Aws Flow module #10

shireesh-illumio · 2024-10-04T21:17:28Z

fixed issue in aws_account example
changed aws_account external id generator to random_password to not show it in the plan/apply/destroy making it sensitive
example for aws flow usage.

version bump 1.2.0

- fixed issue in aws_account example - changed aws_account external id generator to random_password to not show it in the plan/apply/destroy making it sensitive - example for aws flow usage. version bump 1.2.0

rlenglet

All those comments are addressed in the PR I have been working on: #11

rlenglet · 2024-10-04T22:04:14Z

modules/aws_flows/main.tf

+
+resource "aws_iam_role_policy" "IllumioCloudBucketListPolicy" {
+  count = length(local.flow_logs_bucket_list) > 0 ? 1 : 0
+  name  = "IllumioCloudBucketListPolicy"


Don't hardcode names. Follow the same pattern as for aws_account.

rlenglet · 2024-10-04T22:04:58Z

modules/aws_flows/main.tf

+data "aws_iam_role" "illumio_cloud_integration_role" {
+  name = var.role_arn
+}


Just modify aws_acocunt to output the role ID instead of the ARN.

rlenglet · 2024-10-04T22:05:05Z

modules/aws_flows/main.tf

+
+resource "aws_iam_role_policy" "IllumioCloudBucketReadPolicy" {
+  count = length(local.flow_logs_bucket_read) > 0 ? 1 : 0
+  name  = "IllumioCloudBucketReadPolicy"


Don't hardcode names. Follow the same pattern as for aws_account.

rlenglet · 2024-10-04T22:05:42Z

modules/aws_flows/main.tf

+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }


Remove. Not needed.

Suggested change

random = {

source = "hashicorp/random"

version = "~> 3.0"

}

rlenglet · 2024-10-04T22:07:57Z

modules/aws_flows/main.tf

Keep the names consistent with the Terraform provider's resources.
Rename this module into aws_flow_logs_s3_buckets.

rlenglet · 2024-10-04T22:18:47Z

modules/aws_flows/main.tf

+terraform {
+  required_providers {
+    illumio-cloudsecure = {
+      source  = "illumio/illumio-cloudsecure"
+      version = "~> 1.0.11"
+    }
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 3.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+  }
+}


Move this into a separate versions.tf file to follow the standard conventions.

rlenglet · 2024-10-04T22:19:09Z

modules/aws_flows/main.tf

+
+  # Use the full ARN with path for GetObject actions
+  flow_logs_bucket_read = [
+    for bucket_arn in var.flow_logs_bucket_arns : "${bucket_arn}/*"


Also replace //* with /* as in the original CloudFormation Template.

rlenglet · 2024-10-04T22:19:40Z

modules/aws_flows/main.tf

+  role  = data.aws_iam_role.illumio_cloud_integration_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Sid    = "IllumioBucketListAccess"
+      Action = [
+        "s3:ListBucket",
+        "s3:ListBucketVersion",
+        "s3:GetBucketLocation"
+      ]
+      Resource = local.flow_logs_bucket_list
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "IllumioCloudBucketReadPolicy" {
+  count = length(local.flow_logs_bucket_read) > 0 ? 1 : 0
+  name  = "IllumioCloudBucketReadPolicy"
+  role  = data.aws_iam_role.illumio_cloud_integration_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Sid    = "IllumioBucketReadAccess"
+      Action = ["s3:GetObject"]
+      Resource = local.flow_logs_bucket_read
+    }]
+  })
+}


Just define one policy with two statements.

rlenglet · 2024-10-04T22:20:41Z

modules/aws_flows/variables.tf

@@ -0,0 +1,17 @@
+variable "flow_logs_bucket_arns" {


Keep the naming of variables with the naming of attributes of the provider resource:
https://github.com/illumio/terraform-provider-illumio-cloudsecure/blob/010d3d1dc7ac76005ab893aa6d4064968f4ae533/api/schema/aws_flow_logs_s3_bucket.go#L32

Suggested change

variable "flow_logs_bucket_arns" {

variable "s3_bucket_arns" {

rlenglet · 2024-10-04T22:22:25Z

modules/aws_flows/main.tf

+}
+
+resource "aws_iam_role_policy" "IllumioCloudBucketReadPolicy" {
+  count = length(local.flow_logs_bucket_read) > 0 ? 1 : 0


Remove. The flow_logs_bucket_arns variable is validated to never be empty.

Suggested change

count = length(local.flow_logs_bucket_read) > 0 ? 1 : 0

rlenglet · 2024-10-04T22:22:30Z

modules/aws_flows/main.tf

+}
+
+resource "aws_iam_role_policy" "IllumioCloudBucketListPolicy" {
+  count = length(local.flow_logs_bucket_list) > 0 ? 1 : 0


Remove. The flow_logs_bucket_arns variable is validated to never be empty.

Suggested change

count = length(local.flow_logs_bucket_list) > 0 ? 1 : 0

rlenglet · 2024-10-04T22:24:01Z

examples/aws_flows/main.tf

+
+module "aws_flows_dev" {
+  source        = "github.com/illumio/terraform-illumio-cloudsecure//modules/aws_flows?ref=v1.2.0"
+  role_arn      = var.illumio_cloudsecure_role_arn


Modify this example to add an aws_account to show how those should be used together, instead of taking the role ARN as a variable.

rlenglet · 2024-10-04T22:24:42Z

examples/aws_flows/variables.tf

+variable "flow_logs_bucket_arns" {
+  type        = list(string)
+  description = "List of S3 buckets having flow logs"
+  validation {
+    condition     = length(var.flow_logs_bucket_arns) > 0
+    error_message = "The flow_logs_bucket_arns value must not be empty."
+  }
+}
+


Remove this. Give a concrete list of literal ARNs in the example to illustrate how to use the module.

Suggested change

variable "flow_logs_bucket_arns" {

type = list(string)

description = "List of S3 buckets having flow logs"

validation {

condition = length(var.flow_logs_bucket_arns) > 0

error_message = "The flow_logs_bucket_arns value must not be empty."

}

}

You can see how we removed all variables other than client_id and client_secret from the other examples.

rlenglet · 2024-10-04T22:25:44Z

examples/aws_flows/variables.tf

+variable "illumio_cloudsecure_role_arn" {
+  type        = string
+  description = "The ARN of the IAM role granted to the CloudSecure account."
+  validation {
+    condition     = length(var.illumio_cloudsecure_role_arn) > 1
+    error_message = "The illumio_cloudsecure_role_arn value must not be empty."
+  }
+}
+


Remove this. Add an aws_account into the example to illustrate how those two modules should be used together.

Suggested change

variable "illumio_cloudsecure_role_arn" {

type = string

description = "The ARN of the IAM role granted to the CloudSecure account."

validation {

condition = length(var.illumio_cloudsecure_role_arn) > 1

error_message = "The illumio_cloudsecure_role_arn value must not be empty."

}

}

You can see how we removed all variables other than client_id and client_secret from the other examples.

shireesh-illumio · 2024-10-04T23:45:49Z

closing as covered in #11

shireesh-illumio and others added 3 commits October 4, 2024 14:16

- added aws flows module init

df30680

- fixed issue in aws_account example - changed aws_account external id generator to random_password to not show it in the plan/apply/destroy making it sensitive - example for aws flow usage. version bump 1.2.0

terraform-docs: automated action

dff2f62

terraform-docs: automated action

f36253a

shireesh-illumio changed the title ~~- added aws flows module init~~ Aws Flow module Oct 4, 2024

fix

c01c55e

shireesh-illumio requested a review from rlenglet October 4, 2024 21:23

shireesh-illumio and others added 2 commits October 4, 2024 15:12

- adding role_name as output

b6d985b

terraform-docs: automated action

f1bb7eb

rlenglet requested changes Oct 4, 2024

View reviewed changes

rlenglet reviewed Oct 4, 2024

View reviewed changes

shireesh-illumio mentioned this pull request Oct 4, 2024

Add aws_flow_logs_s3_buckets module #11

Merged

shireesh-illumio closed this Oct 4, 2024

shireesh-illumio deleted the aws_flows_module branch October 4, 2024 23:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Aws Flow module #10

Aws Flow module #10

shireesh-illumio commented Oct 4, 2024

rlenglet left a comment

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024

rlenglet Oct 4, 2024 •

edited

Loading

rlenglet Oct 4, 2024

shireesh-illumio commented Oct 4, 2024

	variable "flow_logs_bucket_arns" {
	variable "s3_bucket_arns" {

Aws Flow module #10

Aws Flow module #10

Conversation

shireesh-illumio commented Oct 4, 2024

rlenglet left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rlenglet Oct 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shireesh-illumio commented Oct 4, 2024

rlenglet Oct 4, 2024 •

edited

Loading