fleet-terraform/main.tf at main · fleetdm/fleet-terraform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
locals {
  vpc_flow_log_cloudwatch_log_group_cmk_enabled    = var.vpc.flow_log_cloudwatch_log_group_kms.cmk_enabled
  vpc_flow_log_cloudwatch_log_group_create_kms_key = var.vpc.enable_flow_log == true && var.vpc.create_flow_log_cloudwatch_log_group == true && local.vpc_flow_log_cloudwatch_log_group_cmk_enabled == true && var.vpc.flow_log_cloudwatch_log_group_kms.kms_key_arn == null
  vpc_flow_log_cloudwatch_log_group_kms_key_arn = var.vpc.enable_flow_log == true && var.vpc.create_flow_log_cloudwatch_log_group == true && local.vpc_flow_log_cloudwatch_log_group_cmk_enabled == true ? (
    var.vpc.flow_log_cloudwatch_log_group_kms.kms_key_arn != null ? var.vpc.flow_log_cloudwatch_log_group_kms.kms_key_arn : aws_kms_key.vpc_flow_log_cloudwatch_log_group[0].arn
  ) : null
  kms_base_policy_statements = var.kms_base_policy != null ? var.kms_base_policy : [
    {
      sid    = "EnableRootPermissions"
      effect = "Allow"
      principals = {
        type        = "AWS"
        identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"]
      }
      actions    = ["kms:*"]
      resources  = ["*"]
      conditions = []
    }
  ]
  kms_service_statements = {
    cloudwatch_logs = {
      sid    = "AllowCloudWatchLogsUseOfTheKey"
      effect = "Allow"
      principals = {
        type        = "Service"
        identifiers = ["logs.${data.aws_region.current.id}.amazonaws.com"]
      }
      actions = [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
      ]
      resources  = ["*"]
      conditions = []
    }
  }
}

data "aws_caller_identity" "current" {}
data "aws_partition" "current" {}
data "aws_region" "current" {}

check "kms_base_policy_requires_module_managed_cmk" {
  assert {
    condition = var.kms_base_policy == null || (
      local.vpc_flow_log_cloudwatch_log_group_create_kms_key == true
    )
    error_message = "kms_base_policy is not used by the root module unless this module is creating the VPC flow log CloudWatch log group CMK. When kms_key_arn is provided, external key policies remain caller-managed."
  }
}

# Each source uses its own dynamic "statement" block to avoid Terraform type
# conflicts when concatenating typed variable values with inline literal tuples.
data "aws_iam_policy_document" "vpc_flow_log_cloudwatch_log_group_kms" {
  count = local.vpc_flow_log_cloudwatch_log_group_create_kms_key == true ? 1 : 0

  dynamic "statement" {
    for_each = local.kms_base_policy_statements
    content {
      sid       = statement.value.sid
      effect    = statement.value.effect
      actions   = statement.value.actions
      resources = statement.value.resources
      principals {
        type        = statement.value.principals.type
        identifiers = statement.value.principals.identifiers
      }
      dynamic "condition" {
        for_each = try(statement.value.conditions, [])
        content {
          test     = condition.value.test
          variable = condition.value.variable
          values   = condition.value.values
        }
      }
    }
  }

  dynamic "statement" {
    for_each = var.vpc.flow_log_cloudwatch_log_group_kms.extra_kms_policies
    content {
      sid       = statement.value.sid
      effect    = statement.value.effect
      actions   = statement.value.actions
      resources = statement.value.resources
      principals {
        type        = statement.value.principals.type
        identifiers = statement.value.principals.identifiers
      }
      dynamic "condition" {
        for_each = try(statement.value.conditions, [])
        content {
          test     = condition.value.test
          variable = condition.value.variable
          values   = condition.value.values
        }
      }
    }
  }

  dynamic "statement" {
    for_each = [local.kms_service_statements.cloudwatch_logs]
    content {
      sid       = statement.value.sid
      effect    = statement.value.effect
      actions   = statement.value.actions
      resources = statement.value.resources
      principals {
        type        = statement.value.principals.type
        identifiers = statement.value.principals.identifiers
      }
      dynamic "condition" {
        for_each = try(statement.value.conditions, [])
        content {
          test     = condition.value.test
          variable = condition.value.variable
          values   = condition.value.values
        }
      }
    }
  }
}

resource "aws_kms_key" "vpc_flow_log_cloudwatch_log_group" {
  count               = local.vpc_flow_log_cloudwatch_log_group_create_kms_key == true ? 1 : 0
  description         = "CMK for VPC flow log CloudWatch Logs encryption."
  enable_key_rotation = true
  policy              = data.aws_iam_policy_document.vpc_flow_log_cloudwatch_log_group_kms[0].json
}

resource "aws_kms_alias" "vpc_flow_log_cloudwatch_log_group" {
  count         = local.vpc_flow_log_cloudwatch_log_group_create_kms_key == true ? 1 : 0
  target_key_id = aws_kms_key.vpc_flow_log_cloudwatch_log_group[0].id
  name          = "alias/${var.vpc.flow_log_cloudwatch_log_group_kms.kms_alias}"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.1.2"

  name = var.vpc.name
  cidr = var.vpc.cidr

  azs                                       = var.vpc.azs
  private_subnets                           = var.vpc.private_subnets
  public_subnets                            = var.vpc.public_subnets
  database_subnets                          = var.vpc.database_subnets
  elasticache_subnets                       = var.vpc.elasticache_subnets
  create_database_subnet_group              = var.vpc.create_database_subnet_group
  create_database_subnet_route_table        = var.vpc.create_database_subnet_route_table
  create_elasticache_subnet_group           = var.vpc.create_elasticache_subnet_group
  create_elasticache_subnet_route_table     = var.vpc.create_elasticache_subnet_route_table
  enable_vpn_gateway                        = var.vpc.enable_vpn_gateway
  one_nat_gateway_per_az                    = var.vpc.one_nat_gateway_per_az
  single_nat_gateway                        = var.vpc.single_nat_gateway
  enable_nat_gateway                        = var.vpc.enable_nat_gateway
  enable_flow_log                           = var.vpc.enable_flow_log
  create_flow_log_cloudwatch_log_group      = var.vpc.create_flow_log_cloudwatch_log_group
  create_flow_log_cloudwatch_iam_role       = var.vpc.create_flow_log_cloudwatch_iam_role
  flow_log_max_aggregation_interval         = var.vpc.flow_log_max_aggregation_interval
  flow_log_cloudwatch_log_group_name_prefix = var.vpc.flow_log_cloudwatch_log_group_name_prefix
  flow_log_cloudwatch_log_group_name_suffix = var.vpc.flow_log_cloudwatch_log_group_name_suffix
  flow_log_cloudwatch_log_group_kms_key_id  = local.vpc_flow_log_cloudwatch_log_group_kms_key_arn
  vpc_flow_log_tags                         = var.vpc.vpc_flow_log_tags
  enable_dns_hostnames                      = var.vpc.enable_dns_hostnames
  enable_dns_support                        = var.vpc.enable_dns_support
}

module "byo-vpc" {
  source          = "./byo-vpc"
  kms_base_policy = var.kms_base_policy
  vpc_config = {
    vpc_id = module.vpc.vpc_id
    networking = {
      subnets = module.vpc.private_subnets
    }
  }
  rds_config = merge(var.rds_config, {
    subnets = module.vpc.database_subnets
  })
  redis_config = merge(var.redis_config, {
    subnets                       = module.vpc.elasticache_subnets
    allowed_cidrs                 = module.vpc.private_subnets_cidr_blocks
    elasticache_subnet_group_name = module.vpc.elasticache_subnet_group_name
    availability_zones            = var.vpc.azs
  })
  alb_config = merge(var.alb_config, {
    subnets         = module.vpc.public_subnets
    certificate_arn = var.certificate_arn
  })
  ecs_cluster  = var.ecs_cluster
  fleet_config = var.fleet_config
}