Add migration guide for CIS AWS 1.3.0 #386

infraredgirl · 2021-01-06T16:40:40Z

https://gruntwork.atlassian.net/browse/IAC-1641

Remaining work:

@marinalimeira: NACL deploy instructions
@robmorgan: ebs-encryption-multi-region deploy instructions
@brikis98: Update Acme CIS repos and mention that here in the guide
Everyone: Double check the compatibility matrix - make sure all the versions are correct
Everyone: Sanity check the entire document before merge

netlify · 2021-01-06T16:41:55Z

Deploy preview for keen-clarke-470db9 ready!

Built with commit 8ada2d5

https://deploy-preview-386--keen-clarke-470db9.netlify.app

infraredgirl · 2021-01-06T16:45:06Z

Having the version number in the title makes the guide not appear in the list of guides - I guess this is a bug.

bwhaley

Great start! Left a few comments for your consideration on grammar/use of wording. Looking forward to doing a complete review!

_posts/2021-01-06-how-to-update-to-cis-13.adoc

brikis98 · 2021-01-07T09:36:24Z

Having the version number in the title makes the guide not appear in the list of guides - I guess this is a bug.

Yes, this is a known issue. I think something in the code struggles with non alphanumeric characters (e.g., decimal points)? @eak12913 @oredavids Any chance of getting this fixed, as it's hard to publish a guide for CIS v1.3.0 without using decimal points 😁

brikis98

Thanks for putting this together!

Having seen this, I think the right thing to do is to update the Acme CIS repos too, so customers have a concrete upgrade example to look at. We need to add that to the Jira epic.

_posts/2021-01-06-how-to-update-to-cis-13.adoc

ina-stoyanova · 2021-01-07T13:48:27Z

Thanks for making a start on this @infraredgirl 🙂 I"m having a look to add bits about IAM access analyzer now

eak12913 · 2021-01-07T13:53:02Z

Having the version number in the title makes the guide not appear in the list of guides - I guess this is a bug.

Yes, this is a known issue. I think something in the code struggles with non alphanumeric characters (e.g., decimal points)? @eak12913 @oredavids Any chance of getting this fixed, as it's hard to publish a guide for CIS v1.3.0 without using decimal points 😁

Would this be a blocker for you folks? If at all possible - I'd prefer to not switch context right now but I am worried that this will hold y'all up.

The last time I looked at the code it was somewhat of a tangled mess of wires with at some amount of assumptions baked in about what Jekyll will do too (in addition to whatever our mess of logic is doing). In order to dive into that - I'd have to page out what I'm working on now.

This will need to be updated once we've updated the ACME repos for the Ref Arch.

brikis98 · 2021-01-08T12:54:23Z

Having the version number in the title makes the guide not appear in the list of guides - I guess this is a bug.

Yes, this is a known issue. I think something in the code struggles with non alphanumeric characters (e.g., decimal points)? @eak12913 @oredavids Any chance of getting this fixed, as it's hard to publish a guide for CIS v1.3.0 without using decimal points 😁

Would this be a blocker for you folks? If at all possible - I'd prefer to not switch context right now but I am worried that this will hold y'all up.

The last time I looked at the code it was somewhat of a tangled mess of wires with at some amount of assumptions baked in about what Jekyll will do too (in addition to whatever our mess of logic is doing). In order to dive into that - I'd have to page out what I'm working on now.

I think the guide needs to have "1.2" and "1.3" in the title. If there's some workaround way to get that without forcing you to context switch, we're happy to use that... But otherwise, this won't have the right title, or the right SEO benefits, and changing it later would change the URL, which would require redirects, which we'd prob forget, leading to 404s... So, yea, I think we need some way to have the proper title on this guide.

ina-stoyanova · 2021-01-08T14:50:00Z

Having the version number in the title makes the guide not appear in the list of guides - I guess this is a bug.

Yes, this is a known issue. I think something in the code struggles with non alphanumeric characters (e.g., decimal points)? @eak12913 @oredavids Any chance of getting this fixed, as it's hard to publish a guide for CIS v1.3.0 without using decimal points 😁

Would this be a blocker for you folks? If at all possible - I'd prefer to not switch context right now but I am worried that this will hold y'all up.
The last time I looked at the code it was somewhat of a tangled mess of wires with at some amount of assumptions baked in about what Jekyll will do too (in addition to whatever our mess of logic is doing). In order to dive into that - I'd have to page out what I'm working on now.

I think the guide needs to have "1.2" and "1.3" in the title. If there's some workaround way to get that without forcing you to context switch, we're happy to use that... But otherwise, this won't have the right title, or the right SEO benefits, and changing it later would change the URL, which would require redirects, which we'd prob forget, leading to 404s... So, yea, I think we need some way to have the proper title on this guide.

I was curious to have a play around with this bug, and I have to say it's very annoying and unfortunately my lack of experience with Jekyll and playing around didn't really help!

Anyway, I thought I'd share a few things I looked into, and hopefully it could be a very simple fix when combined with more knowledgeable people in how this works!

https://jekyllrb.com/docs/liquid/filters/
https://shopify.github.io/liquid/filters/escape/

Basically, as far as I could gather, none of the ;, ,, ., : characters work, so I assume it's some sort of escaping of them that needs to happen!

eak12913 · 2021-01-08T16:11:28Z

Thanks for taking a look @ina-stoyanova! - I will just finish up a few things and can try to take a look as well. If memory serves me correctly from last time, the problem is somewhere in the interplay between the following things:

The title of the article
The search behavior which is responsible for showing/hiding the main sections on that index page
Scroll-spy - which is a library that's linking up the nav on the left with what's displayed in the main section

There's interplay between these things and the last time I looked - I was able to figure out Jim's issue - but it still didn't solve this one.

If you'd like - we can pair code? I'm no Jekyll expert and only have cursory exposure to this code from the troubleshooting I did on it last time. Otherwise I'll take it up either later today (probably too late for you) or Monday depending on how today's other tasks go.

ina-stoyanova · 2021-01-08T17:04:16Z

Thanks for taking a look @ina-stoyanova! - I will just finish up a few things and can try to take a look as well. If memory serves me correctly from last time, the problem is somewhere in the interplay between the following things:

The title of the article

The search behavior which is responsible for showing/hiding the main sections on that index page

Scroll-spy - which is a library that's linking up the nav on the left with what's displayed in the main section

There's interplay between these things and the last time I looked - I was able to figure out Jim's issue - but it still didn't solve this one.

If you'd like - we can pair code? I'm no Jekyll expert and only have cursory exposure to this code from the troubleshooting I did on it last time. Otherwise I'll take it up either later today (probably too late for you) or Monday depending on how today's other tasks go.

Yeah - I'd love to pair code if it's on Monday. Although, it's not my domain - it would certainly be useful to pair code with you! Either way - thanks for filling in my gaps :) I knew there must be more to it, as simple fixes obviously didn't work 😜Loads to learn as always! Feel free to pick it up whenever's convenient for you - but if Monday, I'll make time to work with you :)

ina-stoyanova · 2021-01-11T10:28:29Z

Just trying to understand what's still left on this PR? Is the following correct?

[x] Fix title bug (not showing '1.3' in the guide title)
[ ] Add section for NACL
[x] Add section for IAM access analyzer
[ ] Add section for updates to existing modules:
- [ ] EBS encryption
- [ ] Add section for object-level logging functionality
- [ ] Add section for log metrics & alarms
- [ ] Add section S3 bucket (using private buckets)

N.B.: This PR could be reviewed, but not merged until this is also done: https://gruntwork.atlassian.net/browse/IAC-1683

infraredgirl · 2021-01-11T14:41:13Z

Do we need to have dedicated section for the items that were just upgrades to the existing modules? I understand the need for dedicated sections for new modules, but I'm not sure that e.g. the S3 bucket upgrades (which are just refactors to use a different modules under the hood) need a section each?

…n like: period, comma, semicolon (etc...)

eak12913 · 2021-01-11T15:52:55Z

@infraredgirl Could you please try to change your title to what you originally wanted it to be and double check. @ina-stoyanova and I have fixed the issue and we believe that it should no longer be a problem.

This reverts commit 3aba818.

infraredgirl · 2021-01-11T16:24:15Z

@infraredgirl Could you please try to change your title to what you originally wanted it to be and double check. @ina-stoyanova and I have fixed the issue and we believe that it should no longer be a problem.

Works now! Thanks so much for the fix!

eak12913 · 2021-01-11T16:27:43Z

I was originally dreading this one because I thought it was going to be a can of worms. It ended up being pretty straight forward and to correct my earlier assumption, had nothing to do with ScrollSpy or the search logic. The issue was with the id property. We were basing the id property off of the title of the article but were not slugifying.

brikis98 · 2021-01-25T12:15:21Z

Updated for Acme CIS repos are here:
gruntwork-io/cis-infrastructure-modules-acme#6
gruntwork-io/cis-infrastructure-live-acme#8

Should we make a mention of these in the guide?

Yes! We should make these a first-class part of the guide: "See the Acme CIS examples to see what the code changes may look like."

infraredgirl · 2021-01-25T13:04:45Z

Updated for Acme CIS repos are here:
gruntwork-io/cis-infrastructure-modules-acme#6
gruntwork-io/cis-infrastructure-live-acme#8

Should we make a mention of these in the guide?

Yes! We should make these a first-class part of the guide: "See the Acme CIS examples to see what the code changes may look like."

Added in e80a4ee. I've linked directly to the update PRs - if there's a better location to link to please LMK!

infraredgirl · 2021-01-25T13:13:14Z

I think we can open this up for reviews!

brikis98

Getting super close!

_posts/2021-01-06-how-to-update-to-cis-13.adoc

brikis98 · 2021-01-25T19:13:06Z

_posts/2021-01-06-how-to-update-to-cis-13.adoc

+  allow_administrative_remote_access_cidrs_private_app_subnets         = { app_vpc_cidrs = module.app_vpc.vpc_cidr_block }
+  allow_administrative_remote_access_cidrs_private_persistence_subnets = { app_vpc_cidrs = module.app_vpc.vpc_cidr_block }
+}
+----


If you're switching from vpc-app-network-acls in module-vpc to this new one, you'll also need to run state mv commands! As all the original resources are now nested one module deeper.

script here: https://github.com/gruntwork-io/cis-infrastructure-modules-acme/pull/7

_posts/2021-01-06-how-to-update-to-cis-13.adoc

brikis98 · 2021-01-26T15:18:30Z

Yup, that's what I meant!

…

On Tue, Jan 26, 2021 at 3:04 PM Ana Krivokapić ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In _posts/2021-01-06-how-to-update-to-cis-13.adoc <#386 (comment)> : > +Please follow the steps below to upgrade from the version 1.2.0 to 1.3.0 of the Benchmark. To see the actual relevant code +changes, please refer to the Acme CIS examples gruntwork-io/cis-infrastructure-modules-acme#6[here] +and gruntwork-io/cis-infrastructure-live-acme#8[here]. By call-out, do you mean a NOTE block? If so, I've updated it in 801a743 <801a743>. LMK if you meant something else! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#386 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFNZZH37L5X3R4RQJYOZLLS33KW5ANCNFSM4VXYZMQA> .

_posts/2021-01-06-how-to-update-to-cis-13.adoc

Co-authored-by: Ina Stoyanova <ina@gruntwork.io>

_posts/2021-01-06-how-to-update-to-cis-13.adoc

ina-stoyanova · 2021-02-02T16:31:15Z

Hey @marinalimeira @infraredgirl I believe with the last few comments, this is ready to go?

brikis98

This is also good to go after a few minor wording / typo tweaks!

_posts/2021-01-06-how-to-update-to-cis-13.adoc

Co-authored-by: Yevgeniy Brikman <brikis98@users.noreply.github.com>

infraredgirl · 2021-02-03T13:26:28Z

Woohoo!

Many thanks to everyone who contributed to this PR, both in terms of content and reviews!

Merging now!

Add migration guide for CIS AWS 1.3.0

1dc2b1c

infraredgirl requested review from eak12913, josh-padnick, oredavids and tsmit291 as code owners January 6, 2021 16:40

Fix title

3aba818

bwhaley reviewed Jan 6, 2021

View reviewed changes

infraredgirl added 2 commits January 6, 2021 18:21

Add relevant repos and manual steps (Ana)

54a97dc

Address review comments

e4d1550

brikis98 reviewed Jan 7, 2021

View reviewed changes

infraredgirl added 2 commits January 7, 2021 12:28

Fix wording

eccee63

Add a bullet list of new recommendations

ad9272c

Ina Stoyanova added 2 commits January 7, 2021 16:26

Updating reference table for IAM Access Analyzer

c6373e9

Adding steps for deploying the IAM Access Analyzer

f914505

This will need to be updated once we've updated the ACME repos for the Ref Arch.

Fixed issue where titles for guides could not have special punctuatio…

3054a82

…n like: period, comma, semicolon (etc...)

Revert "Fix title"

4cbe2c5

This reverts commit 3aba818.

Mention ACME updates

e80a4ee

marinalimeira and others added 2 commits January 25, 2021 14:08

Word improvement + upgrade example for cis nacl

957bb16

s/ACME/Acme

70264d7

infraredgirl changed the title ~~[WIP] Add migration guide for CIS AWS 1.3.0~~ Add migration guide for CIS AWS 1.3.0 Jan 25, 2021

brikis98 reviewed Jan 25, 2021

View reviewed changes

marinalimeira and others added 4 commits January 26, 2021 10:22

Update wording around |v|version

71af098

Fix the version/version

2201b06

Fix the CIS/CIS AWS

a8f9b6f

Put Acme examples in a NOTE block

801a743

ina-stoyanova reviewed Feb 2, 2021

View reviewed changes

_posts/2021-01-06-how-to-update-to-cis-13.adoc Outdated Show resolved Hide resolved

ina-stoyanova reviewed Feb 2, 2021

View reviewed changes

_posts/2021-01-06-how-to-update-to-cis-13.adoc Show resolved Hide resolved

Update version of terraform-aws-vpc

cc6d5ef

Co-authored-by: Ina Stoyanova <ina@gruntwork.io>

ina-stoyanova reviewed Feb 2, 2021

View reviewed changes

_posts/2021-01-06-how-to-update-to-cis-13.adoc Show resolved Hide resolved

ina-stoyanova reviewed Feb 2, 2021

View reviewed changes

_posts/2021-01-06-how-to-update-to-cis-13.adoc Show resolved Hide resolved

ina-stoyanova reviewed Feb 2, 2021

View reviewed changes

_posts/2021-01-06-how-to-update-to-cis-13.adoc Show resolved Hide resolved

NACL rules docs fixes

ded36fa

josh-padnick removed their request for review February 2, 2021 17:22

brikis98 previously approved these changes Feb 3, 2021

View reviewed changes

Apply suggestions from code review

7bd245b

Co-authored-by: Yevgeniy Brikman <brikis98@users.noreply.github.com>

infraredgirl dismissed brikis98’s stale review via 7bd245b February 3, 2021 11:26

Add links to the main guide

8ada2d5

brikis98 approved these changes Feb 3, 2021

View reviewed changes

infraredgirl merged commit 1491b6c into master Feb 3, 2021

robmorgan deleted the cis-upgrade-guide branch February 3, 2021 13:56

Uh oh!

Add migration guide for CIS AWS 1.3.0 #386

Add migration guide for CIS AWS 1.3.0 #386

Uh oh!

Conversation

infraredgirl commented Jan 6, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Jan 6, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

infraredgirl commented Jan 6, 2021

Uh oh!

bwhaley left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brikis98 commented Jan 7, 2021

Uh oh!

brikis98 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ina-stoyanova commented Jan 7, 2021

Uh oh!

eak12913 commented Jan 7, 2021

Uh oh!

brikis98 commented Jan 8, 2021

Uh oh!

ina-stoyanova commented Jan 8, 2021

Uh oh!

eak12913 commented Jan 8, 2021

Uh oh!

ina-stoyanova commented Jan 8, 2021

Uh oh!

ina-stoyanova commented Jan 11, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

infraredgirl commented Jan 11, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eak12913 commented Jan 11, 2021

Uh oh!

infraredgirl commented Jan 11, 2021

Uh oh!

eak12913 commented Jan 11, 2021

Uh oh!

brikis98 commented Jan 25, 2021

Uh oh!

infraredgirl commented Jan 25, 2021

Uh oh!

infraredgirl commented Jan 25, 2021

Uh oh!

brikis98 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brikis98 Jan 25, 2021

Choose a reason for hiding this comment

Uh oh!

marinalimeira Feb 2, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

brikis98 commented Jan 26, 2021 via email

Uh oh!

Uh oh!

Uh oh!

infraredgirl commented Jan 6, 2021 •

edited

Loading

netlify bot commented Jan 6, 2021 •

edited

Loading

ina-stoyanova commented Jan 11, 2021 •

edited

Loading

infraredgirl commented Jan 11, 2021 •

edited

Loading