Skip to content

Commit afd9db6

Browse files
novekmnovekm
authored
Merge pull request #1 from novekm/novekm/add-initial-module-code
Novekm/add initial module code
2 parents 0f5a9b4 + 17813a7 commit afd9db6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+2694
-62
lines changed

‎.config/.checkov.yml

+36-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,42 @@ skip-check:
99
- CKV_AZURE*
1010
- CKV2_AZURE*
1111
- CKV_TF_1 # default to Terraform registry instead of Git
12+
- CKV2_AWS_5 # Ensure that Security Groups are attached to another resource
13+
- CKV2_AWS_47 # Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
14+
- CKV2_AWS_28 # Ensure public facing ALB are protected by WAF
15+
- CKV2_AWS_42 # Ensure AWS CloudFront distribution uses custom SSL certificate
16+
- CKV2_AWS_11 # Ensure VPC flow logging is enabled in all VPCs
17+
- CKV2_AWS_19 # Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances
18+
- CKV2_AWS_12 # Ensure the default security group of every VPC restricts all traffic
19+
- CKV2_AWS_20 # Ensure that ALB redirects HTTP requests into HTTPS ones
20+
- CKV2_AWS_32 # Ensure CloudFront distribution has a response headers policy attached
21+
- CKV_AWS_65 # Ensure container insights are enabled on ECS cluster
22+
- CKV_AWS_333 # Ensure ECS services do not have public IP addresses assigned to them automatically
23+
- CKV_AWS_158 # Ensure that CloudWatch Log Group is encrypted by KMS
24+
- CKV_AWS_51 # Ensure ECR Image Tags are immutable
25+
- CKV_AWS_103 # Ensure that load balancer is using at least TLS 1.2
26+
- CKV_AWS_136 # Ensure that ECR repositories are encrypted using KMS
27+
- CKV_AWS_163 # Ensure ECR image scanning on push is enabled
28+
- CKV_AWS_91 # Ensure the ELBv2 (Application/Network) has access logging enabled
29+
- CKV_AWS_150 # Ensure that Load Balancer has deletion protection enabled
30+
- CKV_AWS_2 # Ensure ALB protocol is HTTPS
31+
- CKV_AWS_310 # Ensure CloudFront distributions should have origin failover configured
32+
- CKV_AWS_68 # CloudFront Distribution should have WAF enabled
33+
- CKV_AWS_86 # Ensure CloudFront distribution has Access Logging enabled
34+
- CKV_AWS_174 # Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
35+
- CKV_AWS_305 # Ensure CloudFront distribution has a default root object configured
36+
- CKV_AWS_219 # Ensure CodePipeline Artifact store is using a KMS CMK
37+
- CKV_AWS_314 # Ensure CodeBuild project environments have a logging configuration
38+
- CKV2_AWS_6 # Ensure that S3 bucket has a Public Access block
39+
- CKV2_AWS_61 # Ensure that an S3 bucket has a lifecycle configuration
40+
- CKV2_AWS_62 # Ensure S3 buckets should have event notifications enabled
41+
- CKV_AWS_18 # Ensure the S3 bucket has access logging enabled
42+
- CKV_AWS_145 # Ensure that S3 buckets are encrypted with KMS by default
43+
- CKV_AWS_144 # Ensure that S3 bucket has cross-region replication enabled
44+
- CKV_AWS_21 # Ensure all data stored in the S3 bucket have versioning enabled
45+
46+
1247
summary-position: bottom
1348
output: 'cli'
1449
compact: True
15-
quiet: True
50+
quiet: True

‎.config/.tfsec.yml

+21-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
11
{
2-
"minimum_severity": "MEDIUM"
3-
}
2+
"minimum_severity": "MEDIUM",
3+
"exclude": [
4+
"aws-elb-http-not-used",
5+
"aws-ecr-enable-image-scans",
6+
"aws-ecr-enforce-immutable-repository",
7+
"aws-elb-alb-not-public",
8+
"aws-cloudfront-enable-waf",
9+
"aws-cloudfront-use-secure-tls-policy",
10+
"aws-cloudfront-enable-logging",
11+
"aws-ec2-require-vpc-flow-logs-for-all-vpcs",
12+
"aws-iam-no-policy-wildcards",
13+
"aws-s3-block-public-acls",
14+
"aws-s3-ignore-public-acls",
15+
"aws-s3-block-public-policy",
16+
"aws-s3-enable-bucket-encryption",
17+
"aws-s3-no-public-buckets",
18+
"aws-s3-encryption-customer-key",
19+
"aws-s3-enable-bucket-logging",
20+
"aws-s3-enable-versioning",
21+
],
22+
}

‎.config/functional_tests/pre-entrypoint-helpers.sh

+10-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
11
#!/bin/bash
22
## NOTE: this script runs at the start of functional test
3-
## use this to load any configuration before the functional test
3+
## use this to load any configuration before the functional test
44
## TIPS: avoid modifying the .project_automation/functional_test/entrypoint.sh
55
## migrate any customization you did on entrypoint.sh to this helper script
6-
echo "Executing Pre-Entrypoint Helpers"
6+
echo "Executing Pre-Entrypoint Helpers"
7+
8+
#********** Project Path *************
9+
PROJECT_PATH=${BASE_PATH}/project
10+
PROJECT_TYPE_PATH=${BASE_PATH}/projecttype
11+
cd ${PROJECT_PATH}
12+
13+
#********** AWS Region Export *************
14+
export AWS_DEFAULT_REGION=us-east-1

‎.gitignore

+8-5
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ plan.out.json
1313
crash.log
1414

1515
# Exclude all .tfvars files, which are likely to contain sentitive data, such as
16-
# password, private keys, and other secrets. These should not be part of version
17-
# control as they are data points which are potentially sensitive and subject
16+
# password, private keys, and other secrets. These should not be part of version
17+
# control as they are data points which are potentially sensitive and subject
1818
# to change depending on the environment.
1919
#
2020
*.tfvars
@@ -38,9 +38,12 @@ override.tf.json
3838
terraform.rc
3939
.terraform.lock.hcl
4040

41-
# Terratest / GoLang
41+
# Terratest / GoLang
4242
go.mod
4343
go.sum
4444

45-
# Terraform tests
46-
tests/*.auto.tfvars
45+
# Terraform tests
46+
tests/*.auto.tfvars
47+
48+
streamlit-app-assets.zip
49+
./examples/*/streamlit-app-assets.zip

‎.header.md

+50-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,53 @@
1-
# Terraform Module Project
1+
# AWS Serverless Streamlit App Terraform Module
22

3-
:no_entry_sign: Do not edit this readme.md file. To learn how to change this content and work with this repository, refer to CONTRIBUTING.md
3+
## Features
44

5-
## Readme Content
5+
- Serverless deployment using ECS, Application Load Balancer, and CloudFront
6+
- Ability to reference existing VPCs, Subnets, Security Groups, and IAM Roles/Policies
7+
- Automated build of Docker Images
8+
- Automated push of Docker Images to Amazon Elastic Container Registry (ECR)
9+
- Configurable automated CloudFront Invalidations
10+
- Dynamic rollback to previous app versions via image tag
611

7-
This file will contain any instructional information about this module.
12+
## Architecture
13+
14+
### Streamlit App Hosting
15+
16+
![Streamlit App Hosting Arch](architecture/terraform-module-serverless-streamlit-app-hosting-arch.png)
17+
18+
### Streamlit App Deployment Pipeline
19+
20+
![Streamlit App Deployment Pipeline Arch](architecture/terraform-module-serverless-streamlit-app-deployment-pipeline-arch-with-key.png)
21+
22+
## Basic Usage - Simple deployment of sample Streamlit app with default configuration
23+
24+
### Important
25+
26+
**Note:** The basic deployment will create necessary networking and security services for you with the default values defined in the module variables. If you need to reference existing security and networking resources (VPCs, Subnets, Security Groups, IAM Roles/Policies), please visit review the example for existing resources in the `examples` directory.
27+
28+
**Note**: Ensure the architecture of your ECS Task matches your CodeBuild project. For example, if your CodeBuild project uses an ARM environment such as `BUILD_GENERAL1_SMALL` and an ARM image such as `aws/codebuild/amazonlinux2-aarch64-standard:3.0`, you must also set the architecture of your ECS task to be `ARM64`.
29+
30+
The module provides variables named `ecs_cpu_architecture` `codebuild_compute_type`, and `codebuild_image` which can be modified to your desired values. The default values are using ARM.
31+
32+
**Relevant docs**:
33+
34+
- [CodeBuild - Docker images provided by CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html)
35+
- [CodeBuild - Build environment compute modes and types](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html)
36+
37+
```hcl
38+
// This is a template file for a basic deployment.
39+
// Modify the parameters below with your desired values
40+
41+
module "serverless-streamlit-app" {
42+
source = "../.." # local example
43+
# source = "aws-ia/serverless-streamlit-app/aws" # remote example
44+
45+
app_name = "streamlit-app"
46+
environment = "dev"
47+
app_version = "v0.0.1" # used as one of the tags for Docker image. Update this when you wish to push new changes to ECR.
48+
}
49+
```
50+
51+
## Contributing
52+
53+
See the `CONTRIBUTING.md` file for information on how to contribute.

‎.project_automation/static_tests/static_tests.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ else
3232
exit 1
3333
fi
3434

35-
#********** tfsec *********************
35+
# #********** tfsec *********************
3636
echo 'Starting tfsec'
3737
MYTFSEC=$(tfsec . --config-file ${PROJECT_PATH}/.config/.tfsec.yml --custom-check-dir ${PROJECT_PATH}/.config/.tfsec)
3838
if [[ $MYTFSEC == *"No problems detected!"* ]];
@@ -83,4 +83,4 @@ else
8383
fi
8484

8585
#***************************************
86-
echo "End of Static Tests"
86+
echo "End of Static Tests"

0 commit comments

Comments
 (0)