Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Added Deny for CreateLogGroup action in EKS cluster role #1594

Merged
merged 3 commits into from
Nov 2, 2021
Merged

fix: Added Deny for CreateLogGroup action in EKS cluster role #1594

merged 3 commits into from
Nov 2, 2021

Conversation

haarchri
Copy link
Contributor

@haarchri haarchri commented Sep 21, 2021 •
edited
Loading

Signed-off-by: Christopher Haar chhaar30@googlemail.com

PR o'clock

Description

cloudwatch log group now gets auto destroyed with new iam policy deny for create log group in eks cluster role

Fixes: #920

Checklist

@haarchri haarchri mentioned this pull request Sep 21, 2021
Closed
4 tasks
@stale
Copy link

stale bot commented Oct 21, 2021

This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
To track this PR (even if closed), please open a corresponding issue if one does not already exist.

@stale stale bot added the stale label Oct 21, 2021
navaati
navaati approved these changes Oct 21, 2021
View reviewed changes
Copy link

@navaati navaati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, this does fix #920, thanks for writing this patch.

main.tf
actions = [
"logs:CreateLogGroup"
]
resources = ["*"]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you have a simple way to do that, you could restrain the policy to just the log group that would be created, to make the change even smaller. Not strictly necessary tho.

@stale stale bot removed the stale label Oct 21, 2021
@daroga0002
Copy link
Contributor

@haarchri please correct tittle of PR to fix: added deny log group in eks cluster role as CI will fail.

Also seems you using different version of terraform-docs which made some changes in lines 137-147, if possible revert those lines to original.

@haarchri haarchri changed the title fix(cw-loggroup): added deny log group in eks cluster role fix: added deny log group in eks cluster role Nov 2, 2021
@haarchri
fix(cw-loggroup): added deny in eks cluster role to fix cw-loggroup r…
3cace1f 
…ecreate in cleanup/deletion

Signed-off-by: haarchri <chhaar30@googlemail.com>
@haarchri
Copy link
Contributor Author

haarchri commented Nov 2, 2021

@daroga0002 rebased and changed readme

daroga0002
daroga0002 approved these changes Nov 2, 2021
View reviewed changes
Copy link
Contributor

@daroga0002 daroga0002 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@haarchri thank your for your contribution 🎉

@daroga0002
Copy link
Contributor

@antonbabenko lets merge this (I will let you know when we can make release as I still looking into few other PRs)

@antonbabenko antonbabenko changed the title fix: added deny log group in eks cluster role fix: Added Deny for logs:CreateLogGroup action in EKS cluster role Nov 2, 2021
@antonbabenko antonbabenko changed the title fix: Added Deny for logs:CreateLogGroup action in EKS cluster role fix: Added Deny for CreateLogGroup action in EKS cluster role Nov 2, 2021
@antonbabenko antonbabenko merged commit 6959b9b into terraform-aws-modules:master Nov 2, 2021
@Nuru Nuru mentioned this pull request Nov 2, 2021
Closed
@nitrocode nitrocode mentioned this pull request Nov 4, 2021
Merged
antonbabenko pushed a commit that referenced this pull request Nov 22, 2021
@semantic-release-bot
chore(release): version 17.24.0 [skip ci]
e90c877 
# [17.24.0](v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([#1594](#1594)) ([6959b9b](6959b9b))
* update CI/CD process to enable auto-release workflow ([#1698](#1698)) ([b876ff9](b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([#1614](#1614)) ([b7539dc](b7539dc))
* Removed ng_depends_on variable and related hack ([#1672](#1672)) ([56e93d7](56e93d7))
@antonbabenko
Copy link
Member

This PR is included in version 17.24.0 🎉

spr-mweber3 pushed a commit to spring-media/terraform-aws-eks that referenced this pull request Dec 1, 2021
@haarchri @spr-mweber3
fix: Added Deny for CreateLogGroup action in EKS cluster role (terraf…
1aa5fe0 
…orm-aws-modules#1594)
spr-mweber3 pushed a commit to spring-media/terraform-aws-eks that referenced this pull request Dec 1, 2021
@semantic-release-bot @spr-mweber3
chore(release): version 17.24.0 [skip ci]
dfde867 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([terraform-aws-modules#1594](terraform-aws-modules#1594)) ([6959b9b](terraform-aws-modules@6959b9b))
* update CI/CD process to enable auto-release workflow ([terraform-aws-modules#1698](terraform-aws-modules#1698)) ([b876ff9](terraform-aws-modules@b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([terraform-aws-modules#1614](terraform-aws-modules#1614)) ([b7539dc](terraform-aws-modules@b7539dc))
* Removed ng_depends_on variable and related hack ([terraform-aws-modules#1672](terraform-aws-modules#1672)) ([56e93d7](terraform-aws-modules@56e93d7))
bryantbiggs pushed a commit to bryantbiggs/terraform-aws-eks that referenced this pull request Dec 13, 2021
@semantic-release-bot @bryantbiggs
chore(release): version 17.24.0 [skip ci]
15d7c9f 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([terraform-aws-modules#1594](terraform-aws-modules#1594)) ([6959b9b](terraform-aws-modules@6959b9b))
* update CI/CD process to enable auto-release workflow ([terraform-aws-modules#1698](terraform-aws-modules#1698)) ([b876ff9](terraform-aws-modules@b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([terraform-aws-modules#1614](terraform-aws-modules#1614)) ([b7539dc](terraform-aws-modules@b7539dc))
* Removed ng_depends_on variable and related hack ([terraform-aws-modules#1672](terraform-aws-modules#1672)) ([56e93d7](terraform-aws-modules@56e93d7))
bryantbiggs pushed a commit to bryantbiggs/terraform-aws-eks that referenced this pull request Dec 13, 2021
@semantic-release-bot @bryantbiggs
chore(release): version 17.24.0 [skip ci]
32a1803 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([terraform-aws-modules#1594](terraform-aws-modules#1594)) ([6959b9b](terraform-aws-modules@6959b9b))
* update CI/CD process to enable auto-release workflow ([terraform-aws-modules#1698](terraform-aws-modules#1698)) ([b876ff9](terraform-aws-modules@b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([terraform-aws-modules#1614](terraform-aws-modules#1614)) ([b7539dc](terraform-aws-modules@b7539dc))
* Removed ng_depends_on variable and related hack ([terraform-aws-modules#1672](terraform-aws-modules#1672)) ([56e93d7](terraform-aws-modules@56e93d7))
@JoelOtter
Copy link

To anyone landing on this confused like I was about whether this breaks compatibility with Fluent Bit: the IAM role you want to attach the CloudWatch policy to is the node role, not the cluster role.

@bryantbiggs bryantbiggs mentioned this pull request Mar 29, 2022
Merged
3 tasks
baibailiha added a commit to baibailiha/terraform-aws-eks that referenced this pull request Sep 13, 2022
@baibailiha @semantic-release-bot
chore(release): version 17.24.0 [skip ci]
1cb3060 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([#1594](terraform-aws-modules/terraform-aws-eks#1594)) ([d240238](terraform-aws-modules/terraform-aws-eks@d240238))
* update CI/CD process to enable auto-release workflow ([#1698](terraform-aws-modules/terraform-aws-eks#1698)) ([cd93161](terraform-aws-modules/terraform-aws-eks@cd93161))

### Features

* Add ability to define custom timeout for fargate profiles ([#1614](terraform-aws-modules/terraform-aws-eks#1614)) ([43b675b](terraform-aws-modules/terraform-aws-eks@43b675b))
* Removed ng_depends_on variable and related hack ([#1672](terraform-aws-modules/terraform-aws-eks#1672)) ([e610b83](terraform-aws-modules/terraform-aws-eks@e610b83))
@github-actions
Copy link

github-actions bot commented Nov 9, 2022

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 9, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@navaati navaati navaati approved these changes

@daroga0002 daroga0002 daroga0002 approved these changes

@antonbabenko antonbabenko Awaiting requested review from antonbabenko

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Cloudwatch Log Group created with options does not get auto destroyed
5 participants
@haarchri @daroga0002 @antonbabenko @JoelOtter @navaati