Skip to content

Adding SSM patch support #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 24 commits into from
Jun 24, 2021
Merged

Adding SSM patch support #103

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
294928e
Adding SSM patch support
jamengual Jun 22, 2021
053ceae
Auto Format
cloudpossebot Jun 22, 2021
6133cbf
remove uneeded change
jamengual Jun 22, 2021
7eac546
Merge branch 'add_ssm_patch_support' of github.com:cloudposse/terrafo…
jamengual Jun 22, 2021
ad03b75
remove uneeded change
jamengual Jun 22, 2021
2b17d4e
Auto Format
cloudpossebot Jun 22, 2021
9219b10
Update main.tf
jamengual Jun 22, 2021
193d691
Update main.tf
jamengual Jun 22, 2021
07de895
Update variables.tf
jamengual Jun 22, 2021
9f1088c
Auto Format
cloudpossebot Jun 22, 2021
9f00bf2
Update main.tf
jamengual Jun 22, 2021
1a98cd1
Update main.tf
jamengual Jun 22, 2021
1edc0a8
Adding SSM patch support
jamengual Jun 22, 2021
b798e3a
Update main.tf
jamengual Jun 22, 2021
336799f
Auto Format
cloudpossebot Jun 22, 2021
7894217
Fixinf var name
jamengual Jun 22, 2021
271fe61
Fixinf var name
jamengual Jun 22, 2021
16ab864
Merge branch 'add_ssm_patch_support' of github.com:cloudposse/terrafo…
jamengual Jun 22, 2021
d4901ac
Fixing variable name for count
jamengual Jun 22, 2021
d52b935
Fixing variable name for count and adding label module + attribute
jamengual Jun 22, 2021
f60e8af
Auto Format
cloudpossebot Jun 22, 2021
c50f64b
Update main.tf
jamengual Jun 23, 2021
0ed01c4
Update main.tf
jamengual Jun 23, 2021
ebe00ab
Minor fixes
jamengual Jun 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,7 +227,10 @@ Available targets:
| [aws_eip.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
| [aws_eip.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
| [aws_iam_instance_profile.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
| [aws_iam_policy.ssm_patch_s3_log_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy_attachment.ssm_core](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.ssm_s3_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_instance.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
| [aws_network_interface.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_interface) | resource |
| [aws_network_interface_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_interface_attachment) | resource |
Expand All @@ -239,6 +242,7 @@ Available targets:
| [aws_caller_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_instance_profile.given](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_instance_profile) | data source |
| [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.ssm_patch_s3_log_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_partition.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
| [aws_region.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
| [aws_subnet.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |
Expand Down Expand Up @@ -306,6 +310,11 @@ Available targets:
| <a name="input_security_groups"></a> [security\_groups](#input\_security\_groups) | A list of Security Group IDs to associate with EC2 instance. | `list(string)` | `[]` | no |
| <a name="input_source_dest_check"></a> [source\_dest\_check](#input\_source\_dest\_check) | Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNs | `bool` | `true` | no |
| <a name="input_ssh_key_pair"></a> [ssh\_key\_pair](#input\_ssh\_key\_pair) | SSH key pair to be provisioned on the instance | `string` | n/a | yes |
| <a name="input_ssm_patch_manager_enabled"></a> [ssm\_patch\_manager\_enabled](#input\_ssm\_patch\_manager\_enabled) | Weather to enable SSM Patch manager | `bool` | `false` | no |
| <a name="input_ssm_patch_manager_iam_policy"></a> [ssm\_patch\_manager\_iam\_policy](#input\_ssm\_patch\_manager\_iam\_policy) | IAM policy to allow Patch manager to manage the instance | `string` | `null` | no |
| <a name="input_ssm_patch_manager_patch_tag"></a> [ssm\_patch\_manager\_patch\_tag](#input\_ssm\_patch\_manager\_patch\_tag) | The tag name for the instances to patch | `string` | `"TOPATCH"` | no |
| <a name="input_ssm_patch_manager_s3_log_bucket"></a> [ssm\_patch\_manager\_s3\_log\_bucket](#input\_ssm\_patch\_manager\_s3\_log\_bucket) | The name of the s3 bucket to export the patch log to | `string` | `null` | no |
| <a name="input_ssm_patch_manager_scan_tag"></a> [ssm\_patch\_manager\_scan\_tag](#input\_ssm\_patch\_manager\_scan\_tag) | The tag name for the instances to scan | `string` | `"TOSCAN"` | no |
| <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_statistic_level"></a> [statistic\_level](#input\_statistic\_level) | The statistic to apply to the alarm's associated metric. Allowed values are: SampleCount, Average, Sum, Minimum, Maximum | `string` | `"Maximum"` | no |
| <a name="input_subnet"></a> [subnet](#input\_subnet) | VPC Subnet ID the instance is launched in | `string` | n/a | yes |
Expand Down
9 changes: 9 additions & 0 deletions docs/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,10 @@
| [aws_eip.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
| [aws_eip.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
| [aws_iam_instance_profile.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
| [aws_iam_policy.ssm_patch_s3_log_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy_attachment.ssm_core](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.ssm_s3_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_instance.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
| [aws_network_interface.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_interface) | resource |
| [aws_network_interface_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_interface_attachment) | resource |
Expand All @@ -42,6 +45,7 @@
| [aws_caller_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_instance_profile.given](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_instance_profile) | data source |
| [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.ssm_patch_s3_log_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_partition.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
| [aws_region.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
| [aws_subnet.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |
Expand Down Expand Up @@ -109,6 +113,11 @@
| <a name="input_security_groups"></a> [security\_groups](#input\_security\_groups) | A list of Security Group IDs to associate with EC2 instance. | `list(string)` | `[]` | no |
| <a name="input_source_dest_check"></a> [source\_dest\_check](#input\_source\_dest\_check) | Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNs | `bool` | `true` | no |
| <a name="input_ssh_key_pair"></a> [ssh\_key\_pair](#input\_ssh\_key\_pair) | SSH key pair to be provisioned on the instance | `string` | n/a | yes |
| <a name="input_ssm_patch_manager_enabled"></a> [ssm\_patch\_manager\_enabled](#input\_ssm\_patch\_manager\_enabled) | Weather to enable SSM Patch manager | `bool` | `false` | no |
| <a name="input_ssm_patch_manager_iam_policy"></a> [ssm\_patch\_manager\_iam\_policy](#input\_ssm\_patch\_manager\_iam\_policy) | IAM policy to allow Patch manager to manage the instance | `string` | `null` | no |
| <a name="input_ssm_patch_manager_patch_tag"></a> [ssm\_patch\_manager\_patch\_tag](#input\_ssm\_patch\_manager\_patch\_tag) | The tag name for the instances to patch | `string` | `"TOPATCH"` | no |
| <a name="input_ssm_patch_manager_s3_log_bucket"></a> [ssm\_patch\_manager\_s3\_log\_bucket](#input\_ssm\_patch\_manager\_s3\_log\_bucket) | The name of the s3 bucket to export the patch log to | `string` | `null` | no |
| <a name="input_ssm_patch_manager_scan_tag"></a> [ssm\_patch\_manager\_scan\_tag](#input\_ssm\_patch\_manager\_scan\_tag) | The tag name for the instances to scan | `string` | `"TOSCAN"` | no |
| <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_statistic_level"></a> [statistic\_level](#input\_statistic\_level) | The statistic to apply to the alarm's associated metric. Allowed values are: SampleCount, Average, Sum, Minimum, Maximum | `string` | `"Maximum"` | no |
| <a name="input_subnet"></a> [subnet](#input\_subnet) | VPC Subnet ID the instance is launched in | `string` | n/a | yes |
Expand Down
40 changes: 40 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ locals {
var.associate_public_ip_address && var.assign_eip_address && module.this.enabled ?
local.eip_public_dns : join("", aws_instance.default.*.public_dns)
)
ssm_path_log_bucket_enabled = module.this.enabled && var.ssm_patch_manager_enabled && var.ssm_patch_manager_s3_log_bucket != ""
ssm_policy = var.ssm_patch_manager_iam_policy == "" ? "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" : var.ssm_patch_manager_iam_policy
}

data "aws_caller_identity" "default" {
Expand Down Expand Up @@ -51,6 +53,31 @@ data "aws_iam_policy_document" "default" {
}
}

data "aws_iam_policy_document" "ssm_patch_s3_log_policy" {
count = local.ssm_path_log_bucket_enabled ? 1 : 0
statement {
sid = ""
actions = [
"s3:GetObject",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:GetEncryptionConfiguration",
]
resources = [
"arn:aws:s3:::${var.ssm_patch_manager_s3_log_bucket}/*",
"arn:aws:s3:::${var.ssm_patch_manager_s3_log_bucket}",
]
}
}

resource "aws_iam_policy" "ssm_patch_s3_log_policy" {
count = local.ssm_path_log_bucket_enabled ? 1 : 0
name = "ssm_patch_manager_log_bucket_policy"
path = "/"
description = "Policy to allow the local ssm agent on the instance to write the log output to the defined bucket"
policy = data.aws_iam_policy_document.ssm_patch_s3_log_policy[0].json
}

data "aws_ami" "default" {
count = var.ami == "" ? 1 : 0
most_recent = "true"
Expand Down Expand Up @@ -106,6 +133,19 @@ resource "aws_iam_role" "default" {
tags = module.this.tags
}

resource "aws_iam_role_policy_attachment" "ssm_core" {
count = module.this.enabled ? local.instance_profile_count : 0
role = aws_iam_role.default[count.index]
policy_arn = local.ssm_policy
}

resource "aws_iam_role_policy_attachment" "ssm_s3_policy" {
count = module.this.enabled && local.ssm_path_log_bucket_enabled ? local.instance_profile_count : 0
role = aws_iam_role.default[count.index]
policy_arn = aws_iam_policy.ssm_patch_s3_log_policy[0].arn
}


resource "aws_instance" "default" {
#bridgecrew:skip=BC_AWS_GENERAL_31: Skipping `Ensure Instance Metadata Service Version 1 is not enabled` check until BridgeCrew supports conditional evaluation. See https://github.com/bridgecrewio/checkov/issues/793
#bridgecrew:skip=BC_AWS_NETWORKING_47: Skiping `Ensure AWS EC2 instance is configured with VPC` because it is incorrectly flagging that this instance does not belong to a VPC even though subnet_id is configured.
Expand Down
Loading