-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* added and tested managed node group Signed-off-by: jase koonce <[email protected]> * rebasing Signed-off-by: jase koonce <[email protected]> * pre-commit Signed-off-by: jase koonce <[email protected]> * bastion logging wip Signed-off-by: jase koonce <[email protected]> * adding eventbridge rules to aggregate logs Signed-off-by: jase koonce <[email protected]> * tested/adjusted formating Signed-off-by: jase koonce <[email protected]> * rebase Signed-off-by: jase koonce <[email protected]> * WIP Signed-off-by: jase koonce <[email protected]> * adds username logging/one concurrent session Signed-off-by: jase koonce <[email protected]> * cleanup/precommit Signed-off-by: jase koonce <[email protected]> * add parameters to example modules and update readmes (#84) * make optional * update readme * update env vars * unable to iterate over tuple if it doesn't exist * default null * parameterize instance type * refactor * add * parameterize instance type * parameterize instance type * update readme * parameterize * add parameters to example * add backend.tf.example * update lockfile thing * add backend.tf.example * DRYify admin username parameters * update variables * DRYify input vars * add -foce-copy * Remove variable, do not need defaults at the moment * added cluster_name * update readmes * updating self-managed/managed readmes Signed-off-by: jase koonce <[email protected]> * fix some pah and var logic * update readme * ignore build dir * update readme * Empty commit * testing sign * testing sign again * testing sign again again * update readme * update env vars * unable to iterate over tuple if it doesn't exist * default null * parameterize instance type * refactor * add * parameterize instance type * parameterize instance type * update readme * Move the tfstate-backend module to its own repo (#77) * Update README.md (#78) * Use new remote tfstate-backend module (and delete the one in this repo) (#80) * eks output fix (#83) * parameterize * add parameters to example * add backend.tf.example * update lockfile thing * add backend.tf.example * DRYify admin username parameters * update variables * DRYify input vars * add -foce-copy * Remove variable, do not need defaults at the moment * added cluster_name * update readmes * fix some pah and var logic * update readme * update readme * updating self-managed/managed readmes Signed-off-by: jase koonce <[email protected]> * Empty commit * testing sign * testing sign again * testing sign again again --------- Signed-off-by: jase koonce <[email protected]> Co-authored-by: jase koonce <[email protected]> Co-authored-by: Andy Roth <[email protected]> Co-authored-by: Gabe <[email protected]> * Update CODEOWNERS to use groups (#87) * Add GitHub Actions workflows for enabling test automation (#86) * change kc db output from endpoint to address (#92) * added and tested managed node group Signed-off-by: jase koonce <[email protected]> * rebase Signed-off-by: jase koonce <[email protected]> * Fixing cloudwatch error Signed-off-by: jase koonce <[email protected]> * adjusting userdata to log out newest session Signed-off-by: jase koonce <[email protected]> * Fixing failed checks Signed-off-by: jase koonce <[email protected]> * bastion refactor Signed-off-by: jase koonce <[email protected]> * adding newline for checks Signed-off-by: jase koonce <[email protected]> * add checkov comments/adjust startup script behavior Signed-off-by: jase koonce <[email protected]> * formating adjustment Signed-off-by: jase koonce <[email protected]> --------- Signed-off-by: jase koonce <[email protected]> Co-authored-by: Gabe <[email protected]> Co-authored-by: brian.rexrode <[email protected]> Co-authored-by: Zack A <[email protected]> Co-authored-by: Andy Roth <[email protected]> Co-authored-by: brianrexrode <[email protected]>
- Loading branch information
6 people
authored
Mar 9, 2023
1 parent
2df059f
commit 667ba9c
Showing
7 changed files
with
593 additions
and
52 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,171 @@ | ||
| # Create a log group for ssh accesss | ||
| resource "aws_cloudwatch_log_group" "ssh-access-log-group" { | ||
| name = "/aws/events/ssh-access" | ||
| retention_in_days = 60 | ||
| kms_key_id = aws_kms_key.ssmkey.arn | ||
| } | ||
|
|
||
| # Create a cloudtrail and event rule to monitor bastion access over ssh | ||
| resource "aws_cloudtrail" "ssh-access" { | ||
| # checkov:skip=CKV_AWS_252: SNS not currently needed | ||
| # checkov:skip=CKV2_AWS_10: Cloudwatch logs already being used with cloudtrail | ||
| name = "ssh-access" | ||
| s3_bucket_name = var.access_log_bucket_name | ||
| kms_key_id = aws_kms_key.ssmkey.arn | ||
| is_multi_region_trail = true | ||
| enable_log_file_validation = true | ||
| event_selector { | ||
| read_write_type = "All" | ||
| include_management_events = true | ||
| } | ||
| depends_on = [ | ||
| aws_s3_bucket_policy.cloudwatch-s3-policy, | ||
| aws_kms_key.ssmkey, | ||
| aws_cloudwatch_log_group.ssh-access-log-group | ||
| ] | ||
| } | ||
|
|
||
| resource "aws_cloudwatch_event_rule" "ssh-access" { | ||
| name = "ssh-access" | ||
| description = "filters ssm access logs and sends usable data to a cloudwatch log group" | ||
|
|
||
| event_pattern = <<EOF | ||
| { | ||
| "source": ["aws.ssm"], | ||
| "detail-type": ["AWS API Call via CloudTrail"], | ||
| "detail": { | ||
| "eventSource": ["ssm.amazonaws.com"], | ||
| "eventName": ["IAMUser","StartSession"] | ||
| } | ||
| } | ||
| EOF | ||
| } | ||
|
|
||
| resource "aws_cloudwatch_event_target" "ssm-target" { | ||
| rule = aws_cloudwatch_event_rule.ssh-access.name | ||
| target_id = "ssh-access-target" | ||
| arn = aws_cloudwatch_log_group.ssh-access-log-group.arn | ||
| } | ||
|
|
||
| # Create a cloudwatch agent configuration file and log group | ||
| resource "aws_ssm_parameter" "cloudwatch_configuration_file" { | ||
| name = "AmazonCloudWatch-linux-${var.name}" | ||
| type = "SecureString" | ||
| overwrite = true | ||
| value = jsonencode({ | ||
| "agent" : { | ||
| "metrics_collection_interval" : 60, | ||
| "run_as_user" : "root" | ||
| }, | ||
| "logs" : { | ||
| "logs_collected" : { | ||
| "files" : { | ||
| "collect_list" : [ | ||
| { | ||
| "file_path" : "/root/.bash_history", | ||
| "log_group_name" : "ec2-cloudwatch-logging-${var.name}", | ||
| "log_stream_name" : "root-user-commands", | ||
| "retention_in_days" : 60 | ||
| }, | ||
| { | ||
| "file_path" : "/home/ec2-user/.bash_history", | ||
| "log_group_name" : "ec2-cloudwatch-logging-${var.name}", | ||
| "log_stream_name" : "ec2-user-commands", | ||
| "retention_in_days" : 60 | ||
| }, | ||
|
|
||
| { | ||
| "file_path" : "/var/log/secure", | ||
| "log_group_name" : "ec2-cloudwatch-logging-${var.name}", | ||
| "log_stream_name" : "logins", | ||
| "retention_in_days" : 60 | ||
| }, | ||
| { | ||
| "file_path" : "/home/ssm-user/.bash_history", | ||
| "log_group_name" : "ec2-cloudwatch-logging-${var.name}", | ||
| "log_stream_name" : "ssm-user-commands", | ||
| "retention_in_days" : 60 | ||
| }, | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
| "metrics" : { | ||
| "aggregation_dimensions" : [ | ||
| [ | ||
| "InstanceId" | ||
| ] | ||
| ], | ||
|
|
||
| "metrics_collected" : { | ||
| "collectd" : { | ||
| "metrics_aggregation_interval" : 60 | ||
| }, | ||
| "cpu" : { | ||
| "measurement" : [ | ||
| "cpu_usage_idle", | ||
| "cpu_usage_iowait", | ||
| "cpu_usage_user", | ||
| "cpu_usage_system" | ||
| ], | ||
| "metrics_collection_interval" : 60, | ||
| "resources" : [ | ||
| "*" | ||
| ], | ||
| "totalcpu" : false | ||
| }, | ||
| "disk" : { | ||
| "measurement" : [ | ||
| "used_percent", | ||
| "inodes_free" | ||
| ], | ||
| "metrics_collection_interval" : 60, | ||
| "resources" : [ | ||
| "*" | ||
| ] | ||
| }, | ||
| "diskio" : { | ||
| "measurement" : [ | ||
| "io_time" | ||
| ], | ||
| "metrics_collection_interval" : 60, | ||
| "resources" : [ | ||
| "*" | ||
| ] | ||
| }, | ||
| "mem" : { | ||
| "measurement" : [ | ||
| "mem_used_percent" | ||
| ], | ||
| "metrics_collection_interval" : 60 | ||
| }, | ||
| "statsd" : { | ||
| "metrics_aggregation_interval" : 60, | ||
| "metrics_collection_interval" : 10, | ||
| "service_address" : ":8125" | ||
| }, | ||
| "swap" : { | ||
| "measurement" : [ | ||
| "swap_used_percent" | ||
| ], | ||
| "metrics_collection_interval" : 60 | ||
| } | ||
| } | ||
| } | ||
| }) | ||
| } | ||
|
|
||
| resource "aws_cloudwatch_log_group" "ec2_cloudwatch_logs" { | ||
| name = "ec2-cloudwatch-logging-${var.name}" | ||
| retention_in_days = 60 | ||
| kms_key_id = aws_kms_key.ssmkey.arn | ||
| } | ||
|
|
||
| # Create cloudwatch log group for ssm | ||
| resource "aws_cloudwatch_log_group" "session_manager_log_group" { | ||
| name_prefix = "${var.cloudwatch_log_group_name}-" | ||
| retention_in_days = var.cloudwatch_logs_retention | ||
| kms_key_id = aws_kms_key.ssmkey.arn | ||
|
|
||
| tags = var.tags | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.