf → network/base-network/account.tf
diff --git a/network/us-east-1/base-network/config.tf → network/base-network/config.tf b/network/us-east-1/base-network/config.tf → network/base-network/config.tf
diff --git a/...-east-1/base-network/customer_gateways.tf → network/base-network/customer_gateways.tf b/...-east-1/base-network/customer_gateways.tf → network/base-network/customer_gateways.tf
diff --git a/network/us-east-1/base-network/locals.tf → network/base-network/locals.tf b/network/us-east-1/base-network/locals.tf → network/base-network/locals.tf
diff --git a/...s-east-1/base-network/network.auto.tfvars → network/base-network/network.auto.tfvars b/...s-east-1/base-network/network.auto.tfvars → network/base-network/network.auto.tfvars
diff --git a/network/us-east-1/base-network/network.tf → network/base-network/network.tf b/network/us-east-1/base-network/network.tf → network/base-network/network.tf
diff --git a/network/us-east-1/base-network/outputs.tf → network/base-network/outputs.tf b/network/us-east-1/base-network/outputs.tf → network/base-network/outputs.tf
diff --git a/network/us-east-1/base-network/variables.tf → network/base-network/variables.tf b/network/us-east-1/base-network/variables.tf → network/base-network/variables.tf
@@ -218,7 +218,7 @@ variable "vpc_endpoints" {
 variable "enable_tgw" {
   description = "Enable Transit Gateway Support"
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_vpc_attach" {

diff --git a/...rk/us-east-1/base-network/vpn_gateways.tf → network/base-network/vpn_gateways.tf b/...rk/us-east-1/base-network/vpn_gateways.tf → network/base-network/vpn_gateways.tf
diff --git a/network/us-east-1/base-tf-backend/README.md → network/base-tf-backend/README.md b/network/us-east-1/base-tf-backend/README.md → network/base-tf-backend/README.md
diff --git a/network/us-east-1/base-tf-backend/config.tf → network/base-tf-backend/config.tf b/network/us-east-1/base-tf-backend/config.tf → network/base-tf-backend/config.tf
diff --git a/network/us-east-1/base-tf-backend/locals.tf → network/base-tf-backend/locals.tf b/network/us-east-1/base-tf-backend/locals.tf → network/base-tf-backend/locals.tf
diff --git a/network/us-east-1/base-tf-backend/main.tf → network/base-tf-backend/main.tf b/network/us-east-1/base-tf-backend/main.tf → network/base-tf-backend/main.tf
diff --git a/...rk/us-east-1/base-tf-backend/variables.tf → network/base-tf-backend/variables.tf b/...rk/us-east-1/base-tf-backend/variables.tf → network/base-tf-backend/variables.tf
diff --git a/network/config/account.tfvars → network/config/account.config b/network/config/account.tfvars → network/config/account.config
diff --git a/network/config/backend.tfvars → network/config/backend.config b/network/config/backend.tfvars → network/config/backend.config
diff --git a/network/us-east-1/network-firewall/README.md → network/network-firewall/README.md b/network/us-east-1/network-firewall/README.md → network/network-firewall/README.md
diff --git a/network/us-east-1/network-firewall/config.tf → network/network-firewall/config.tf b/network/us-east-1/network-firewall/config.tf → network/network-firewall/config.tf
diff --git a/...rk/us-east-1/network-firewall/firewall.tf → network/network-firewall/firewall.tf b/...rk/us-east-1/network-firewall/firewall.tf → network/network-firewall/firewall.tf
diff --git a/network/us-east-1/network-firewall/locals.tf → network/network-firewall/locals.tf b/network/us-east-1/network-firewall/locals.tf → network/network-firewall/locals.tf
diff --git a/...ork/us-east-1/network-firewall/network.tf → network/network-firewall/network.tf b/...ork/us-east-1/network-firewall/network.tf → network/network-firewall/network.tf
diff --git a/...ork/us-east-1/network-firewall/outputs.tf → network/network-firewall/outputs.tf b/...ork/us-east-1/network-firewall/outputs.tf → network/network-firewall/outputs.tf
diff --git a/...k/us-east-1/network-firewall/variables.tf → network/network-firewall/variables.tf b/...k/us-east-1/network-firewall/variables.tf → network/network-firewall/variables.tf
diff --git a/network/us-east-1/notifications/README.md → network/notifications/README.md b/network/us-east-1/notifications/README.md → network/notifications/README.md
diff --git a/network/us-east-1/notifications/build.env → network/notifications/build.env b/network/us-east-1/notifications/build.env → network/notifications/build.env
diff --git a/network/us-east-1/notifications/config.tf → network/notifications/config.tf b/network/us-east-1/notifications/config.tf → network/notifications/config.tf
diff --git a/network/us-east-1/notifications/locals.tf → network/notifications/locals.tf b/network/us-east-1/notifications/locals.tf → network/notifications/locals.tf
diff --git a/network/us-east-1/notifications/outputs.tf → network/notifications/outputs.tf b/network/us-east-1/notifications/outputs.tf → network/notifications/outputs.tf
diff --git a/network/us-east-1/notifications/secrets.enc → network/notifications/secrets.enc b/network/us-east-1/notifications/secrets.enc → network/notifications/secrets.enc
diff --git a/...1/notifications/slack_tools_monitoring.tf → ...k/notifications/slack_tools_monitoring.tf b/...1/notifications/slack_tools_monitoring.tf → ...k/notifications/slack_tools_monitoring.tf
diff --git a/...tifications/slack_tools_monitoring_sec.tf → ...tifications/slack_tools_monitoring_sec.tf b/...tifications/slack_tools_monitoring_sec.tf → ...tifications/slack_tools_monitoring_sec.tf
diff --git a/network/us-east-1/notifications/variables.tf → network/notifications/variables.tf b/network/us-east-1/notifications/variables.tf → network/notifications/variables.tf
diff --git a/...us-east-1/security-audit/awscloudtrail.tf → network/security-audit/awscloudtrail.tf b/...us-east-1/security-audit/awscloudtrail.tf → network/security-audit/awscloudtrail.tf
diff --git a/network/us-east-1/security-audit/build.env → network/security-audit/build.env b/network/us-east-1/security-audit/build.env → network/security-audit/build.env
diff --git a/network/us-east-1/security-audit/config.tf → network/security-audit/config.tf b/network/us-east-1/security-audit/config.tf → network/security-audit/config.tf
diff --git a/network/us-east-1/security-audit/locals.tf → network/security-audit/locals.tf b/network/us-east-1/security-audit/locals.tf → network/security-audit/locals.tf
diff --git a/...east-1/security-audit/metrics.auto.tfvars → network/security-audit/metrics.auto.tfvars b/...east-1/security-audit/metrics.auto.tfvars → network/security-audit/metrics.auto.tfvars
diff --git a/...ork/us-east-1/security-audit/variables.tf → network/security-audit/variables.tf b/...ork/us-east-1/security-audit/variables.tf → network/security-audit/variables.tf
diff --git a/network/us-east-1/security-base/account.tf → network/security-base/account.tf b/network/us-east-1/security-base/account.tf → network/security-base/account.tf
diff --git a/network/us-east-1/security-base/build.env → network/security-base/build.env b/network/us-east-1/security-base/build.env → network/security-base/build.env
diff --git a/network/us-east-1/security-base/config.tf → network/security-base/config.tf b/network/us-east-1/security-base/config.tf → network/security-base/config.tf
diff --git a/network/us-east-1/security-base/variables.tf → network/security-base/variables.tf b/network/us-east-1/security-base/variables.tf → network/security-base/variables.tf
diff --git a/...s-east-1/security-compliance/awsconfig.tf → network/security-compliance/awsconfig.tf b/...s-east-1/security-compliance/awsconfig.tf → network/security-compliance/awsconfig.tf
diff --git a/...k/us-east-1/security-compliance/config.tf → network/security-compliance/config.tf b/...k/us-east-1/security-compliance/config.tf → network/security-compliance/config.tf
diff --git a/.../us-east-1/security-compliance/outputs.tf → network/security-compliance/outputs.tf b/.../us-east-1/security-compliance/outputs.tf → network/security-compliance/outputs.tf
diff --git a/...s-east-1/security-compliance/variables.tf → network/security-compliance/variables.tf b/...s-east-1/security-compliance/variables.tf → network/security-compliance/variables.tf
diff --git a/network/security-keys/build.env b/network/security-keys/build.env
@@ -0,0 +1 @@
+TERRAFORM_IMAGE_TAG=0.14.11
diff --git a/network/security-keys/config.tf b/network/security-keys/config.tf
@@ -0,0 +1,23 @@
+#=============================#
+# AWS Provider Settings       #
+#=============================#
+provider "aws" {
+  region                  = var.region
+  profile                 = var.profile
+  shared_credentials_file = "~/.aws/${var.project}/config"
+}
+
+#=============================#
+# Backend Config (partial)    #
+#=============================#
+terraform {
+  required_version = ">= 0.14.11"
+
+  required_providers {
+    aws = "~> 3.0"
+  }
+
+  backend "s3" {
+    key = "network/security-keys/terraform.tfstate"
+  }
+}
diff --git a/network/security-keys/kms.tf b/network/security-keys/kms.tf
@@ -0,0 +1,52 @@
+module "kms_key" {
+  source = "github.com/binbashar/terraform-aws-kms-key.git?ref=0.10.0"
+
+  enabled                 = true
+  namespace               = var.project
+  stage                   = var.environment
+  name                    = var.kms_key_name
+  delimiter               = "-"
+  description             = "KMS key for ${var.environment} Account"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+  alias                   = "alias/${var.project}_${var.environment}_${var.kms_key_name}_key"
+  policy                  = data.aws_iam_policy_document.kms.json
+  tags                    = local.tags
+}
+
+data "aws_iam_policy_document" "kms" {
+  statement {
+    sid       = "Enable IAM User Permissions"
+    effect    = "Allow"
+    actions   = ["kms:*"]
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${var.network_account_id}:root"]
+    }
+  }
+
+  statement {
+    sid    = "Enable CloudWatch Logs Service"
+    effect = "Allow"
+    actions = [
+      "kms:Encrypt*",
+      "kms:Decrypt*",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:Describe*"
+    ]
+    resources = ["*"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["logs.${var.region}.amazonaws.com"]
+    }
+    condition {
+      test     = "ArnLike"
+      variable = "kms:EncryptionContext:aws:logs:arn"
+      values   = ["arn:aws:logs:${var.region}:${var.network_account_id}:*"]
+    }
+  }
+}
diff --git a/network/security-keys/locals.tf b/network/security-keys/locals.tf
@@ -0,0 +1,6 @@
+locals {
+  tags = {
+    Terraform   = "true"
+    Environment = var.environment
+  }
+}
diff --git a/network/security-keys/outputs.tf b/network/security-keys/outputs.tf
@@ -0,0 +1,29 @@
+#
+# EC2 aws_key_pair name
+#
+output "aws_key_pair_name" {
+  value = aws_key_pair.compute-ssh-key.key_name
+}
+
+#
+# KMS aws_kms_key outputs
+#
+output "aws_kms_key_arn" {
+  description = "Key ARN"
+  value       = module.kms_key.key_arn
+}
+
+output "aws_kms_key_id" {
+  description = "KMS Key ID"
+  value       = module.kms_key.key_id
+}
+
+output "aws_kms_key_alias_arn" {
+  description = "KMS Alias ARN"
+  value       = module.kms_key.alias_arn
+}
+
+output "aws_kms_key_alias_name" {
+  description = "KMS Alias name"
+  value       = module.kms_key.alias_name
+}
diff --git a/network/security-keys/ssh.tf b/network/security-keys/ssh.tf
@@ -0,0 +1,4 @@
+resource "aws_key_pair" "compute-ssh-key" {
+  key_name   = var.compute_ssh_key_name
+  public_key = var.compute_ssh_public_key
+}