Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump tfsec to 0.39.0 #201

Merged
merged 6 commits into from
Feb 24, 2021
Merged

Bump tfsec to 0.39.0 #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0a980f5
Bump tfsec to 0.39.0
AntoineAugusti Feb 24, 2021
7626669
AWS067: add authenticator log type
AntoineAugusti Feb 24, 2021
9b17bf6
Tackle AWS069: EKS Clusters should have the public access disabled
AntoineAugusti Feb 24, 2021
7fb1f8c
Move comment around
AntoineAugusti Feb 24, 2021
ff8fa55
Move comment around
AntoineAugusti Feb 24, 2021
af1f7e5
Remove blank line
AntoineAugusti Feb 24, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/terraform_static_analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ jobs:
uses: actions/checkout@v2

- name: Terraform security scan
uses: triat/terraform-security-scan@v2.0.2
uses: triat/terraform-security-scan@v2.1.0
with:
tfsec_version: 'v0.37.1'
tfsec_version: 'v0.39.0'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
10 changes: 8 additions & 2 deletions aws/eks/eks.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,21 @@ resource "aws_eks_cluster" "notification-canada-ca-eks-cluster" {
name = var.eks_cluster_name
role_arn = aws_iam_role.eks-cluster-role.arn

enabled_cluster_log_types = ["api", "audit", "controllerManager", "scheduler"]
enabled_cluster_log_types = ["api", "audit", "controllerManager", "scheduler", "authenticator"]

vpc_config {
# tfsec:ignore:AWS068 EKS cluster should not have open CIDR range for public access
# Will be tackled in the future https://github.com/cds-snc/notification-terraform/issues/203
security_group_ids = [
aws_security_group.notification-canada-ca-worker.id
]
subnet_ids = var.vpc_private_subnets
subnet_ids = var.vpc_private_subnets
endpoint_public_access = false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

}

# tfsec:ignore:AWS066 EKS should have the encryption of secrets enabled
# Will be tackled in the future https://github.com/cds-snc/notification-terraform/issues/202

# Ensure that IAM Role permissions are created before and deleted after EKS Cluster handling.
# Otherwise, EKS will not be able to properly delete EKS managed EC2 infrastructure such as Security Groups.
depends_on = [
Expand Down