Update the security header Lambda's runtime to Node 18

[jsf9k]

🗣 Description

This pull request updates the security header Lambda's runtime from Node 16 to Node 18.

💭 Motivation and context

We recently received an email from AWS Lambda stating that they are dropping support for Node 16 in mid-2024. Now that we are using version 4.9 of the Terraform AWS provider, we can upgrade our Lambda runtime to Node 18. When we move to the latest version of the Terraform AWS provider, we will be able to upgrade the runtime to at least Node 20.

🧪 Testing

I tested this in the most brütal fashion - by deploying it to production.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

[jsf9k]

@dav3r - I have a strong memory of you creating something that needed this sort of Lambda@Edge sauce too, but I couldn't find it. If you have such Terraform out there, and it's running Node 16, then you should upgrade it similarly.

[jsf9k]

@cisagov/team-ois - Aargh! This change has broken the rules website. If anyone knows why that is so, please let me know. I think the problem is that the Cloudfront distribution is unable to read the objects in the rules bucket, but I don't know why that would be the case. 😭

[dv4harr10]

Hi Team, I am noticing the following issues, please ensure that these are resolved:

1. AWS CloudWatch Log Group is missing retention which can cause losing important event info: @ terraform/bod_vpc_flow_logs.tf line 43, terraform/cyhy_vpc_flow_logs.tf line 43, terraform/mgmt_vpc_flow_logs.tf line 43, and terraform/nvdsync_failure_alarms.tf line 2.
2. AWS Lambda tracing is not enabled: @ terraform/adi_lambda.tf line 113, terraform/bod_lambdas.tf line 58, and terraform/fdi_lambda.tf line 114.
3. Ensure that your AWS Cloudfront distributions have the logging feature enabled: @ terraform_egress_pub/cloudfront.tf.
4. AWS Lambda does not use KMS CMK key to protect environment variables: @ terraform/adi_lambda.tf line 129 and terraform/fdi_lambda.tf line 130.

Thanks

[jsf9k]

Hi Team, I am noticing the following issues, please ensure that these are resolved:

1. AWS CloudWatch Log Group is missing retention which can cause losing important event info: @ terraform/bod_vpc_flow_logs.tf line 43, terraform/cyhy_vpc_flow_logs.tf line 43, terraform/mgmt_vpc_flow_logs.tf line 43, and terraform/nvdsync_failure_alarms.tf line 2.
2. AWS Lambda tracing is not enabled: @ terraform/adi_lambda.tf line 113, terraform/bod_lambdas.tf line 58, and terraform/fdi_lambda.tf line 114.
3. Ensure that your AWS Cloudfront distributions have the logging feature enabled: @ terraform_egress_pub/cloudfront.tf.
4. AWS Lambda does not use KMS CMK key to protect environment variables: @ terraform/adi_lambda.tf line 129 and terraform/fdi_lambda.tf line 130.

Thanks

@dv4harr10 - None of these points has anything to do with the changes in this PR, but we still want to capture them. Can you create an issue in this repo for each of these four points?

[dav3r]

@dav3r - I have a strong memory of you creating something that needed this sort of Lambda@Edge sauce too, but I couldn't find it. If you have such Terraform out there, and it's running Node 16, then you should upgrade it similarly.

I think you are probably talking about cisagov/publish-egress-ip-terraform#6, which stalled out due to lack of interest from the intended beneficiaries, hence it was never merged and deployed to Production.

[dav3r]

@cisagov/team-ois - Aargh! This change has broken the rules website. If anyone knows why that is so, please let me know. I think the problem is that the Cloudfront distribution is unable to read the objects in the rules bucket, but I don't know why that would be the case. 😭

@mcdonnnj created #742 to address the issues you encountered.

[dav3r]

👍 ⚙️ 🚀