Skip to content

fix(core): z111 security group description tweaks #373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Sep 8, 2020
Merged

fix(core): z111 security group description tweaks #373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7b8be18
added version to accelerator version ssm parameter
nachundu-amzn Sep 7, 2020
fdb54e0
added installer version environment variable
nachundu-amzn Sep 7, 2020
7116aed
changed max results value
nachundu-amzn Sep 7, 2020
0c3d561
updated description based on installer version and fixed tests
nachundu-amzn Sep 8, 2020
01c9eaa
Merge branch 'master' into fix/z111-Security-Group-description-tweaks
nachundu-amzn Sep 8, 2020
5291116
fixed code review comment
nachundu-amzn Sep 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion src/core/cdk/src/initial-setup.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -514,7 +514,7 @@ export namespace InitialSetup {
'configFilePath.$': '$.configFilePath',
'configCommitId.$': '$.configCommitId',
},
resultPath: 'DISCARD',
resultPath: '$.installerVersion',
});

const codeBuildStateMachine = new sfn.StateMachine(this, `${props.acceleratorPrefix}CodeBuild_sm`, {
Expand All @@ -534,6 +534,7 @@ export namespace InitialSetup {
'CONFIG_COMMIT_ID.$': '$.configCommitId',
'ACCELERATOR_BASELINE.$': '$.baseline',
'CONFIG_ROOT_FILE_PATH.$': '$.configRootFilePath',
'INSTALLER_VERSION.$': '$.installerVersion',
ACCELERATOR_PIPELINE_ROLE_NAME: pipelineRole.roleName,
ACCELERATOR_STATE_MACHINE_NAME: props.stateMachineName,
CONFIG_BRANCH_NAME: props.configBranchName,
Expand Down
12 changes: 8 additions & 4 deletions src/core/runtime/src/enable-trusted-access-for-services-step.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@ import { IAM } from '@aws-accelerator/common/src/aws/iam';
import { Account } from '@aws-accelerator/common-outputs/src/accounts';
import { LoadConfigurationInput } from './load-configuration-step';
import { loadAcceleratorConfig } from '@aws-accelerator/common-config/src/load';
import { SSM } from '@aws-accelerator/common/src/aws/ssm';

interface EnableTrustedAccessForServicesInput extends LoadConfigurationInput {
accounts: Account[];
}

const ssm = new SSM();
export const handler = async (input: EnableTrustedAccessForServicesInput) => {
console.log(`Enable Trusted Access for AWS services within the organization ...`);
console.log(JSON.stringify(input, null, 2));
Expand Down Expand Up @@ -80,8 +82,10 @@ export const handler = async (input: EnableTrustedAccessForServicesInput) => {
await org.registerDelegatedAdministrator(securityAccountId, 'guardduty.amazonaws.com');
console.log('Security account registered as delegated administrator for Guard Duty in the organization.');

return {
status: 'SUCCESS',
statusReason: `Successfully enabled trusted access for AWS services within the organization.`,
};
// Get all the parameter history versions from SSM parameter store
const parameterHistoryList = await ssm.getParameterHistory('/accelerator/version');
// Finding the first entry of the parameter version
const installerVersion = parameterHistoryList.find(p => p.Version === 1);
const installerVersionValue = JSON.parse(installerVersion!.Value!);
return !installerVersionValue.AcceleratorVersion ? '<1.2.1' : installerVersionValue.AcceleratorVersion;
};
96 changes: 49 additions & 47 deletions src/deployments/cdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,12 @@
"synth": "pnpx cdk synth"
},
"devDependencies": {
"@aws-accelerator/cdk-plugin-assume-role": "workspace:^0.0.1",
"@aws-accelerator/deployments-runtime": "workspace:^0.0.1",
"@aws-cdk/assert": "1.46.0",
"@aws-cdk/cfnspec": "1.46.0",
"@aws-cdk/cloud-assembly-schema": "1.46.0",
"@aws-cdk/cx-api": "1.46.0",
"@aws-accelerator/cdk-plugin-assume-role": "workspace:^0.0.1",
"@aws-accelerator/deployments-runtime": "workspace:^0.0.1",
"@types/jest": "25.1.4",
"@types/mri": "^1.1.0",
"@types/node": "12.12.6",
Expand All @@ -31,49 +31,18 @@
"typescript": "3.8.3"
},
"dependencies": {
"@aws-cdk/aws-accessanalyzer": "1.46.0",
"@aws-cdk/aws-autoscaling": "1.46.0",
"@aws-cdk/aws-budgets": "1.46.0",
"@aws-cdk/aws-certificatemanager": "1.46.0",
"@aws-cdk/aws-cloudformation": "1.46.0",
"@aws-cdk/aws-config": "1.46.0",
"@aws-cdk/aws-directoryservice": "1.46.0",
"@aws-cdk/aws-ec2": "1.46.0",
"@aws-cdk/aws-elasticloadbalancingv2": "1.46.0",
"@aws-cdk/aws-guardduty": "1.46.0",
"@aws-cdk/aws-iam": "1.46.0",
"@aws-cdk/aws-kinesis": "1.46.0",
"@aws-cdk/aws-kinesisfirehose": "1.46.0",
"@aws-cdk/aws-kms": "1.46.0",
"@aws-cdk/aws-lambda": "1.46.0",
"@aws-cdk/aws-logs": "1.46.0",
"@aws-cdk/aws-ram": "1.46.0",
"@aws-cdk/aws-route53": "1.46.0",
"@aws-cdk/aws-route53-targets": "1.46.0",
"@aws-cdk/aws-route53resolver": "1.46.0",
"@aws-cdk/aws-s3": "1.46.0",
"@aws-cdk/aws-s3-deployment": "1.46.0",
"@aws-cdk/aws-secretsmanager": "1.46.0",
"@aws-cdk/aws-securityhub": "1.46.0",
"@aws-cdk/aws-sns": "1.46.0",
"@aws-cdk/aws-ssm": "1.46.0",
"@aws-cdk/aws-cloudwatch": "1.46.0",
"@aws-cdk/core": "1.46.0",
"@aws-cdk/custom-resources": "1.46.0",
"@aws-cdk/aws-events": "1.46.0",
"@aws-cdk/aws-stepfunctions": "1.46.0",
"@aws-accelerator/cdk-accelerator": "workspace:^0.0.1",
"@aws-accelerator/cdk-constructs": "workspace:^0.0.1",
"@aws-accelerator/common": "workspace:^0.0.1",
"@aws-accelerator/common-config": "workspace:^0.0.1",
"@aws-accelerator/common-outputs": "workspace:^0.0.1",
"@aws-accelerator/common-types": "workspace:^0.0.1",
"@aws-accelerator/cdk-constructs": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-accept-tgw-peering-attachment": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-acm-import-certificate": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-cfn-sleep": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-cur-report-definition": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-cloud-trail": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-create-tgw-peering-attachment": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-cur-report-definition": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-ds-log-subscription": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-ec2-ebs-default-encryption": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-ec2-image-finder": "workspace:^0.0.1",
Expand All @@ -82,12 +51,23 @@
"@aws-accelerator/custom-resource-ec2-marketplace-subscription-validation": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-ec2-vpn-attachment": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-ec2-vpn-tunnel-options": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-admin-setup": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-create-publish": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-enable-admin": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-get-detector": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-iam-create-role": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-iam-password-policy": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-kms-grant": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-logs-add-subscription-filter": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-logs-log-group": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-logs-metric-filter": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-logs-resource-policy": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-create-member": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-enable": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-enable-admin": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-export-config": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-update-config": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-update-session": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-organization": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-r53-dns-endpoint-ips": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-s3-copy-files": "workspace:^0.0.1",
Expand All @@ -97,26 +77,48 @@
"@aws-accelerator/custom-resource-security-hub-disable-controls": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-security-hub-enable": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-security-hub-send-invites": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-enable-admin": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-create-member": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-enable": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-update-config": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-update-session": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-macie-export-config": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-get-detector": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-enable-admin": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-create-publish": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-guardduty-admin-setup": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-vpc-default-security-group": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-ssm-session-manager-document": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-logs-metric-filter": "workspace:^0.0.1",
"@aws-accelerator/custom-resource-vpc-default-security-group": "workspace:^0.0.1",
"@aws-cdk/aws-accessanalyzer": "1.46.0",
"@aws-cdk/aws-autoscaling": "1.46.0",
"@aws-cdk/aws-budgets": "1.46.0",
"@aws-cdk/aws-certificatemanager": "1.46.0",
"@aws-cdk/aws-cloudformation": "1.46.0",
"@aws-cdk/aws-cloudwatch": "1.46.0",
"@aws-cdk/aws-config": "1.46.0",
"@aws-cdk/aws-directoryservice": "1.46.0",
"@aws-cdk/aws-ec2": "1.46.0",
"@aws-cdk/aws-elasticloadbalancingv2": "1.46.0",
"@aws-cdk/aws-events": "1.46.0",
"@aws-cdk/aws-guardduty": "1.46.0",
"@aws-cdk/aws-iam": "1.46.0",
"@aws-cdk/aws-kinesis": "1.46.0",
"@aws-cdk/aws-kinesisfirehose": "1.46.0",
"@aws-cdk/aws-kms": "1.46.0",
"@aws-cdk/aws-lambda": "1.46.0",
"@aws-cdk/aws-logs": "1.46.0",
"@aws-cdk/aws-ram": "1.46.0",
"@aws-cdk/aws-route53": "1.46.0",
"@aws-cdk/aws-route53-targets": "1.46.0",
"@aws-cdk/aws-route53resolver": "1.46.0",
"@aws-cdk/aws-s3": "1.46.0",
"@aws-cdk/aws-s3-deployment": "1.46.0",
"@aws-cdk/aws-secretsmanager": "1.46.0",
"@aws-cdk/aws-securityhub": "1.46.0",
"@aws-cdk/aws-sns": "1.46.0",
"@aws-cdk/aws-ssm": "1.46.0",
"@aws-cdk/aws-stepfunctions": "1.46.0",
"@aws-cdk/core": "1.46.0",
"@aws-cdk/custom-resources": "1.46.0",
"@types/cfn-response": "^1.0.3",
"@types/semver": "^7.3.3",
"colors": "1.4.0",
"constructs": "2.0.1",
"generate-password": "1.5.1",
"io-ts": "2.1.2",
"io-ts-types": "0.5.6",
"pascal-case": "^3.1.1",
"semver": "^7.3.2",
"tempy": "0.5.0"
},
"jest": {
Expand Down
3 changes: 2 additions & 1 deletion src/deployments/cdk/src/apps/phase-1.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
throw new Error(`Cannot find mandatory primary account ${masterAccountKey}`);
}

const { acceleratorName } = context;
const { acceleratorName, installerVersion } = context;
// Find the central bucket in the outputs
const centralBucket = CentralBucketOutput.getBucket({
accountStacks,
Expand Down Expand Up @@ -231,6 +231,7 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
vpcConfigs: acceleratorConfig.getVpcConfigs(),
outputs,
acceleratorName,
installerVersion,
});

const pcxConfig = vpcConfig.pcx;
Expand Down
2 changes: 2 additions & 0 deletions src/deployments/cdk/src/apps/phase-2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,8 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
vpcId: vpcOutput.vpcId,
accountKey,
vpcConfigs,
sharedAccountKey,
installerVersion: context.installerVersion,
});

const accountId = getAccountId(accounts, accountKey);
Expand Down
1 change: 1 addition & 0 deletions src/deployments/cdk/src/apps/phase-3.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
outputs,
vpcs: allVpcs,
centralBucket,
context,
});

// Deploy Security Hub Step-2
Expand Down
1 change: 1 addition & 0 deletions src/deployments/cdk/src/apps/phase-5.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
userSecrets,
accountKey,
serviceLinkedRoleArn: madAutoScalingRoleOutput.roleArn,
installerVersion: context.installerVersion,
});
adUsersAndGroups.node.addDependency(keyPair);
}
Expand Down
3 changes: 3 additions & 0 deletions src/deployments/cdk/src/common/ad-users-groups.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ export interface ADUsersAndGroupsProps extends cdk.StackProps {
userSecrets: UserSecret[];
accountKey: string;
serviceLinkedRoleArn: string;
installerVersion: string;
}

export interface UserSecret {
Expand Down Expand Up @@ -50,6 +51,7 @@ export class ADUsersAndGroups extends cdk.Construct {
userSecrets,
accountKey,
serviceLinkedRoleArn,
installerVersion,
} = props;

// Creating AD Users command
Expand Down Expand Up @@ -102,6 +104,7 @@ export class ADUsersAndGroups extends cdk.Construct {
accountKey,
vpcId,
vpcName,
installerVersion,
});

const stack = AcceleratorStack.of(this);
Expand Down
15 changes: 13 additions & 2 deletions src/deployments/cdk/src/common/security-group.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ import * as ec2 from '@aws-cdk/aws-ec2';
import * as config from '@aws-accelerator/common-config/src';
import * as constructs from '@aws-accelerator/cdk-constructs/src/vpc';
import { NonEmptyString } from 'io-ts-types/lib/NonEmptyString';
import * as sv from 'semver';

export interface NameToSecurityGroupMap {
[key: string]: ec2.CfnSecurityGroup;
Expand Down Expand Up @@ -49,7 +50,11 @@ export interface SecurityGroupProps {
*/
vpcName: string;

installerVersion: string;

vpcConfigs?: config.ResolvedVpcConfig[];

sharedAccountKey?: string;
}

export class SecurityGroup extends cdk.Construct {
Expand All @@ -58,12 +63,18 @@ export class SecurityGroup extends cdk.Construct {

constructor(parent: cdk.Construct, name: string, props: SecurityGroupProps) {
super(parent, name);
const { securityGroups, accountKey, vpcId, vpcConfigs, vpcName } = props;
const { securityGroups, accountKey, vpcId, vpcConfigs, vpcName, installerVersion, sharedAccountKey } = props;

const isUpdateDescription =
sv.clean(installerVersion) === null ? sv.satisfies('1.2.1', installerVersion) : sv.gte(installerVersion, '1.2.1');

// const securityGroups = vpcConfig['security-groups'];
// Create all security groups
for (const securityGroup of securityGroups || []) {
const groupName = `${securityGroup.name}_sg`;
const groupDescription = `${accountKey} ${vpcName} Mgmt Security Group`;
const groupDescription = isUpdateDescription
? `${sharedAccountKey || accountKey} ${vpcName} Security Group`
: `${accountKey} ${vpcName} Mgmt Security Group`;
const sg = new ec2.CfnSecurityGroup(this, securityGroup.name, {
vpcId,
groupDescription,
Expand Down
3 changes: 3 additions & 0 deletions src/deployments/cdk/src/common/vpc.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ export class AzSubnets {
export interface VpcProps extends VpcCommonProps {
outputs: StackOutput[];
acceleratorName: string;
installerVersion: string;
}

export class VpcStack extends NestedStack {
Expand Down Expand Up @@ -146,6 +147,7 @@ export class Vpc extends cdk.Construct implements constructs.Vpc {
vpcConfigs,
accountStacks,
acceleratorName,
installerVersion,
} = props.vpcProps;
const vpcName = props.vpcProps.vpcConfig.name;

Expand Down Expand Up @@ -510,6 +512,7 @@ export class Vpc extends cdk.Construct implements constructs.Vpc {
vpcId: this.vpcId,
accountKey,
vpcConfigs: vpcConfigs!,
installerVersion,
});
}

Expand Down
17 changes: 15 additions & 2 deletions src/deployments/cdk/src/deployments/rsyslog/step-2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,19 @@ import { checkAccountWarming } from '../account-warming/outputs';
import { StackOutput } from '@aws-accelerator/common-outputs/src/stack-output';
import { ImageIdOutputFinder } from '@aws-accelerator/common-outputs/src/ami-output';
import { IamRoleOutputFinder } from '@aws-accelerator/common-outputs/src/iam-role';
import { Context } from '../../utils/context';

export interface RSysLogStep1Props {
accountStacks: AccountStacks;
config: AcceleratorConfig;
outputs: StackOutput[];
vpcs: Vpc[];
centralBucket: s3.IBucket;
context: Context;
}

export async function step2(props: RSysLogStep1Props) {
const { accountStacks, config, outputs, vpcs, centralBucket } = props;
const { accountStacks, config, outputs, vpcs, centralBucket, context } = props;

for (const [accountKey, accountConfig] of config.getMandatoryAccountConfigs()) {
const rsyslogConfig = accountConfig.deployments?.rsyslog;
Expand All @@ -52,7 +54,16 @@ export async function step2(props: RSysLogStep1Props) {

const rsyslogTargetGroup = createTargetGroupForInstance(accountStack, 'RsyslogTG', vpc.id);
createNlb(accountKey, rsyslogConfig, accountStack, vpc, rsyslogTargetGroup.ref);
createAsg(accountKey, rsyslogConfig, accountStack, outputs, vpc, rsyslogTargetGroup.ref, centralBucket.bucketName);
createAsg(
accountKey,
rsyslogConfig,
accountStack,
outputs,
vpc,
rsyslogTargetGroup.ref,
centralBucket.bucketName,
context.installerVersion,
);
}
}

Expand Down Expand Up @@ -107,6 +118,7 @@ export function createAsg(
vpc: Vpc,
targetGroupArn: string,
centralBucketName: string,
installerVersion: string,
) {
const instanceSubnetIds: string[] = [];
for (const subnetConfig of rsyslogConfig['app-subnets']) {
Expand Down Expand Up @@ -158,6 +170,7 @@ export function createAsg(
accountKey,
vpcId: vpc.id,
vpcName: vpc.name,
installerVersion,
});
const securityGroupId = securityGroup.securityGroups[0].id;

Expand Down
2 changes: 2 additions & 0 deletions src/deployments/cdk/src/utils/context.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ export interface Context {
configBranch: string;
acceleratorStateMachineName: string;
configRootFilePath: string;
installerVersion: string;
}

export function loadContext(): Context {
Expand All @@ -39,5 +40,6 @@ export function loadContext(): Context {
configFilePath: process.env.CONFIG_FILE_PATH!,
acceleratorStateMachineName: process.env.ACCELERATOR_STATE_MACHINE_NAME!,
configRootFilePath: process.env.CONFIG_ROOT_FILE_PATH!,
installerVersion: process.env.INSTALLER_VERSION!,
};
}
Loading