Added terraform files #4
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
defsec found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.
modules/api_gateway/main.tf
Outdated
| resource "aws_api_gateway_stage" "this" { | ||
| deployment_id = aws_api_gateway_deployment.this.id | ||
| rest_api_id = aws_api_gateway_rest_api.this.id | ||
| stage_name = var.stage | ||
| } |
Check warning
Code scanning / defsec
API Gateway stages for V1 and V2 should have access logging enabled Warning
| resource "aws_dynamodb_table" "this" { | ||
| name = var.name | ||
| billing_mode = var.billing_mode.mode | ||
| read_capacity = var.billing_mode.mode == "PROVISIONED" ? var.billing_mode.read_capacity : null | ||
| write_capacity = var.billing_mode.mode == "PROVISIONED" ? var.billing_mode.write_capacity : null | ||
| hash_key = var.hash_key.name | ||
| range_key = var.range_key.name | ||
|
|
||
| attribute { | ||
| name = var.hash_key.name | ||
| type = var.hash_key.type | ||
| } | ||
|
|
||
| attribute { | ||
| name = var.range_key.name | ||
| type = var.range_key.type | ||
| } | ||
|
|
||
| server_side_encryption { | ||
| enabled = true | ||
| } | ||
|
|
||
| } |
Check warning
Code scanning / defsec
Point in time recovery should be enabled to protect DynamoDB table Warning
| resource "aws_s3_bucket" "www" { | ||
| bucket = local.www_frontend_bucket_name | ||
| # object_lock_enabled = true | ||
| force_destroy = true | ||
|
|
||
| tags = { | ||
| type = "frontend" | ||
| } | ||
| } |
Check warning
Code scanning / defsec
S3 Data should be versioned Warning
| resource "aws_s3_bucket" "frontend" { | ||
| bucket = var.frontend_name | ||
| # object_lock_enabled = true | ||
| force_destroy = true | ||
|
|
||
|
|
||
| tags = { | ||
| type = "frontend" | ||
| } | ||
| } |
Check warning
Code scanning / defsec
S3 Data should be versioned Warning
| resource "aws_s3_bucket_server_side_encryption_configuration" "frontend" { | ||
| bucket = aws_s3_bucket.frontend.id | ||
|
|
||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| sse_algorithm = "AES256" | ||
| } | ||
| } | ||
| } |
Check failure
Code scanning / defsec
S3 encryption should use Customer Managed Keys Error
| server_side_encryption { | ||
| enabled = true | ||
| } |
Check notice
Code scanning / defsec
DynamoDB tables should use at rest encryption with a Customer Managed Key Note
| resource "aws_s3_bucket_server_side_encryption_configuration" "www" { | ||
| bucket = aws_s3_bucket.www.id | ||
|
|
||
| rule { | ||
| apply_server_side_encryption_by_default { | ||
| sse_algorithm = "AES256" | ||
| } | ||
| } | ||
| } |
Check failure
Code scanning / defsec
S3 encryption should use Customer Managed Keys Error
also applied recursive formatting.
| } | ||
| } | ||
|
|
||
| # resource "aws_iam_role" "example_role" { |
There was a problem hiding this comment.
Mas alla de que esta comentado, no esta bien que pongan el iam role junto con el provider
| @@ -0,0 +1,26 @@ | |||
|
|
|||
| data "aws_availability_zones" "available" { | |||
There was a problem hiding this comment.
Tienen un datasource en locals, esto iria en el archivo datasources
|
|
||
| security_groups_prefix = "${local.name}-security-group" | ||
|
|
||
| frontend_bucket_name = "dev.condor.com" |
There was a problem hiding this comment.
Esto debería ser una variable al igual que los campos que estan por debajo
| methods = [ | ||
| { | ||
| path = "reports" | ||
| methods = [ |
There was a problem hiding this comment.
Esto podría haber estado definido en locals.
| @@ -0,0 +1,39 @@ | |||
| resource "aws_s3_bucket" "this" { | |||
There was a problem hiding this comment.
Si bien no esta mal lo que hacen de tener dos modulos, uno para logging y uno para el front, idealmente tendrían que tener un modulo s3 lo suficientemente customizable para que puedan funcionar ambas necesidades con el mismo módulo.
| @@ -0,0 +1,133 @@ | |||
| // condor.com bucket | |||
There was a problem hiding this comment.
Venían llamando a todos los resources this, que suele ser convención, y aca cambiaron a llamar todo a frontend.
| @@ -0,0 +1,28 @@ | |||
| resource "aws_lambda_function" "index" { | |||
There was a problem hiding this comment.
Acá tambien, dejaron de usar la convención "this"
| @@ -0,0 +1,9 @@ | |||
| terraform { | |||
| required_version = "1.5.7" | |||
There was a problem hiding this comment.
Aca tienen que poner >= porque sino es esa versión específica
No description provided.