-
diff --git a/frontend/stage-lz.env b/frontend/stage-lz.env new file mode 100644 index 00000000..cd5ca25e --- /dev/null +++ b/frontend/stage-lz.env @@ -0,0 +1,13 @@ +REACT_APP_API_URL=https://api.staging.crossfeed.cyber.dhs.gov +REACT_APP_FARGATE_LOG_GROUP=crossfeed-staging-worker +REACT_APP_USE_COGNITO=1 +REACT_APP_USER_POOL_ID=us-gov-west-1_F76spofW0 +REACT_APP_USER_POOL_CLIENT_ID=1ufalfdlti3i7q7ao7i8ee54bd +REACT_APP_TERMS_VERSION=1 +REACT_APP_COOKIE_DOMAIN=staging.crossfeed.cyber.dhs.gov +REACT_APP_TOTP_ISSUER=Staging Crossfeed +AWS_REGION=us-gov-west-1 +REACT_APP_COGNITO_DOMAIN=crossfeed-staging-okta-idp.auth-fips.us-gov-west-1.amazoncognito.com +REACT_APP_COGNITO_CLIENT_ID=3vd67chnkk7dg3jt3nkoidf94e +REACT_APP_COGNITO_USER_POOL_ID=us-gov-west-1_N84vh2cq2 +REACT_APP_COGNITO_CALLBACK_URL=https://staging.crossfeed.cyber.dhs.gov/okta-callback \ No newline at end of file diff --git a/infrastructure/cloudtrail.tf b/infrastructure/cloudtrail.tf index 798e51c8..d8e5b73c 100644 --- a/infrastructure/cloudtrail.tf +++ b/infrastructure/cloudtrail.tf @@ -4,7 +4,7 @@ resource "aws_cloudtrail" "all-events" { s3_bucket_name = var.cloudtrail_bucket_name kms_key_id = aws_kms_key.key.arn cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail.arn}:*" - cloud_watch_logs_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.cloudtrail_role_name}" + cloud_watch_logs_role_arn = "arn:${var.aws_partition}:iam::${data.aws_caller_identity.current.account_id}:role/${var.cloudtrail_role_name}" tags = { Project = var.project Stage = var.stage @@ -14,11 +14,11 @@ resource "aws_cloudtrail" "all-events" { include_management_events = true data_resource { type = "AWS::S3::Object" - values = ["arn:aws:s3"] + values = ["arn:${var.aws_partition}:s3"] } data_resource { type = "AWS::Lambda::Function" - values = ["arn:aws:lambda"] + values = ["arn:${var.aws_partition}:lambda"] } } enable_log_file_validation = true @@ -31,6 +31,7 @@ resource "aws_s3_bucket" "cloudtrail_bucket" { tags = { Project = var.project Stage = var.stage + Owner = "Crossfeed managed resource" } } @@ -41,6 +42,7 @@ resource "aws_cloudwatch_log_group" "cloudtrail" { tags = { Project = var.project Stage = var.stage + Owner = "Crossfeed managed resource" } } @@ -91,14 +93,16 @@ resource "aws_iam_role" "cloudtrail_role" { tags = { Project = var.project Stage = var.stage + Owner = "Crossfeed managed resource" } } data "template_file" "cloudtrail_bucket_policy" { template = file("cloudtrail_bucket_policy.tpl") vars = { - bucketName = var.cloudtrail_bucket_name - accountId = data.aws_caller_identity.current.account_id + bucketName = var.cloudtrail_bucket_name + accountId = data.aws_caller_identity.current.account_id + awsPartition = var.aws_partition } } @@ -135,7 +139,7 @@ resource "aws_iam_role_policy" "cloudtrail_cloudwatch_policy" { "logs:PutLogEvents" ], Effect = "Allow", - Resource = "arn:aws:logs:*" + Resource = "arn:${var.aws_partition}:logs:*" }] }) } diff --git a/infrastructure/cloudtrail_bucket_policy.tpl b/infrastructure/cloudtrail_bucket_policy.tpl index 5067a5c4..955a71fd 100644 --- a/infrastructure/cloudtrail_bucket_policy.tpl +++ b/infrastructure/cloudtrail_bucket_policy.tpl @@ -8,7 +8,7 @@ "Service": "cloudtrail.amazonaws.com" }, "Action": ["s3:GetBucketAcl"], - "Resource": ["arn:aws:s3:::${bucketName}"] + "Resource": ["arn:${awsPartition}:s3:::${bucketName}"] }, { "Sid": "AWSCloudTrailWrite20121017", @@ -18,8 +18,8 @@ }, "Action": ["s3:PutObject"], "Resource": [ - "arn:aws:s3:::${bucketName}/AWSLogs/${accountId}", - "arn:aws:s3:::${bucketName}/AWSLogs/${accountId}/*" + "arn:${awsPartition}:s3:::${bucketName}/AWSLogs/${accountId}", + "arn:${awsPartition}:s3:::${bucketName}/AWSLogs/${accountId}/*" ], "Condition": { "StringEquals": { @@ -33,8 +33,8 @@ "Effect": "Deny", "Principal": "*", "Resource": [ - "arn:aws:s3:::${bucketName}", - "arn:aws:s3:::${bucketName}/*" + "arn:${awsPartition}:s3:::${bucketName}", + "arn:${awsPartition}:s3:::${bucketName}/*" ], "Condition": { "Bool": { diff --git a/infrastructure/database.tf b/infrastructure/database.tf index c0a1b8ac..2233e539 100644 --- a/infrastructure/database.tf +++ b/infrastructure/database.tf @@ -3,10 +3,11 @@ data "aws_ssm_parameter" "db_username" { name = var.ssm_db_username } resource "aws_db_subnet_group" "default" { name = var.db_group_name - subnet_ids = [aws_subnet.db_1.id, aws_subnet.db_2.id] + subnet_ids = var.is_dmz ? [aws_subnet.db_1[0].id, aws_subnet.db_2[0].id] : [data.aws_ssm_parameter.subnet_db_1_id[0].value, data.aws_ssm_parameter.subnet_db_2_id[0].value] tags = { Project = var.project + Owner = "Crossfeed managed resource" } } @@ -31,15 +32,16 @@ resource "aws_db_instance" "db" { max_allocated_storage = 10000 storage_type = "gp2" engine = "postgres" - engine_version = "15.5" - allow_major_version_upgrade = false + engine_version = "15.7" + allow_major_version_upgrade = true skip_final_snapshot = true availability_zone = data.aws_availability_zones.available.names[0] - multi_az = false + multi_az = true backup_retention_period = 35 storage_encrypted = true iam_database_authentication_enabled = true enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"] + deletion_protection = true // database information db_name = var.db_table_name @@ -50,15 +52,16 @@ resource "aws_db_instance" "db" { db_subnet_group_name = aws_db_subnet_group.default.name parameter_group_name = aws_db_parameter_group.default.name - vpc_security_group_ids = [aws_security_group.allow_internal.id] + vpc_security_group_ids = [var.is_dmz ? aws_security_group.allow_internal[0].id : aws_security_group.allow_internal_lz[0].id] tags = { Project = "Crossfeed" + Owner = "Crossfeed managed resource" } } data "aws_ami" "ubuntu" { - + count = var.is_dmz ? 1 : 0 most_recent = true filter { @@ -75,36 +78,8 @@ data "aws_ami" "ubuntu" { owners = ["099720109477"] } -# DB Accessor EC2 -resource "aws_instance" "db_accessor" { - count = var.create_db_accessor_instance ? 1 : 0 - ami = data.aws_ami.ubuntu.id - instance_type = var.db_accessor_instance_class - associate_public_ip_address = false - - tags = { - Name = "${var.project}-${var.stage}-db-accessor" - Project = var.project - Stage = var.stage - } - - root_block_device { - volume_size = 1000 - } - - vpc_security_group_ids = [aws_security_group.allow_internal.id] - subnet_id = aws_subnet.backend.id - - iam_instance_profile = aws_iam_instance_profile.db_accessor.id - user_data = file("./ssm-agent-install.sh") - - lifecycle { - # prevent_destroy = true - ignore_changes = [ami] - } -} - resource "aws_iam_role" "db_accessor" { + count = var.create_db_accessor_instance ? 1 : 0 name = "crossfeed-db-accessor-${var.stage}" assume_role_policy = <=14.0.0" - }, - "integrity": "sha512-Oy8rmScVrVxWZVOpEF57ovlnhpZ8CCPlnIIumVcV9nFdiSIrus99+Lw78ekXyGvVDlIsFJbSfmSovJUhCWYV3w==", - "peer": true, - "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.15.3.tgz", - "version": "1.15.3" - }, "node_modules/@sinclair/typebox": { "dev": true, "integrity": "sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==", @@ -3742,6 +3732,7 @@ "version": "8.1.1" }, "node_modules/js-tokens": { + "dev": true, "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==", "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz", "version": "4.0.0" @@ -3881,17 +3872,6 @@ "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz", "version": "4.6.2" }, - "node_modules/loose-envify": { - "bin": { - "loose-envify": "cli.js" - }, - "dependencies": { - "js-tokens": "^3.0.0 || ^4.0.0" - }, - "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==", - "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz", - "version": "1.4.0" - }, "node_modules/lru-cache": { "dependencies": { "yallist": "^3.0.2" @@ -4019,14 +3999,6 @@ "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz", "version": "4.0.1" }, - "node_modules/object-assign": { - "engines": { - "node": ">=0.10.0" - }, - "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==", - "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz", - "version": "4.1.1" - }, "node_modules/once": { "dependencies": { "wrappy": "1" @@ -4322,21 +4294,6 @@ "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz", "version": "2.4.2" }, - "node_modules/prop-types": { - "dependencies": { - "loose-envify": "^1.4.0", - "object-assign": "^4.1.1", - "react-is": "^16.13.1" - }, - "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==", - "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz", - "version": "15.8.1" - }, - "node_modules/prop-types/node_modules/react-is": { - "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==", - "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz", - "version": "16.13.1" - }, "node_modules/punycode": { "dev": true, "engines": { @@ -4383,83 +4340,12 @@ "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", "version": "1.2.3" }, - "node_modules/react": { - "dependencies": { - "loose-envify": "^1.1.0", - "object-assign": "^4.1.1" - }, - "engines": { - "node": ">=0.10.0" - }, - "integrity": "sha512-gnhPt75i/dq/z3/6q/0asP78D0u592D5L1pd7M8P+dck6Fu/jJeL6iVVK23fptSUZj8Vjf++7wXA8UNclGQcbA==", - "peer": true, - "resolved": "https://registry.npmjs.org/react/-/react-17.0.2.tgz", - "version": "17.0.2" - }, - "node_modules/react-dom": { - "dependencies": { - "loose-envify": "^1.1.0", - "object-assign": "^4.1.1", - "scheduler": "^0.20.2" - }, - "integrity": "sha512-s4h96KtLDUQlsENhMn1ar8t2bEa+q/YAtj8pPPdIjPDGBDIVNsrD9aXNWqspUe6AzKCIG0C1HZZLqLV7qpOBGA==", - "peer": true, - "peerDependencies": { - "react": "17.0.2" - }, - "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-17.0.2.tgz", - "version": "17.0.2" - }, "node_modules/react-is": { "dev": true, "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==", "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.2.0.tgz", "version": "18.2.0" }, - "node_modules/react-router": { - "dependencies": { - "@remix-run/router": "1.15.3" - }, - "engines": { - "node": ">=14.0.0" - }, - "integrity": "sha512-dr2eb3Mj5zK2YISHK++foM9w4eBnO23eKnZEDs7c880P6oKbrjz/Svg9+nxqtHQK+oMW4OtjZca0RqPglXxguQ==", - "peer": true, - "peerDependencies": { - "react": ">=16.8" - }, - "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.22.3.tgz", - "version": "6.22.3" - }, - "node_modules/react-router-dom": { - "dependencies": { - "@remix-run/router": "1.15.3", - "react-router": "6.22.3" - }, - "engines": { - "node": ">=14.0.0" - }, - "integrity": "sha512-7ZILI7HjcE+p31oQvwbokjk6OA/bnFxrhJ19n82Ex9Ph8fNAq+Hm/7KchpMGlTgWhUxRHMMCut+vEtNpWpowKw==", - "peer": true, - "peerDependencies": { - "react": ">=16.8", - "react-dom": ">=16.8" - }, - "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.22.3.tgz", - "version": "6.22.3" - }, - "node_modules/react-router-hash-link": { - "dependencies": { - "prop-types": "^15.7.2" - }, - "integrity": "sha512-NU7GWc265m92xh/aYD79Vr1W+zAIXDWp3L2YZOYP4rCqPnJ6LI6vh3+rKgkidtYijozHclaEQTAHaAaMWPVI4A==", - "peerDependencies": { - "react": ">=15", - "react-router-dom": ">=4" - }, - "resolved": "https://registry.npmjs.org/react-router-hash-link/-/react-router-hash-link-2.4.3.tgz", - "version": "2.4.3" - }, "node_modules/require-directory": { "dev": true, "engines": { @@ -4575,16 +4461,6 @@ "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", "version": "1.2.0" }, - "node_modules/scheduler": { - "dependencies": { - "loose-envify": "^1.1.0", - "object-assign": "^4.1.1" - }, - "integrity": "sha512-2eWfGgAqqWFGqtdMmcL5zCMK1U8KlXv8SQFGglL3CEtd0aDVDWgeF/YoCmvln55m5zSk3J/20hTaSBeSObsQDQ==", - "peer": true, - "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.20.2.tgz", - "version": "0.20.2" - }, "node_modules/semver": { "bin": { "semver": "bin/semver.js"