Enhacement | security-base: Update versions constraint

[rodriguez-matias]

What?

• Update and test Ref Architecture layers with tf latest versions, Leverage CLI latest version and SSO feature enabled.

How?

• Update tf version constrains ~> v1.2.7
• Update tf aws provider constrains ~> v4.10
• Update module version to the latest available

Environment Versions

• Leverage CLI : v1.8
• Terraform: v1.2.7
• provider registry.terraform.io/hashicorp/aws v4.47.0

Layers

/apps-devstg/us-east-1/security-base
/apps-prd/us-east-1/security-base
/management/us-east-1/security-base
/network/us-east-1/security-base
/security/us-east-1/security-base
/shared/us-east-1/security-base

Why?

Keeping Leverage Reference Architecture up to date.

References

GitHub issue #370

[github-actions]

💰 Infracost estimate: monthly cost will not change

Project	Previous	New	Diff
All projects	$1,766	$1,766	$0

124 projects have no cost estimate changes.

Infracost output

──────────────────────────────────

The following projects have no cost estimate changes: binbashar/le-tf-infra-aws/apps-devstg/global/base-identities (Module path: apps-devstg/global/base-identities), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/backups -- (Module path: apps-devstg/us-east-1/backups --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/base-network (Module path: apps-devstg/us-east-1/base-network), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/base-tf-backend (Module path: apps-devstg/us-east-1/base-tf-backend), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/cdn-s3-frontend -- (Module path: apps-devstg/us-east-1/cdn-s3-frontend --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/databases-aurora (Module path: apps-devstg/us-east-1/databases-aurora), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/databases-mysql -- (Module path: apps-devstg/us-east-1/databases-mysql --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/databases-pgsql -- (Module path: apps-devstg/us-east-1/databases-pgsql --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/ec2-fleet-ansible -- (Module path: apps-devstg/us-east-1/ec2-fleet-ansible --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-demoapps/cluster (Module path: apps-devstg/us-east-1/k8s-eks-demoapps/cluster), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-demoapps/identities (Module path: apps-devstg/us-east-1/k8s-eks-demoapps/identities), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components (Module path: apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-workloads (Module path: apps-devstg/us-east-1/k8s-eks-demoapps/k8s-workloads), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-demoapps/network (Module path: apps-devstg/us-east-1/k8s-eks-demoapps/network), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-v1.17/cluster (Module path: apps-devstg/us-east-1/k8s-eks-v1.17/cluster), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-v1.17/identities (Module path: apps-devstg/us-east-1/k8s-eks-v1.17/identities), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-v1.17/k8s-resources (Module path: apps-devstg/us-east-1/k8s-eks-v1.17/k8s-resources), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-v1.17/k8s-workloads (Module path: apps-devstg/us-east-1/k8s-eks-v1.17/k8s-workloads), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-eks-v1.17/network (Module path: apps-devstg/us-east-1/k8s-eks-v1.17/network), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-kind/k8s-resources (Module path: apps-devstg/us-east-1/k8s-kind/k8s-resources), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-kops --/1-prerequisites (Module path: apps-devstg/us-east-1/k8s-kops --/1-prerequisites), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/k8s-kops --/2-kops (Module path: apps-devstg/us-east-1/k8s-kops --/2-kops), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/notifications (Module path: apps-devstg/us-east-1/notifications), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/security-audit (Module path: apps-devstg/us-east-1/security-audit), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/security-base (Module path: apps-devstg/us-east-1/security-base), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/security-certs (Module path: apps-devstg/us-east-1/security-certs), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/security-compliance -- (Module path: apps-devstg/us-east-1/security-compliance --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/security-firewall -- (Module path: apps-devstg/us-east-1/security-firewall --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/security-keys (Module path: apps-devstg/us-east-1/security-keys), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/storage/s3-bucket-demo-files -- (Module path: apps-devstg/us-east-1/storage/s3-bucket-demo-files --), binbashar/le-tf-infra-aws/apps-devstg/us-east-1/tools-cloud-nuke (Module path: apps-devstg/us-east-1/tools-cloud-nuke), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/k8s-eks-v1.17/cluster (Module path: apps-devstg/us-east-2/k8s-eks-v1.17/cluster), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/k8s-eks-v1.17/identities (Module path: apps-devstg/us-east-2/k8s-eks-v1.17/identities), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources (Module path: apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/k8s-eks-v1.17/k8s-workloads (Module path: apps-devstg/us-east-2/k8s-eks-v1.17/k8s-workloads), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/k8s-eks-v1.17/network (Module path: apps-devstg/us-east-2/k8s-eks-v1.17/network), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/security-compliance -- (Module path: apps-devstg/us-east-2/security-compliance --), binbashar/le-tf-infra-aws/apps-devstg/us-east-2/security-keys (Module path: apps-devstg/us-east-2/security-keys), binbashar/le-tf-infra-aws/apps-prd/global/base-identities (Module path: apps-prd/global/base-identities), binbashar/le-tf-infra-aws/apps-prd/us-east-1/backups -- (Module path: apps-prd/us-east-1/backups --), binbashar/le-tf-infra-aws/apps-prd/us-east-1/base-network (Module path: apps-prd/us-east-1/base-network), binbashar/le-tf-infra-aws/apps-prd/us-east-1/base-tf-backend (Module path: apps-prd/us-east-1/base-tf-backend), binbashar/le-tf-infra-aws/apps-prd/us-east-1/cdn-s3-frontend -- (Module path: apps-prd/us-east-1/cdn-s3-frontend --), binbashar/le-tf-infra-aws/apps-prd/us-east-1/ec2-fleet -- (Module path: apps-prd/us-east-1/ec2-fleet --), binbashar/le-tf-infra-aws/apps-prd/us-east-1/notifications (Module path: apps-prd/us-east-1/notifications), binbashar/le-tf-infra-aws/apps-prd/us-east-1/security-audit (Module path: apps-prd/us-east-1/security-audit), binbashar/le-tf-infra-aws/apps-prd/us-east-1/security-base (Module path: apps-prd/us-east-1/security-base), binbashar/le-tf-infra-aws/apps-prd/us-east-1/security-certs (Module path: apps-prd/us-east-1/security-certs), binbashar/le-tf-infra-aws/apps-prd/us-east-1/security-compliance -- (Module path: apps-prd/us-east-1/security-compliance --), binbashar/le-tf-infra-aws/apps-prd/us-east-1/security-keys (Module path: apps-prd/us-east-1/security-keys), binbashar/le-tf-infra-aws/management/global/base-identities (Module path: management/global/base-identities), binbashar/le-tf-infra-aws/management/global/cost-mgmt (Module path: management/global/cost-mgmt), binbashar/le-tf-infra-aws/management/global/organizations (Module path: management/global/organizations), binbashar/le-tf-infra-aws/management/global/sso (Module path: management/global/sso), binbashar/le-tf-infra-aws/management/us-east-1/backups (Module path: management/us-east-1/backups), binbashar/le-tf-infra-aws/management/us-east-1/base-tf-backend (Module path: management/us-east-1/base-tf-backend), binbashar/le-tf-infra-aws/management/us-east-1/firewall-manager (Module path: management/us-east-1/firewall-manager), binbashar/le-tf-infra-aws/management/us-east-1/notifications (Module path: management/us-east-1/notifications), binbashar/le-tf-infra-aws/management/us-east-1/security-audit (Module path: management/us-east-1/security-audit), binbashar/le-tf-infra-aws/management/us-east-1/security-base (Module path: management/us-east-1/security-base), binbashar/le-tf-infra-aws/management/us-east-1/security-compliance (Module path: management/us-east-1/security-compliance), binbashar/le-tf-infra-aws/management/us-east-1/security-keys (Module path: management/us-east-1/security-keys), binbashar/le-tf-infra-aws/management/us-east-1/security-monitoring (Module path: management/us-east-1/security-monitoring), binbashar/le-tf-infra-aws/management/us-east-2/security-monitoring -- (Module path: management/us-east-2/security-monitoring --), binbashar/le-tf-infra-aws/network/global/base-identities (Module path: network/global/base-identities), binbashar/le-tf-infra-aws/network/us-east-1/base-network (Module path: network/us-east-1/base-network), binbashar/le-tf-infra-aws/network/us-east-1/base-tf-backend (Module path: network/us-east-1/base-tf-backend), binbashar/le-tf-infra-aws/network/us-east-1/network-firewall (Module path: network/us-east-1/network-firewall), binbashar/le-tf-infra-aws/network/us-east-1/notifications (Module path: network/us-east-1/notifications), binbashar/le-tf-infra-aws/network/us-east-1/security-audit (Module path: network/us-east-1/security-audit), binbashar/le-tf-infra-aws/network/us-east-1/security-base (Module path: network/us-east-1/security-base), binbashar/le-tf-infra-aws/network/us-east-1/security-compliance -- (Module path: network/us-east-1/security-compliance --), binbashar/le-tf-infra-aws/network/us-east-1/security-keys (Module path: network/us-east-1/security-keys), binbashar/le-tf-infra-aws/network/us-east-1/transit-gateway (Module path: network/us-east-1/transit-gateway), binbashar/le-tf-infra-aws/network/us-east-2/base-network (Module path: network/us-east-2/base-network), binbashar/le-tf-infra-aws/network/us-east-2/network-firewall (Module path: network/us-east-2/network-firewall), binbashar/le-tf-infra-aws/network/us-east-2/security-compliance -- (Module path: network/us-east-2/security-compliance --), binbashar/le-tf-infra-aws/network/us-east-2/security-keys (Module path: network/us-east-2/security-keys), binbashar/le-tf-infra-aws/network/us-east-2/transit-gateway (Module path: network/us-east-2/transit-gateway), binbashar/le-tf-infra-aws/security/global/base-identities (Module path: security/global/base-identities), binbashar/le-tf-infra-aws/security/us-east-1/base-tf-backend (Module path: security/us-east-1/base-tf-backend), binbashar/le-tf-infra-aws/security/us-east-1/firewall-manager (Module path: security/us-east-1/firewall-manager), binbashar/le-tf-infra-aws/security/us-east-1/notifications (Module path: security/us-east-1/notifications), binbashar/le-tf-infra-aws/security/us-east-1/security-audit (Module path: security/us-east-1/security-audit), binbashar/le-tf-infra-aws/security/us-east-1/security-base (Module path: security/us-east-1/security-base), binbashar/le-tf-infra-aws/security/us-east-1/security-compliance -- (Module path: security/us-east-1/security-compliance --), binbashar/le-tf-infra-aws/security/us-east-1/security-keys (Module path: security/us-east-1/security-keys), binbashar/le-tf-infra-aws/security/us-east-1/security-monitoring (Module path: security/us-east-1/security-monitoring), binbashar/le-tf-infra-aws/security/us-east-2/security-audit (Module path: security/us-east-2/security-audit), binbashar/le-tf-infra-aws/security/us-east-2/security-compliance -- (Module path: security/us-east-2/security-compliance --), binbashar/le-tf-infra-aws/security/us-east-2/security-monitoring -- (Module path: security/us-east-2/security-monitoring --), binbashar/le-tf-infra-aws/shared/global/base-dns/binbash.com.ar (Module path: shared/global/base-dns/binbash.com.ar), binbashar/le-tf-infra-aws/shared/global/base-identities (Module path: shared/global/base-identities), binbashar/le-tf-infra-aws/shared/us-east-1/backups (Module path: shared/us-east-1/backups), binbashar/le-tf-infra-aws/shared/us-east-1/base-network (Module path: shared/us-east-1/base-network), binbashar/le-tf-infra-aws/shared/us-east-1/base-tf-backend (Module path: shared/us-east-1/base-tf-backend), binbashar/le-tf-infra-aws/shared/us-east-1/container-registry (Module path: shared/us-east-1/container-registry), binbashar/le-tf-infra-aws/shared/us-east-1/ec2-fleet -- (Module path: shared/us-east-1/ec2-fleet --), binbashar/le-tf-infra-aws/shared/us-east-1/ec2-fleet-bastions -- (Module path: shared/us-east-1/ec2-fleet-bastions --), binbashar/le-tf-infra-aws/shared/us-east-1/k8s-eks-demoapps/identities (Module path: shared/us-east-1/k8s-eks-demoapps/identities), binbashar/le-tf-infra-aws/shared/us-east-1/notifications (Module path: shared/us-east-1/notifications), binbashar/le-tf-infra-aws/shared/us-east-1/secrets-manager (Module path: shared/us-east-1/secrets-manager), binbashar/le-tf-infra-aws/shared/us-east-1/security-audit (Module path: shared/us-east-1/security-audit), binbashar/le-tf-infra-aws/shared/us-east-1/security-base (Module path: shared/us-east-1/security-base), binbashar/le-tf-infra-aws/shared/us-east-1/security-compliance -- (Module path: shared/us-east-1/security-compliance --), binbashar/le-tf-infra-aws/shared/us-east-1/security-keys (Module path: shared/us-east-1/security-keys), binbashar/le-tf-infra-aws/shared/us-east-1/storage/backup-gdrive -- (Module path: shared/us-east-1/storage/backup-gdrive --), binbashar/le-tf-infra-aws/shared/us-east-1/storage/object-file-shares-for-users-list -- (Module path: shared/us-east-1/storage/object-file-shares-for-users-list --), binbashar/le-tf-infra-aws/shared/us-east-1/storage/object-file-shares-sftp-transfer-service -- (Module path: shared/us-east-1/storage/object-file-shares-sftp-transfer-service --), binbashar/le-tf-infra-aws/shared/us-east-1/tools-cloud-scheduler-stop-start (Module path: shared/us-east-1/tools-cloud-scheduler-stop-start), binbashar/le-tf-infra-aws/shared/us-east-1/tools-eskibana -- (Module path: shared/us-east-1/tools-eskibana --), binbashar/le-tf-infra-aws/shared/us-east-1/tools-github-selfhosted-runners (Module path: shared/us-east-1/tools-github-selfhosted-runners), binbashar/le-tf-infra-aws/shared/us-east-1/tools-jenkins -- (Module path: shared/us-east-1/tools-jenkins --), binbashar/le-tf-infra-aws/shared/us-east-1/tools-managedeskibana -- (Module path: shared/us-east-1/tools-managedeskibana --), binbashar/le-tf-infra-aws/shared/us-east-1/tools-prometheus-grafana -- (Module path: shared/us-east-1/tools-prometheus-grafana --), binbashar/le-tf-infra-aws/shared/us-east-1/tools-vault -- (Module path: shared/us-east-1/tools-vault --), binbashar/le-tf-infra-aws/shared/us-east-1/tools-vpn-server (Module path: shared/us-east-1/tools-vpn-server), binbashar/le-tf-infra-aws/shared/us-east-1/tools-webhooks -- (Module path: shared/us-east-1/tools-webhooks --), binbashar/le-tf-infra-aws/shared/us-east-2/base-network (Module path: shared/us-east-2/base-network), binbashar/le-tf-infra-aws/shared/us-east-2/container-registry (Module path: shared/us-east-2/container-registry), binbashar/le-tf-infra-aws/shared/us-east-2/security-compliance -- (Module path: shared/us-east-2/security-compliance --), binbashar/le-tf-infra-aws/shared/us-east-2/security-keys (Module path: shared/us-east-2/security-keys), binbashar/le-tf-infra-aws/shared/us-east-2/tools-eskibana -- (Module path: shared/us-east-2/tools-eskibana --), binbashar/le-tf-infra-aws/shared/us-east-2/tools-prometheus-grafana -- (Module path: shared/us-east-2/tools-prometheus-grafana --)
Run the following command to see their breakdown: infracost breakdown --path=/path/to/code

──────────────────────────────────
577 cloud resources were detected:
∙ 577 were estimated, 436 of which include usage-based costs, see https://infracost.io/usage-file

This comment will be updated when the cost estimate changes.

_{Is this comment useful? Yes, No, Other}

[rodriguez-matias]

terraform commands

$ leverage --version

leverage, version 1.8.0

$ leverage terraform version

Terraform v1.2.7
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.47.0

[rodriguez-matias]

$ leverage terraform init

[09:12:56.536] INFO     Checking environment name definition in account.tfvars...
[09:12:56.546] INFO     ✔ OK
[09:12:56.551] INFO     Checking backend key...
[09:12:56.553] INFO     Found: 'shared/security-base/terraform.tfstate'
[09:12:56.556] INFO     ✔ OK
[09:12:56.560] INFO     Checking backend.tfvars:
[09:12:56.563] INFO     Checking if profile starts with bb-shared...
[09:12:56.565] INFO     ✔ OK
[09:12:56.567] INFO     Checking if bucket starts with bb-shared...
[09:12:56.569] INFO     ✔ OK
[09:12:56.571] INFO     Checking if dynamodb table starts with bb-shared...
[09:12:56.575] INFO     ✔ OK
[12:13:10]    INFO      Attempting to get temporary credentials for shared account.
[12:13:12]    INFO      Using already configured temporary credentials.
Initializing modules...
Downloading git::https://github.com/binbashar/terraform-aws-root-login-notifications.git?ref=v2.3.0 for root-login-notifications...
- root-login-notifications in .terraform/modules/root-login-notifications

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/aws versions matching ">= 3.0.0, ~> 4.10"...
- Installing hashicorp/aws v4.47.0...
- Installed hashicorp/aws v4.47.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

[rodriguez-matias]

$ leverage terraform plan

[12:16:01]    INFO      Attempting to get temporary credentials for shared account.
[12:16:03]    INFO      Using already configured temporary credentials.
Acquiring state lock. This may take a few moments...
aws_ebs_encryption_by_default.main: Refreshing state... [id=terraform-20200729153724335200000001]
aws_s3_account_public_access_block.main: Refreshing state... [id=763606934258]
module.root-login-notifications.data.aws_partition.current: Reading...
module.root-login-notifications.data.aws_sns_topic.main: Reading...
module.root-login-notifications.data.aws_caller_identity.current: Reading...
module.root-login-notifications.data.aws_partition.current: Read complete after 0s [id=aws]
module.root-login-notifications.aws_cloudwatch_event_rule.main_com[0]: Refreshing state... [id=iam-root-login]
module.root-login-notifications.data.aws_caller_identity.current: Read complete after 1s [id=763606934258]
module.root-login-notifications.data.aws_sns_topic.main: Read complete after 1s [id=arn:aws:sns:us-east-1:763606934258:sns-topic-slack-notify-monitoring-sec]
module.root-login-notifications.aws_cloudwatch_event_target.main[0]: Refreshing state... [id=iam-root-login-send-to-sns]
module.root-login-notifications.aws_cloudwatch_metric_alarm.alarm_cwe_triggered: Refreshing state... [id=iam-root-login-alarm-shared-account]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.
Releasing state lock. This may take a few moments...