Skip to content

Commit f5c4e19

Browse files
jamengualcloudpossebotaknysh
authored
Add ssm patch support (#104)
* Adding SSM patch support * Auto Format * remove uneeded change * remove uneeded change * Auto Format * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Update variables.tf Co-authored-by: Andriy Knysh <[email protected]> * Auto Format * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Adding SSM patch support * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Auto Format * Fixinf var name * Fixinf var name * Fixing variable name for count * Fixing variable name for count and adding label module + attribute * Auto Format * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Minor fixes * Fixing broken resource reference * Fixing broken resource reference * Adding ssm_enabled variable * Auto Format * removing ssm locals * Fixing count logic * Auto Format * Fixing count logic * Fixing count logic * Fixing count logic * Fixing count logic * Update ssm_patch.tf Co-authored-by: Andriy Knysh <[email protected]> * Update main.tf Co-authored-by: Andriy Knysh <[email protected]> * Update variables.tf Co-authored-by: Andriy Knysh <[email protected]> * Update variables.tf Co-authored-by: Andriy Knysh <[email protected]> * Auto Format * more feedback fixes * Removing duplicated resources * Update ssm_patch.tf Co-authored-by: Andriy Knysh <[email protected]> * Auto Format * Addressing Feedback * Auto Format * fixing local name * reverting logic from master Co-authored-by: cloudpossebot <[email protected]> Co-authored-by: Andriy Knysh <[email protected]>
1 parent 8c2ca76 commit f5c4e19

File tree

5 files changed

+58
-53
lines changed

5 files changed

+58
-53
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ Available targets:
312312
| <a name="input_source_dest_check"></a> [source\_dest\_check](#input\_source\_dest\_check) | Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNs | `bool` | `true` | no |
313313
| <a name="input_ssh_key_pair"></a> [ssh\_key\_pair](#input\_ssh\_key\_pair) | SSH key pair to be provisioned on the instance | `string` | n/a | yes |
314314
| <a name="input_ssm_patch_manager_enabled"></a> [ssm\_patch\_manager\_enabled](#input\_ssm\_patch\_manager\_enabled) | Whether to enable SSM Patch manager | `bool` | `false` | no |
315-
| <a name="input_ssm_patch_manager_iam_policy"></a> [ssm\_patch\_manager\_iam\_policy](#input\_ssm\_patch\_manager\_iam\_policy) | IAM policy to allow Patch manager to manage the instance | `string` | `null` | no |
315+
| <a name="input_ssm_patch_manager_iam_policy_arn"></a> [ssm\_patch\_manager\_iam\_policy\_arn](#input\_ssm\_patch\_manager\_iam\_policy\_arn) | IAM policy ARN to allow Patch Manager to manage the instance. If not provided, `arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore` will be used | `string` | `null` | no |
316316
| <a name="input_ssm_patch_manager_s3_log_bucket"></a> [ssm\_patch\_manager\_s3\_log\_bucket](#input\_ssm\_patch\_manager\_s3\_log\_bucket) | The name of the s3 bucket to export the patch log to | `string` | `null` | no |
317317
| <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
318318
| <a name="input_statistic_level"></a> [statistic\_level](#input\_statistic\_level) | The statistic to apply to the alarm's associated metric. Allowed values are: SampleCount, Average, Sum, Minimum, Maximum | `string` | `"Maximum"` | no |

‎docs/terraform.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@
115115
| <a name="input_source_dest_check"></a> [source\_dest\_check](#input\_source\_dest\_check) | Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNs | `bool` | `true` | no |
116116
| <a name="input_ssh_key_pair"></a> [ssh\_key\_pair](#input\_ssh\_key\_pair) | SSH key pair to be provisioned on the instance | `string` | n/a | yes |
117117
| <a name="input_ssm_patch_manager_enabled"></a> [ssm\_patch\_manager\_enabled](#input\_ssm\_patch\_manager\_enabled) | Whether to enable SSM Patch manager | `bool` | `false` | no |
118-
| <a name="input_ssm_patch_manager_iam_policy"></a> [ssm\_patch\_manager\_iam\_policy](#input\_ssm\_patch\_manager\_iam\_policy) | IAM policy to allow Patch manager to manage the instance | `string` | `null` | no |
118+
| <a name="input_ssm_patch_manager_iam_policy_arn"></a> [ssm\_patch\_manager\_iam\_policy\_arn](#input\_ssm\_patch\_manager\_iam\_policy\_arn) | IAM policy ARN to allow Patch Manager to manage the instance. If not provided, `arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore` will be used | `string` | `null` | no |
119119
| <a name="input_ssm_patch_manager_s3_log_bucket"></a> [ssm\_patch\_manager\_s3\_log\_bucket](#input\_ssm\_patch\_manager\_s3\_log\_bucket) | The name of the s3 bucket to export the patch log to | `string` | `null` | no |
120120
| <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
121121
| <a name="input_statistic_level"></a> [statistic\_level](#input\_statistic\_level) | The statistic to apply to the alarm's associated metric. Allowed values are: SampleCount, Average, Sum, Minimum, Maximum | `string` | `"Maximum"` | no |

‎main.tf

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ locals {
2020
var.associate_public_ip_address && var.assign_eip_address && module.this.enabled ?
2121
local.eip_public_dns : join("", aws_instance.default.*.public_dns)
2222
)
23-
ssm_path_log_bucket_enabled = local.enabled && var.ssm_patch_manager_enabled && var.ssm_patch_manager_s3_log_bucket != "" && var.ssm_patch_manager_s3_log_bucket != null
24-
ssm_policy = var.ssm_patch_manager_iam_policy == null || var.ssm_patch_manager_iam_policy == "" ? "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" : var.ssm_patch_manager_iam_policy
2523
}
2624

2725
data "aws_caller_identity" "default" {
@@ -53,40 +51,6 @@ data "aws_iam_policy_document" "default" {
5351
effect = "Allow"
5452
}
5553
}
56-
57-
module "label_ssm_patch_s3_log_policy" {
58-
source = "cloudposse/label/null"
59-
version = "0.24.1"
60-
61-
attributes = ["ssm-patch-s3-logs"]
62-
context = module.this.context
63-
}
64-
65-
data "aws_iam_policy_document" "ssm_patch_s3_log_policy" {
66-
count = local.ssm_path_log_bucket_enabled ? 1 : 0
67-
statement {
68-
sid = "AllowAccessToPathLogBucket"
69-
actions = [
70-
"s3:GetObject",
71-
"s3:PutObject",
72-
"s3:PutObjectAcl",
73-
"s3:GetEncryptionConfiguration",
74-
]
75-
resources = [
76-
"arn:aws:s3:::${var.ssm_patch_manager_s3_log_bucket}/*",
77-
"arn:aws:s3:::${var.ssm_patch_manager_s3_log_bucket}",
78-
]
79-
}
80-
}
81-
82-
resource "aws_iam_policy" "ssm_patch_s3_log_policy" {
83-
count = local.ssm_path_log_bucket_enabled ? 1 : 0
84-
name = module.label_ssm_patch_s3_log_policy.id
85-
path = "/"
86-
description = "Policy to allow the local SSM agent on the instance to write the log output to the defined bucket"
87-
policy = data.aws_iam_policy_document.ssm_patch_s3_log_policy[0].json
88-
}
89-
9054
data "aws_ami" "default" {
9155
count = var.ami == "" ? 1 : 0
9256
most_recent = "true"
@@ -142,19 +106,6 @@ resource "aws_iam_role" "default" {
142106
tags = module.this.tags
143107
}
144108

145-
resource "aws_iam_role_policy_attachment" "ssm_core" {
146-
count = local.enabled ? local.instance_profile_count : 0
147-
role = aws_iam_role.default[count.index]
148-
policy_arn = local.ssm_policy
149-
}
150-
151-
resource "aws_iam_role_policy_attachment" "ssm_s3_policy" {
152-
count = local.enabled && local.ssm_path_log_bucket_enabled ? local.instance_profile_count : 0
153-
role = aws_iam_role.default[count.index]
154-
policy_arn = aws_iam_policy.ssm_patch_s3_log_policy[0].arn
155-
}
156-
157-
158109
resource "aws_instance" "default" {
159110
#bridgecrew:skip=BC_AWS_GENERAL_31: Skipping `Ensure Instance Metadata Service Version 1 is not enabled` check until BridgeCrew supports conditional evaluation. See https://github.com/bridgecrewio/checkov/issues/793
160111
#bridgecrew:skip=BC_AWS_NETWORKING_47: Skiping `Ensure AWS EC2 instance is configured with VPC` because it is incorrectly flagging that this instance does not belong to a VPC even though subnet_id is configured.

‎ssm_patch.tf

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
2+
locals {
3+
ssm_patch_log_bucket_enabled = local.ssm_enabled && var.ssm_patch_manager_s3_log_bucket != "" && var.ssm_patch_manager_s3_log_bucket != null
4+
ssm_policy_arn = var.ssm_patch_manager_iam_policy_arn == null || var.ssm_patch_manager_iam_policy_arn == "" ? "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" : var.ssm_patch_manager_iam_policy_arn
5+
ssm_enabled = local.enabled && var.ssm_patch_manager_enabled
6+
}
7+
8+
module "label_ssm_patch_s3_log_policy" {
9+
source = "cloudposse/label/null"
10+
version = "0.24.1"
11+
12+
enabled = local.ssm_patch_log_bucket_enabled
13+
attributes = ["ssm-patch-s3-logs"]
14+
context = module.this.context
15+
}
16+
17+
data "aws_iam_policy_document" "ssm_patch_s3_log_policy" {
18+
count = local.ssm_patch_log_bucket_enabled ? 1 : 0
19+
statement {
20+
sid = "AllowAccessToPathLogBucket"
21+
actions = [
22+
"s3:GetObject",
23+
"s3:PutObject",
24+
"s3:PutObjectAcl",
25+
"s3:GetEncryptionConfiguration",
26+
]
27+
resources = [
28+
"arn:aws:s3:::${var.ssm_patch_manager_s3_log_bucket}/*",
29+
"arn:aws:s3:::${var.ssm_patch_manager_s3_log_bucket}",
30+
]
31+
}
32+
}
33+
34+
resource "aws_iam_policy" "ssm_patch_s3_log_policy" {
35+
count = local.ssm_patch_log_bucket_enabled ? 1 : 0
36+
name = module.label_ssm_patch_s3_log_policy.id
37+
path = "/"
38+
description = "Policy to allow the local SSM agent on the instance to write the log output to the defined bucket"
39+
policy = data.aws_iam_policy_document.ssm_patch_s3_log_policy[0].json
40+
}
41+
42+
43+
resource "aws_iam_role_policy_attachment" "ssm_core" {
44+
count = local.ssm_enabled ? local.instance_profile_count : 0
45+
role = aws_iam_role.default[count.index].name
46+
policy_arn = local.ssm_policy_arn
47+
}
48+
49+
resource "aws_iam_role_policy_attachment" "ssm_s3_policy" {
50+
count = local.ssm_patch_log_bucket_enabled ? local.instance_profile_count : 0
51+
role = aws_iam_role.default[count.index].name
52+
policy_arn = aws_iam_policy.ssm_patch_s3_log_policy[0].arn
53+
}

‎variables.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -326,14 +326,15 @@ variable "ssm_patch_manager_enabled" {
326326
description = "Whether to enable SSM Patch manager"
327327
}
328328

329-
variable "ssm_patch_manager_iam_policy" {
329+
variable "ssm_patch_manager_iam_policy_arn" {
330330
type = string
331331
default = null
332-
description = "IAM policy to allow Patch manager to manage the instance"
332+
description = "IAM policy ARN to allow Patch Manager to manage the instance. If not provided, `arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore` will be used"
333333
}
334334

335335
variable "ssm_patch_manager_s3_log_bucket" {
336336
type = string
337337
default = null
338338
description = "The name of the s3 bucket to export the patch log to"
339339
}
340+

0 commit comments

Comments
 (0)