From 3951c8e1cf4faf94c3c92b2b01d26b078bc60d88 Mon Sep 17 00:00:00 2001 From: Heath Snow Date: Sun, 2 May 2021 14:10:29 -0700 Subject: [PATCH] Allow all TCP traffic from designated security groups (#31) --- .github/CODEOWNERS | 4 ++-- .github/auto-release.yml | 2 +- .github/mergify.yml | 7 ++++++ .github/workflows/auto-format.yml | 4 +++- .github/workflows/auto-release.yml | 26 +++++++++++++++-------- .github/workflows/validate-codeowners.yml | 2 ++ README.md | 5 +++-- docs/terraform.md | 1 + outputs.tf | 5 +++++ sg.tf | 6 +++--- 10 files changed, 44 insertions(+), 18 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 2537f2f..6f64b5a 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -15,8 +15,8 @@ # Cloud Posse must review any changes to standard context definition, # but some changes can be rubber-stamped. -**/*.tf @cloudposse/engineering @cloudposse/approvers -README.yaml @cloudposse/engineering @cloudposse/approvers +**/*.tf @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers +README.yaml @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers diff --git a/.github/auto-release.yml b/.github/auto-release.yml index c78a4d8..39a7f1e 100644 --- a/.github/auto-release.yml +++ b/.github/auto-release.yml @@ -46,7 +46,7 @@ template: | replacers: # Remove irrelevant information from Renovate bot -- search: '/---\s+^#.*Renovate configuration(?:.|\n)*?This PR has been generated .*/gm' +- search: '/(?<=---\s+)+^#.*(Renovate configuration|Configuration)(?:.|\n)*?This PR has been generated .*/gm' replace: '' # Remove Renovate bot banner image - search: '/\[!\[[^\]]*Renovate\][^\]]*\](\([^)]*\))?\s*\n+/gm' diff --git a/.github/mergify.yml b/.github/mergify.yml index b010656..ef15545 100644 --- a/.github/mergify.yml +++ b/.github/mergify.yml @@ -56,3 +56,10 @@ pull_request_rules: changes_requested: true approved: true message: "This Pull Request has been updated, so we're dismissing all reviews." + +- name: "close Pull Requests without files changed" + conditions: + - "#files=0" + actions: + close: + message: "This pull request has been automatically closed by Mergify because there are no longer any changes." diff --git a/.github/workflows/auto-format.yml b/.github/workflows/auto-format.yml index 990abed..375d0fd 100644 --- a/.github/workflows/auto-format.yml +++ b/.github/workflows/auto-format.yml @@ -6,7 +6,7 @@ on: jobs: auto-format: runs-on: ubuntu-latest - container: cloudposse/build-harness:slim-latest + container: cloudposse/build-harness:latest steps: # Checkout the pull request branch # "An action in a workflow run can’t trigger a new workflow run. For example, if an action pushes code using @@ -29,6 +29,8 @@ jobs: - name: Auto Format if: github.event.pull_request.state == 'open' shell: bash + env: + GITHUB_TOKEN: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}" run: make BUILD_HARNESS_PATH=/build-harness PACKAGES_PREFER_HOST=true -f /build-harness/templates/Makefile.build-harness pr/auto-format/host # Commit changes (if any) to the PR branch diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 3f48017..1d06d9b 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -3,17 +3,25 @@ name: auto-release on: push: branches: - - master + - main + - master + - production jobs: publish: runs-on: ubuntu-latest steps: - # Drafts your next Release notes as Pull Requests are merged into "master" - - uses: release-drafter/release-drafter@v5 - with: - publish: true - prerelease: false - config-name: auto-release.yml - env: - GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} + # Get PR from merged commit to master + - uses: actions-ecosystem/action-get-merged-pull-request@v1 + id: get-merged-pull-request + with: + github_token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} + # Drafts your next Release notes as Pull Requests are merged into "main" + - uses: release-drafter/release-drafter@v5 + if: "!contains(steps.get-merged-pull-request.outputs.labels, 'no-release')" + with: + publish: true + prerelease: false + config-name: auto-release.yml + env: + GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index 386eb28..c5193b6 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -1,5 +1,7 @@ name: Validate Codeowners on: + workflow_dispatch: + pull_request: jobs: diff --git a/README.md b/README.md index 5be6ec9..7b17d21 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,4 @@ + # terraform-aws-mq-broker [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-mq-broker.svg)](https://github.com/cloudposse/terraform-aws-mq-broker/releases/latest) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) @@ -29,7 +30,6 @@ Terraform module to provision AmazonMQ resources on AWS - --- This project is part of our comprehensive ["SweetOps"](https://cpco.io/sweetops) approach towards DevOps. @@ -59,7 +59,6 @@ We literally have [*hundreds of terraform modules*][terraform_modules] that are - ## Introduction This module provisions the following resources: @@ -69,6 +68,7 @@ This module provisions the following resources: Admin and application users are created and credentials written to SSM if not passed in as variables. + ## Security & Compliance [](https://bridgecrew.io/) Security scanning is graciously provided by Bridgecrew. Bridgecrew is the leading fully hosted, cloud-native solution providing continuous Terraform security and compliance. @@ -265,6 +265,7 @@ Available targets: | [secondary\_ssl\_endpoint](#output\_secondary\_ssl\_endpoint) | AmazonMQ secondary SSL endpoint | | [secondary\_stomp\_ssl\_endpoint](#output\_secondary\_stomp\_ssl\_endpoint) | AmazonMQ secondary STOMP+SSL endpoint | | [secondary\_wss\_endpoint](#output\_secondary\_wss\_endpoint) | AmazonMQ secondary WSS endpoint | +| [security\_group\_id](#output\_security\_group\_id) | The security group created by this module. | diff --git a/docs/terraform.md b/docs/terraform.md index 63fca0b..a00a534 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -111,4 +111,5 @@ | [secondary\_ssl\_endpoint](#output\_secondary\_ssl\_endpoint) | AmazonMQ secondary SSL endpoint | | [secondary\_stomp\_ssl\_endpoint](#output\_secondary\_stomp\_ssl\_endpoint) | AmazonMQ secondary STOMP+SSL endpoint | | [secondary\_wss\_endpoint](#output\_secondary\_wss\_endpoint) | AmazonMQ secondary WSS endpoint | +| [security\_group\_id](#output\_security\_group\_id) | The security group created by this module. | diff --git a/outputs.tf b/outputs.tf index 895196b..a4de0f8 100644 --- a/outputs.tf +++ b/outputs.tf @@ -8,6 +8,11 @@ output "broker_arn" { description = "AmazonMQ broker ARN" } +output "security_group_id" { + value = var.use_existing_security_groups ? null : aws_security_group.default.0.id + description = "The security group created by this module." +} + output "primary_console_url" { value = try(aws_mq_broker.default[0].instances[0].console_url, "") description = "AmazonMQ active web console URL" diff --git a/sg.tf b/sg.tf index 1714b62..2aa233e 100644 --- a/sg.tf +++ b/sg.tf @@ -20,7 +20,7 @@ resource "aws_security_group_rule" "ingress_security_groups" { count = module.this.enabled && var.use_existing_security_groups == false ? length(var.allowed_security_groups) : 0 description = "Allow inbound traffic from existing Security Groups" from_port = 0 - to_port = 0 + to_port = 65535 protocol = "tcp" source_security_group_id = var.allowed_security_groups[count.index] security_group_id = join("", aws_security_group.default.*.id) @@ -30,8 +30,8 @@ resource "aws_security_group_rule" "ingress_security_groups" { resource "aws_security_group_rule" "ingress_cidr_blocks" { count = module.this.enabled && var.use_existing_security_groups == false && length(var.allowed_cidr_blocks) > 0 ? 1 : 0 description = "Allow inbound traffic from CIDR blocks" - from_port = "0" - to_port = "0" + from_port = 0 + to_port = 65535 protocol = "tcp" cidr_blocks = var.allowed_cidr_blocks security_group_id = join("", aws_security_group.default.*.id)