diff --git a/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/locals.tf b/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/locals.tf index 7a4db9ce6..599df6ef3 100644 --- a/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/locals.tf +++ b/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/locals.tf @@ -55,4 +55,5 @@ locals { alb_ingress_to_nginx_ingress_tags_list = [ for k, v in local.alb_ingress_to_nginx_ingress_tags_map : "${k}=${v}" ] + eks_alb_logging_prefix = var.eks_alb_logging_prefix != "" ? var.eks_alb_logging_prefix : data.terraform_remote_state.cluster.outputs.cluster_name } diff --git a/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/networking-ingress.tf b/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/networking-ingress.tf index d36ba9492..cb9f1e394 100644 --- a/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/networking-ingress.tf +++ b/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/networking-ingress.tf @@ -82,6 +82,8 @@ resource "kubernetes_ingress_v1" "apps" { # Filter traffic by IP addresses # NOTE: this is highly recommended when using an internet-facing ALB "alb.ingress.kubernetes.io/inbound-cidrs" = "0.0.0.0/0" + # ALB access logs + "alb.ingress.kubernetes.io/load-balancer-attributes" = "access_logs.s3.enabled=${var.enable_eks_alb_logging},access_logs.s3.bucket=${var.project}-${var.environment}-alb-logs,access_logs.s3.prefix=${local.eks_alb_logging_prefix}" } } diff --git a/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/variables.tf b/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/variables.tf index 4776c66f5..2c295d2aa 100644 --- a/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/variables.tf +++ b/apps-devstg/us-east-1/k8s-eks-demoapps/k8s-components/variables.tf @@ -121,6 +121,18 @@ variable "enable_backups" { default = false } +variable "enable_eks_alb_logging" { + description = "Turn EKS ALB logging on" + type = bool + default = false +} + +variable "eks_alb_logging_prefix" { + description = "Turn EKS ALB logging on" + type = string + default = "" +} + #==================================# # Ingress Monitor Controller (IMC) # #==================================# diff --git a/apps-devstg/us-east-1/k8s-eks/cluster/config.tf b/apps-devstg/us-east-1/k8s-eks/cluster/config.tf index 43331131a..ca05f7e9b 100644 --- a/apps-devstg/us-east-1/k8s-eks/cluster/config.tf +++ b/apps-devstg/us-east-1/k8s-eks/cluster/config.tf @@ -16,7 +16,7 @@ provider "kubernetes" { # Backend Config (partial) # terraform { - required_version = "~> 1.1.3" + required_version = "~> 1.2" required_providers { aws = "~> 4.10" diff --git a/apps-devstg/us-east-1/k8s-eks/identities/ids_external_secrets.tf b/apps-devstg/us-east-1/k8s-eks/identities/ids_external_secrets.tf index da60d9f48..43e752568 100644 --- a/apps-devstg/us-east-1/k8s-eks/identities/ids_external_secrets.tf +++ b/apps-devstg/us-east-1/k8s-eks/identities/ids_external_secrets.tf @@ -51,7 +51,7 @@ resource "aws_iam_policy" "external_secrets_secrets_manager" { "kms:DescribeKey" ], "Resource": [ - "${data.terraform_remote_state.shared.outputs.aws_kms_key_arn}" + "${data.terraform_remote_state.shared-keys.outputs.aws_kms_key_arn}" ] } ] @@ -85,7 +85,7 @@ resource "aws_iam_policy" "external_secrets_parameter_store" { "kms:DescribeKey" ], "Resource": [ - "${data.terraform_remote_state.shared.outputs.aws_kms_key_arn}" + "${data.terraform_remote_state.shared-keys.outputs.aws_kms_key_arn}" ] } ] diff --git a/apps-devstg/us-east-1/k8s-eks/k8s-components/locals.tf b/apps-devstg/us-east-1/k8s-eks/k8s-components/locals.tf index 57f37e230..c79330aaa 100644 --- a/apps-devstg/us-east-1/k8s-eks/k8s-components/locals.tf +++ b/apps-devstg/us-east-1/k8s-eks/k8s-components/locals.tf @@ -45,4 +45,5 @@ locals { alb_ingress_to_nginx_ingress_tags_list = [ for k, v in local.alb_ingress_to_nginx_ingress_tags_map : "${k}=${v}" ] + eks_alb_logging_prefix = var.eks_alb_logging_prefix != "" ? var.eks_alb_logging_prefix : data.terraform_remote_state.eks-cluster.outputs.cluster_name } diff --git a/apps-devstg/us-east-1/k8s-eks/k8s-components/networking-ingress.tf b/apps-devstg/us-east-1/k8s-eks/k8s-components/networking-ingress.tf index 514b4f974..60a4101eb 100644 --- a/apps-devstg/us-east-1/k8s-eks/k8s-components/networking-ingress.tf +++ b/apps-devstg/us-east-1/k8s-eks/k8s-components/networking-ingress.tf @@ -82,6 +82,8 @@ resource "kubernetes_ingress_v1" "apps" { # Filter traffic by IP addresses # NOTE: this is highly recommended when using an internet-facing ALB "alb.ingress.kubernetes.io/inbound-cidrs" = "0.0.0.0/0" + # ALB access logs + "alb.ingress.kubernetes.io/load-balancer-attributes" = "access_logs.s3.enabled=${var.enable_eks_alb_logging},access_logs.s3.bucket=${var.project}-${var.environment}-alb-logs,access_logs.s3.prefix=${local.eks_alb_logging_prefix}" } } diff --git a/apps-devstg/us-east-1/k8s-eks/k8s-components/variables.tf b/apps-devstg/us-east-1/k8s-eks/k8s-components/variables.tf index 532d7c181..60554939f 100644 --- a/apps-devstg/us-east-1/k8s-eks/k8s-components/variables.tf +++ b/apps-devstg/us-east-1/k8s-eks/k8s-components/variables.tf @@ -111,6 +111,18 @@ variable "enable_backups" { default = false } +variable "enable_eks_alb_logging" { + description = "Turn EKS ALB logging on" + type = bool + default = false +} + +variable "eks_alb_logging_prefix" { + description = "Turn EKS ALB logging on" + type = string + default = "" +} + #==================================# # Ingress Monitor Controller (IMC) # #==================================# diff --git a/apps-devstg/us-east-1/security-audit/logs.tf b/apps-devstg/us-east-1/security-audit/logs.tf new file mode 100644 index 000000000..ecc92feb0 --- /dev/null +++ b/apps-devstg/us-east-1/security-audit/logs.tf @@ -0,0 +1,23 @@ +module "s3_bucket_alb_logs" { + source = "github.com/binbashar/terraform-aws-s3-bucket.git?ref=v3.7.0" + count = var.create_alb_logs_bucket ? 1 : 0 + + bucket = "${var.project}-${var.environment}-alb-logs" + acl = "log-delivery-write" + + versioning = { + enabled = true + } + + # Allow deletion of non-empty bucket + force_destroy = true + + attach_elb_log_delivery_policy = true # Required for ALB logs + attach_lb_log_delivery_policy = true # Required for ALB/NLB logs + + # S3 bucket-level Public Access Block configuration + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true +} diff --git a/apps-devstg/us-east-1/security-audit/variables.tf b/apps-devstg/us-east-1/security-audit/variables.tf index 18780deea..bbf09bd06 100644 --- a/apps-devstg/us-east-1/security-audit/variables.tf +++ b/apps-devstg/us-east-1/security-audit/variables.tf @@ -18,3 +18,8 @@ variable "metrics" { description = "Metrics definitions" default = {} } + +variable "create_alb_logs_bucket" { + type = bool + default = false +} diff --git a/apps-devstg/us-east-1/security-certs/outputs.tf b/apps-devstg/us-east-1/security-certs/outputs.tf index 10533969f..802f203e9 100644 --- a/apps-devstg/us-east-1/security-certs/outputs.tf +++ b/apps-devstg/us-east-1/security-certs/outputs.tf @@ -4,4 +4,4 @@ output "certificate_arn" { description = "The certificate ARN" value = aws_acm_certificate.main.arn -} \ No newline at end of file +}