Skip to content

Commit f27eadd

Browse files
rodrigobersarodrigobersa
committed
Initial setup
1 parent c8734d6 commit f27eadd

9 files changed

+155
-179
lines changed

‎.tfsec/launch_configuration_imdsv2_tfchecks.json‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎.tfsec/launch_template_imdsv2_tfchecks.json‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎.tfsec/no_launch_config_tfchecks.json‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎.tfsec/sg_no_embedded_egress_rules_tfchecks.json‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎.tfsec/sg_no_embedded_ingress_rules_tfchecks.json‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎README.md‎

Lines changed: 39 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
<!-- BEGIN_TF_DOCS -->
21
# Creating modules for AWS I&A Organization
32

43
This repo template is used to seed Terraform Module templates for the [AWS I&A GitHub organization](https://github.com/aws-ia). Usage of this template is allowed per included license. PRs to this template will be considered but are not guaranteed to be included. Consider creating an issue to discuss a feature you want to include before taking the time to create a PR.
@@ -63,31 +62,51 @@ For best practices and information on developing with Terraform, see the [I&A Mo
6362

6463
The I&A team uses AWS CodeBuild to perform continuous integration (CI) within the organization. Our CI uses the a repo's `.pre-commit-config.yaml` file as well as some other checks. All PRs with other CI will be rejected. See our [FAQ](https://aws-ia.github.io/standards-terraform/faq/#are-modules-protected-by-ci-automation) for more details.
6564

66-
## Requirements
65+
### Requirements
6766

6867
| Name | Version |
6968
|------|---------|
70-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.7 |
71-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0.0, < 5.0.0 |
72-
| <a name="requirement_awscc"></a> [awscc](#requirement\_awscc) | >= 0.24.0 |
69+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
70+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.47 |
71+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.4 |
7372

74-
## Providers
73+
### Providers
7574

76-
No providers.
75+
| Name | Version |
76+
|------|---------|
77+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.47 |
7778

78-
## Modules
79+
### Modules
7980

8081
No modules.
8182

82-
## Resources
83-
84-
No resources.
85-
86-
## Inputs
87-
88-
No inputs.
89-
90-
## Outputs
91-
92-
No outputs.
93-
<!-- END_TF_DOCS -->
83+
### Resources
84+
85+
| Name | Type |
86+
|------|------|
87+
| [aws_route53_health_check.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_health_check) | resource |
88+
| [aws_shield_protection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/shield_protection) | resource |
89+
| [aws_shield_protection_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/shield_protection_group) | resource |
90+
| [aws_shield_protection_health_check_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/shield_protection_health_check_association) | resource |
91+
92+
### Inputs
93+
94+
| Name | Description | Type | Default | Required |
95+
|------|-------------|------|---------|:--------:|
96+
| <a name="input_aggregation"></a> [aggregation](#input\_aggregation) | Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events. | `string` | n/a | yes |
97+
| <a name="input_name"></a> [name](#input\_name) | A friendly name for the Protection you are creating. | `string` | n/a | yes |
98+
| <a name="input_pattern"></a> [pattern](#input\_pattern) | The criteria to use to choose the protected resources for inclusion in the group. | `string` | n/a | yes |
99+
| <a name="input_protection_group_id"></a> [protection\_group\_id](#input\_protection\_group\_id) | The name of the protection group. | `string` | n/a | yes |
100+
| <a name="input_resource_arn"></a> [resource\_arn](#input\_resource\_arn) | The ARN (Amazon Resource Name) of the resource to be protected. | `string` | n/a | yes |
101+
| <a name="input_health_check_configuration"></a> [health\_check\_configuration](#input\_health\_check\_configuration) | Amazon Route53 Health Check Configuration to be associated to AWS Shield Advanced Protection. | `map(any)` | `null` | no |
102+
| <a name="input_resource_type"></a> [resource\_type](#input\_resource\_type) | The resource type to include in the protection group. This is required if `pattern` is set to BY\_RESOURCE\_TYPE. Otherwise this must be not set. Defaults to `null` | `string` | `null` | no |
103+
| <a name="input_tags"></a> [tags](#input\_tags) | Key-value map of resource tags. Defaults to `{}` | `map(string)` | `{}` | no |
104+
105+
### Outputs
106+
107+
| Name | Description |
108+
|------|-------------|
109+
| <a name="output_route53_health_check"></a> [route53\_health\_check](#output\_route53\_health\_check) | Amazon Route53 Health Check Configuration. |
110+
| <a name="output_shied_protection"></a> [shied\_protection](#output\_shied\_protection) | AWS Shield Advanced Protection and assigned resources. |
111+
| <a name="output_shied_protection_group"></a> [shied\_protection\_group](#output\_shied\_protection\_group) | Group of protected resources to be collectivelly handled by AWS Shield Advanced. |
112+
| <a name="output_shield_protection_health_check_association"></a> [shield\_protection\_health\_check\_association](#output\_shield\_protection\_health\_check\_association) | Association between an Amazon Route53 Health Check and an AWS Shield Advanced protected resource. |

‎main.tf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
locals {
2+
tags = {
3+
Repository = "https://github.com/aws-ia/terraform-aws-shield-advanced"
4+
}
5+
}
6+
7+
##################################################
8+
# Shield Advanced Protection
9+
##################################################
10+
resource "aws_shield_protection" "this" {
11+
name = var.name
12+
resource_arn = var.resource_arn
13+
tags = merge(
14+
local.tags,
15+
var.tags
16+
)
17+
}
18+
19+
resource "aws_shield_protection_group" "this" {
20+
protection_group_id = var.protection_group_id
21+
aggregation = var.aggregation
22+
pattern = var.pattern
23+
members = [var.resource_arn]
24+
resource_type = var.resource_type
25+
tags = merge(
26+
local.tags,
27+
var.tags
28+
)
29+
30+
depends_on = [aws_shield_protection.this]
31+
}
32+
33+
##################################################
34+
# Health Check
35+
##################################################
36+
resource "aws_route53_health_check" "this" {
37+
for_each = var.health_check_configuration
38+
ip_address = each.value.resource_ip
39+
port = each.value.health_check_port
40+
type = each.value.health_check_type
41+
resource_path = each.value.health_check_path
42+
failure_threshold = each.value.health_check_threshold
43+
request_interval = each.value.health_check_interval
44+
45+
tags = merge(
46+
local.tags,
47+
var.tags
48+
)
49+
}
50+
51+
resource "aws_shield_protection_health_check_association" "this" {
52+
for_each = aws_route53_health_check.this
53+
health_check_arn = aws_route53_health_check.this[each.key].arn
54+
shield_protection_id = aws_shield_protection.this.id
55+
}

‎outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "shied_protection" {
2+
description = "AWS Shield Advanced Protection and assigned resources."
3+
value = aws_shield_protection.this
4+
}
5+
6+
output "shied_protection_group" {
7+
description = "Group of protected resources to be collectivelly handled by AWS Shield Advanced."
8+
value = aws_shield_protection_group.this
9+
}
10+
11+
output "route53_health_check" {
12+
description = "Amazon Route53 Health Check Configuration."
13+
value = aws_route53_health_check.this
14+
}
15+
16+
output "shield_protection_health_check_association" {
17+
description = "Association between an Amazon Route53 Health Check and an AWS Shield Advanced protected resource."
18+
value = aws_shield_protection_health_check_association.this
19+
}

‎variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
variable "name" {
2+
description = "A friendly name for the Protection you are creating."
3+
type = string
4+
}
5+
6+
variable "resource_arn" {
7+
description = "The ARN (Amazon Resource Name) of the resource to be protected."
8+
type = string
9+
}
10+
11+
variable "protection_group_id" {
12+
description = "The name of the protection group."
13+
type = string
14+
}
15+
16+
variable "aggregation" {
17+
description = "Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events."
18+
type = string
19+
}
20+
21+
variable "pattern" {
22+
description = "The criteria to use to choose the protected resources for inclusion in the group."
23+
type = string
24+
}
25+
26+
variable "resource_type" {
27+
description = "The resource type to include in the protection group. This is required if `pattern` is set to BY_RESOURCE_TYPE. Otherwise this must be not set. Defaults to `null`"
28+
type = string
29+
default = null
30+
}
31+
32+
variable "health_check_configuration" {
33+
description = "Amazon Route53 Health Check Configuration to be associated to AWS Shield Advanced Protection."
34+
type = map(any)
35+
default = null
36+
}
37+
38+
variable "tags" {
39+
description = "Key-value map of resource tags. Defaults to `{}`"
40+
type = map(string)
41+
default = {}
42+
}

0 commit comments

Comments
 (0)