BCP early stages

aws/common/outputs.tf

@@ -6,6 +6,10 @@ output "vpc_id" {
   value = aws_vpc.notification-canada-ca.id
 }
 
+output "vpc_private_subnet_cidr_blocks" {
+  value = aws_subnet.notification-canada-ca-private.*.cidr_block
+}
+
 output "vpc_private_subnets" {
   value = aws_subnet.notification-canada-ca-private.*.id
 }
@@ -177,12 +181,4 @@ output "sqs_send_email_medium_queue_name" {
 
 output "sqs_send_email_high_queue_name" {
   value = var.sqs_send_email_high_queue_name
-}
-
-output "client_vpn_cloudwatch_log_group_name" {
-  value = module.vpn.client_vpn_cloudwatch_log_group_name
-}
-
-output "client_vpn_security_group_id" {
-  value = module.vpn.client_vpn_security_group_id
-}
+}

aws/common/s3.tf

@@ -25,6 +25,7 @@ resource "aws_s3_bucket" "csv_bucket" {
 
   #tfsec:ignore:AWS077 - Versioning is not enabled
   logging {
+    target_prefix = var.env
     target_bucket = module.csv_bucket_logs.s3_bucket_id
   }
 
@@ -155,6 +156,7 @@ resource "aws_s3_bucket" "document_bucket" {
 
   #tfsec:ignore:AWS077 - Versioning is not enabled
   logging {
+    target_prefix = var.env
     target_bucket = module.document_download_logs.s3_bucket_id
   }
 
@@ -188,6 +190,7 @@ resource "aws_s3_bucket" "scan_files_document_bucket" {
 
   #tfsec:ignore:AWS077 - Versioning is not enabled
   logging {
+    target_prefix = var.env
     target_bucket = module.document_download_logs.s3_bucket_id
   }
 
@@ -329,6 +332,7 @@ resource "aws_s3_bucket" "athena_bucket" {
 
   #tfsec:ignore:AWS077 - Versioning is not enabled
   logging {
+    target_prefix = var.env
     target_bucket = module.athena_logs_bucket.s3_bucket_id
   }
 

aws/common/variables.tf

@@ -278,23 +278,6 @@ variable "eks_cluster_name" {
   type        = string
 }
 
-variable "client_vpn_access_group_id" {
-  description = "IAM Identity Center group ID that will be allowed access to the VPN."
-  type        = string
-  sensitive   = true
-}
-
-variable "client_vpn_saml_metadata" {
-  description = "IAM Identity Center application SAML metadata.  Users that want to connect to the VPN must be granted access to this app."
-  type        = string
-  sensitive   = true
-}
-
-variable "client_vpn_self_service_saml_metadata" {
-  description = "IAM Identity Center self-service application SAML metadata.  This allows users to download the VPN client and configuration."
-  type        = string
-  sensitive   = true
-}
 
 variable "account_budget_limit" {
   description = "The dollar amount in USD that this AWS account should be budgeted to"

aws/common/vpc.tf

@@ -7,7 +7,7 @@ data "aws_availability_zones" "available" {
 }
 
 resource "aws_vpc" "notification-canada-ca" {
-  cidr_block           = "10.0.0.0/16"
+  cidr_block           = var.vpc_cidr_block
   enable_dns_hostnames = true
 
   tags = {
@@ -74,7 +74,7 @@ resource "aws_subnet" "notification-canada-ca-private" {
   count = 3
 
   vpc_id            = aws_vpc.notification-canada-ca.id
-  cidr_block        = cidrsubnet("10.0.0.0/16", 8, count.index)
+  cidr_block        = cidrsubnet(var.vpc_cidr_block, 8, count.index)
   availability_zone = element(data.aws_availability_zones.available.names, count.index)
 
   tags = {
@@ -91,7 +91,7 @@ resource "aws_subnet" "notification-canada-ca-public" {
   count = 3
 
   vpc_id            = aws_vpc.notification-canada-ca.id
-  cidr_block        = cidrsubnet("10.0.0.0/16", 8, count.index + 3)
+  cidr_block        = cidrsubnet(var.vpc_cidr_block, 8, count.index + 3)
   availability_zone = element(data.aws_availability_zones.available.names, count.index)
 
   tags = {

aws/database-tools/rds.tf

@@ -17,7 +17,7 @@ resource "aws_db_instance" "database-tools" {
   allocated_storage   = 10
   db_name             = "database_tools"
   engine              = "postgres"
-  engine_version      = "14.3"
+  engine_version      = "15.5"
   instance_class      = "db.t3.micro"
   username            = "postgres"
   password            = var.dbtools_password

aws/dns/iam.tf

@@ -42,6 +42,50 @@ resource "aws_iam_role" "scratch_dns_manager" {
 EOF
 }
 
+resource "aws_iam_role_policy" "pond_dns_manager_policy" {
+  count = var.env == "staging" ? 1 : 0
+  name  = "pond_dns_manager_policy"
+  role  = aws_iam_role.pond_dns_manager[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = ["route53:GetHostedZone",
+        "route53:ListResourceRecordSets",
+        "route53:ListHostedZones",
+        "route53:ChangeResourceRecordSets",
+        "route53:ListResourceRecordSets",
+        "route53:GetHostedZoneCount",
+        "route53:ListHostedZonesByName",
+        "route53:GetChange"
+      ]
+      Resource = ["*"]
+    }]
+  })
+}
+
+resource "aws_iam_role" "pond_dns_manager" {
+  count = var.env == "staging" ? 1 : 0
+  name  = "pond_dns_manager_role"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "AWS": "339712868793"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
 resource "aws_iam_role_policy" "staging_dns_manager_policy" {
   count = var.env == "staging" ? 1 : 0
   name  = "staging_dns_manager_policy"

aws/ecr/images.tf

@@ -97,7 +97,7 @@ resource "null_resource" "build_heartbeat_docker_image" {
   ]
 
   provisioner "local-exec" {
-    command = "docker build -t ${aws_ecr_repository.heartbeat.repository_url}:bootstrap -f /var/tmp/notification-lambdas/heartbeat/Dockerfile /var/tmp/notification-lambdas/"
+    command = "pushd /var/tmp/notification-lambdas/heartbeat && docker build -t ${aws_ecr_repository.heartbeat.repository_url}:bootstrap -f /var/tmp/notification-lambdas/heartbeat/Dockerfile . && popd"
   }
 
 }
@@ -121,7 +121,7 @@ resource "null_resource" "build_google_cidr_docker_image" {
   ]
 
   provisioner "local-exec" {
-    command = "docker build -t ${aws_ecr_repository.google-cidr.repository_url}:bootstrap -f /var/tmp/notification-lambdas/google-cidr/Dockerfile /var/tmp/notification-lambdas/google-cidr"
+    command = "pushd /var/tmp/notification-lambdas/google-cidr && docker build -t ${aws_ecr_repository.google-cidr.repository_url}:bootstrap -f /var/tmp/notification-lambdas/google-cidr/Dockerfile . && popd"
   }
 
 }
@@ -145,7 +145,7 @@ resource "null_resource" "build_ses_receiving_emails_docker_image" {
   ]
 
   provisioner "local-exec" {
-    command = "docker build -t ${aws_ecr_repository.ses_receiving_emails.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesreceivingemails/Dockerfile /var/tmp/notification-lambdas"
+    command = "pushd /var/tmp/notification-lambdas/sesreceivingemails && docker build -t ${aws_ecr_repository.ses_receiving_emails.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesreceivingemails/Dockerfile . && popd"
   }
 
 }
@@ -169,7 +169,7 @@ resource "null_resource" "build_ses_to_sqs_email_callbacks_docker_image" {
   ]
 
   provisioner "local-exec" {
-    command = "docker build -t ${aws_ecr_repository.ses_to_sqs_email_callbacks.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesemailcallbacks/Dockerfile /var/tmp/notification-lambdas"
+    command = "pushd /var/tmp/notification-lambdas/sesemailcallbacks && docker build -t ${aws_ecr_repository.ses_to_sqs_email_callbacks.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesemailcallbacks/Dockerfile . && popd"
   }
 
 }
@@ -193,7 +193,7 @@ resource "null_resource" "build_sns_to_sqs_sms_callbacks_docker_image" {
   ]
 
   provisioner "local-exec" {
-    command = "docker build -t ${aws_ecr_repository.sns_to_sqs_sms_callbacks.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesemailcallbacks/Dockerfile /var/tmp/notification-lambdas"
+    command = "pushd /var/tmp/notification-lambdas/sesemailcallbacks && docker build -t ${aws_ecr_repository.sns_to_sqs_sms_callbacks.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesemailcallbacks/Dockerfile . && popd"
   }
 
 }
@@ -217,7 +217,7 @@ resource "null_resource" "build_system_status_docker_image" {
   ]
 
   provisioner "local-exec" {
-    command = "docker build -t ${aws_ecr_repository.system_status.repository_url}:bootstrap -f /var/tmp/notification-lambdas/system_status/Dockerfile /var/tmp/notification-lambdas/"
+    command = "pushd /var/tmp/notification-lambdas/system_status && docker build -t ${aws_ecr_repository.system_status.repository_url}:bootstrap -f /var/tmp/notification-lambdas/system_status/Dockerfile . && popd"
   }
 }
 

aws/eks/securitygroups.tf

@@ -359,7 +359,7 @@ resource "aws_security_group_rule" "client-vpn-ingress-database" {
   from_port                = 5432
   to_port                  = 5432
   protocol                 = "tcp"
-  source_security_group_id = var.client_vpn_security_group_id
+  source_security_group_id = module.vpn.client_vpn_security_group_id
   security_group_id        = data.aws_security_group.eks-securitygroup-rds.id
 }
 
@@ -369,7 +369,7 @@ resource "aws_security_group_rule" "client-vpn-ingress-redis" {
   from_port                = 6379
   to_port                  = 6379
   protocol                 = "tcp"
-  source_security_group_id = var.client_vpn_security_group_id
+  source_security_group_id = module.vpn.client_vpn_security_group_id
   security_group_id        = data.aws_security_group.eks-securitygroup-rds.id
 }
 

aws/eks/sentinel.tf

@@ -1,6 +1,6 @@
 locals {
   application_log_group_arn = "arn:aws:logs:${var.region}:${var.account_id}:log-group:${local.eks_application_log_group}"
-  client_vpn_log_group_arn  = "arn:aws:logs:${var.region}:${var.account_id}:log-group:${var.client_vpn_cloudwatch_log_group_name}"
+  client_vpn_log_group_arn  = "arn:aws:logs:${var.region}:${var.account_id}:log-group:${module.vpn.client_vpn_cloudwatch_log_group_name}"
   blazer_log_group_arn      = "arn:aws:logs:${var.region}:${var.account_id}:log-group:blazer"
 }
 
@@ -45,9 +45,10 @@ resource "aws_cloudwatch_log_subscription_filter" "blazer_logging" {
 }
 
 resource "aws_cloudwatch_log_subscription_filter" "client_vpn_connections" {
-  count           = var.enable_sentinel_forwarding ? 1 : 0
-  name            = "Client VPN connections"
-  log_group_name  = var.client_vpn_cloudwatch_log_group_name
+  count          = var.enable_sentinel_forwarding ? 1 : 0
+  name           = "Client VPN connections"
+  log_group_name = module.vpn.client_vpn_cloudwatch_log_group_name
+
   filter_pattern  = "[w1=\"*\"]" # All logs
   destination_arn = module.sentinel_forwarder[0].lambda_arn
   distribution    = "Random"

aws/eks/variables.tf

@@ -240,16 +240,6 @@ variable "celery_queue_prefix" {
   description = "Celery queue prefix"
 }
 
-variable "client_vpn_cloudwatch_log_group_name" {
-  type        = string
-  description = "Client VPN CloudWatch log group name. This is used by the Sentinel forwarder to send logs to Sentinel."
-}
-
-variable "client_vpn_security_group_id" {
-  type        = string
-  description = "Client VPN security group ID"
-}
-
 variable "eks_addon_ebs_driver_version" {
   type        = string
   description = "Version for EBS driver addon for EKS (Persistence)"
@@ -294,3 +284,25 @@ variable "pr_bot_installation_id" {
   sensitive   = true
 }
 
+variable "client_vpn_access_group_id" {
+  description = "IAM Identity Center group ID that will be allowed access to the VPN."
+  type        = string
+  sensitive   = true
+}
+variable "client_vpn_saml_metadata" {
+  description = "IAM Identity Center application SAML metadata.  Users that want to connect to the VPN must be granted access to this app."
+  type        = string
+  sensitive   = true
+}
+
+variable "client_vpn_self_service_saml_metadata" {
+  description = "IAM Identity Center self-service application SAML metadata.  This allows users to download the VPN client and configuration."
+  type        = string
+  sensitive   = true
+}
+
+variable "vpc_private_subnet_cidr_blocks" {
+  description = "CIDR blocks of the subnets where the VPN will be deployed."
+  type        = list(string)
+}
+

aws/common/vpn.tf → aws/eks/vpn.tf

@@ -8,10 +8,10 @@ module "vpn" {
   endpoint_name   = "private-subnets"
   access_group_id = var.client_vpn_access_group_id
 
-  vpc_id              = aws_vpc.notification-canada-ca.id
-  vpc_cidr_block      = aws_vpc.notification-canada-ca.cidr_block
-  subnet_cidr_blocks  = aws_subnet.notification-canada-ca-private.*.cidr_block
-  subnet_ids          = aws_subnet.notification-canada-ca-private.*.id
+  vpc_id              = var.vpc_id
+  vpc_cidr_block      = var.vpc_cidr_block
+  subnet_cidr_blocks  = var.vpc_private_subnet_cidr_blocks
+  subnet_ids          = var.vpc_private_subnets
   acm_certificate_arn = aws_acm_certificate.client_vpn.arn
 
   # Only create a self-service portal in prod  
@@ -27,7 +27,6 @@ module "vpn" {
 }
 
 #
-# Certificate used for VPN communication
 #
 resource "tls_private_key" "client_vpn" {
   algorithm = "RSA"

aws/heartbeat/lambda.tf

@@ -1,5 +1,5 @@
 locals {
-  image_tag = var.env == "production" ? var.heartbeat_docker_tag : "latest"
+  image_tag = var.env == "production" ? var.heartbeat_docker_tag : (var.bootstrap == true ? "bootstrap" : "latest")
 }
 
 module "heartbeat" {

aws/heartbeat/variables.tf

@@ -44,4 +44,9 @@ variable "heartbeat_docker_tag" {
   type        = string
   description = "Set this to specify the image version"
   default     = "bootstrap"
+}
+variable "bootstrap" {
+  description = "Boolean value to decide whether or not to build images"
+  type        = bool
+  default     = false
 }

aws/lambda-api/api_gateway.tf

@@ -176,3 +176,46 @@
   resource_arn = aws_api_gateway_stage.api.arn
   web_acl_arn  = aws_wafv2_web_acl.api_lambda.arn
 }
+
+
+resource "aws_api_gateway_method_settings" "api_settings" {
+  rest_api_id = aws_api_gateway_rest_api.api.id
+  stage_name  = aws_api_gateway_stage.api.stage_name
+  method_path = "*/*"
+  settings {
+    logging_level      = "INFO"
+    data_trace_enabled = false
+    metrics_enabled    = true
+    caching_enabled    = true
+  }
+}
+
+# Allow API Gateway to push logs to CloudWatch
+resource "aws_api_gateway_account" "main" {
+  cloudwatch_role_arn = aws_iam_role.main.arn
+}
+
+resource "aws_iam_role" "main" {
+  name               = "api-gateway-logs-role"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "apigateway.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+
+}
+
+resource "aws_iam_role_policy_attachment" "main" {
+  role       = aws_iam_role.main.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}