Skip to content

Commit 8db925b

Browse files
HelenadenHelenaden
committed
modified files
1 parent 5b0dbb6 commit 8db925b

File tree

5 files changed

+176
-108
lines changed

5 files changed

+176
-108
lines changed

‎ec2.tf‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ data "aws_ami" "amazon_linux_2" {
1818
}
1919
}
2020

21-
resource "aws_key_pair" "terraform_key" {
22-
key_name = "ec2-new-key"
21+
resource "aws_key_pair" "terraform_key_3" {
22+
key_name = "ec2-new3-key"
2323
public_key = tls_private_key.rsa.public_key_openssh
2424
}
2525

@@ -28,13 +28,14 @@ resource "tls_private_key" "rsa" {
2828
rsa_bits = 4096
2929
}
3030

31-
resource "aws_secretsmanager_secret" "ec2_private_key" {
32-
name = "ec2-private-key"
31+
resource "aws_secretsmanager_secret" "ec2_private_key_new" {
32+
name = "ec2-private-key-new"
3333
description = "EC2 private key for SSH access"
34+
kms_key_id = aws_kms_key.secrets_key.arn
3435
}
3536

3637
resource "aws_secretsmanager_secret_version" "ec2_private_key_version" {
37-
secret_id = aws_secretsmanager_secret.ec2_private_key.id
38+
secret_id = aws_secretsmanager_secret.ec2_private_key_new.id
3839
secret_string = tls_private_key.rsa.private_key_pem
3940
}
4041

@@ -53,7 +54,7 @@ resource "aws_launch_template" "web_tier_template" {
5354
name_prefix = "web-tier-"
5455
image_id = data.aws_ami.amazon_linux_2.id
5556
instance_type = "t2.micro"
56-
key_name = aws_key_pair.terraform_key.key_name
57+
key_name = aws_key_pair.terraform_key_3.key_name
5758
user_data = base64encode(data.template_file.web_user_data.rendered)
5859

5960
block_device_mappings {
@@ -83,7 +84,7 @@ resource "aws_launch_template" "app_tier_template" {
8384
name_prefix = "app-tier-"
8485
image_id = data.aws_ami.amazon_linux_2.id
8586
instance_type = "t2.micro"
86-
key_name = aws_key_pair.terraform_key.key_name
87+
key_name = aws_key_pair.terraform_key_3.key_name
8788
user_data = base64encode(data.template_file.app_user_data.rendered)
8889

8990
block_device_mappings {

‎iam.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ data "aws_iam_policy_document" "web_tier_policy_doc" {
5757
# The ARN of the secret we'll create later in kms_secrets.tf
5858
"arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:db-credentials*",
5959
# New: Permission to retrieve the EC2 private key
60-
aws_secretsmanager_secret.ec2_private_key.arn,
60+
aws_secretsmanager_secret.ec2_private_key_new.arn,
6161
]
6262
}
6363
}
@@ -82,7 +82,7 @@ data "aws_iam_policy_document" "app_tier_policy_doc" {
8282
resources = [
8383
"arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:db-credentials*",
8484
# New: Permission to retrieve the EC2 private key
85-
aws_secretsmanager_secret.ec2_private_key.arn,
85+
aws_secretsmanager_secret.ec2_private_key_new.arn,
8686
]
8787
}
8888

@@ -111,10 +111,10 @@ resource "aws_iam_role_policy" "app_tier_policy" {
111111
#Add an IAM policy for the Inspector agent.
112112
resource "aws_iam_role_policy_attachment" "inspector_agent_web_policy_attach" {
113113
role = aws_iam_role.web_tier_role.name
114-
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2RoleforSSM"
114+
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
115115
}
116116

117117
resource "aws_iam_role_policy_attachment" "inspector_agent_app_policy_attach" {
118118
role = aws_iam_role.app_tier_role.name
119-
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2RoleforSSM"
119+
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
120120
}

‎kms-secrets.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,16 +44,16 @@ resource "aws_kms_key" "secrets_key" {
4444
}
4545

4646
# Create an RDS MySQL database secret
47-
resource "aws_secretsmanager_secret" "db_credentials" {
48-
name = "db-credentials"
47+
resource "aws_secretsmanager_secret" "db_credentials_new" {
48+
name = "db-credentials-new"
4949
description = "RDS MySQL database credentials"
5050
kms_key_id = aws_kms_key.secrets_key.arn
5151
}
5252

5353
# Store the actual secret value.
5454
# This should be a securely generated value, not hardcoded.
5555
resource "aws_secretsmanager_secret_version" "db_credentials_version" {
56-
secret_id = aws_secretsmanager_secret.db_credentials.id
56+
secret_id = aws_secretsmanager_secret.db_credentials_new.id
5757
secret_string = jsonencode({
5858
username = var.db_username
5959
password = random_password.db_password.result
@@ -63,6 +63,7 @@ resource "aws_secretsmanager_secret_version" "db_credentials_version" {
6363
resource "random_password" "db_password" {
6464
length = 16
6565
special = true
66+
override_special = "!#$%&*()_+-=[]{}<>:;?|~" # Customize as needed
6667
keepers = {
6768
version = "1"
6869
}

‎security.tf‎

Lines changed: 71 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,28 @@
11
# Description: This file implements CloudTrail and WAF.
22
# -------------------------------------------------------------
33

4+
# -------------------------------------------------------------
5+
# CloudTrail and CloudWatch Resources
6+
# -------------------------------------------------------------
7+
48
# CloudTrail S3 Bucket for log storage
59
resource "aws_s3_bucket" "cloudtrail_logs" {
610
# The bucket name must be globally unique across all of AWS
711
# We use the account ID to ensure uniqueness
812
bucket = "cloudtrail-logs-${data.aws_caller_identity.current.account_id}"
913
}
1014

15+
# S3 Bucket Public Access Block
16+
# This is a best practice to prevent the bucket from being publicly accessible.
17+
resource "aws_s3_bucket_public_access_block" "cloudtrail_logs" {
18+
bucket = aws_s3_bucket.cloudtrail_logs.id
19+
20+
block_public_acls = true
21+
block_public_policy = true
22+
ignore_public_acls = true
23+
restrict_public_buckets = true
24+
}
25+
1126
# S3 Bucket Policy for CloudTrail logs
1227
resource "aws_s3_bucket_policy" "cloudtrail_logs_policy" {
1328
bucket = aws_s3_bucket.cloudtrail_logs.id
@@ -17,30 +32,49 @@ resource "aws_s3_bucket_policy" "cloudtrail_logs_policy" {
1732
Version = "2012-10-17"
1833
Statement = [
1934
{
20-
Effect = "Allow"
35+
Effect = "Allow"
2136
Principal = {
2237
Service = "cloudtrail.amazonaws.com"
2338
}
24-
Action = "s3:PutObject"
25-
Resource = "${aws_s3_bucket.cloudtrail_logs.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"
39+
Action = "s3:PutObject"
40+
Resource = "${aws_s3_bucket.cloudtrail_logs.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"
2641
},
2742
{
28-
Effect = "Allow"
43+
Effect = "Allow"
2944
Principal = {
3045
Service = "cloudtrail.amazonaws.com"
3146
}
32-
Action = "s3:GetBucketAcl"
33-
Resource = aws_s3_bucket.cloudtrail_logs.arn
47+
Action = "s3:GetBucketAcl"
48+
Resource = aws_s3_bucket.cloudtrail_logs.arn
3449
},
3550
]
3651
})
3752
}
3853

54+
# S3 Bucket Versioning
55+
resource "aws_s3_bucket_versioning" "cloudtrail_logs_versioning" {
56+
bucket = aws_s3_bucket.cloudtrail_logs.id
57+
versioning_configuration {
58+
status = "Enabled"
59+
}
60+
}
61+
62+
# S3 Bucket Server-Side Encryption
63+
resource "aws_s3_bucket_server_side_encryption_configuration" "cloudtrail_s3_bucket_sse" {
64+
bucket = aws_s3_bucket.cloudtrail_logs.id
65+
rule {
66+
apply_server_side_encryption_by_default {
67+
sse_algorithm = "aws:kms"
68+
# Use the ARN of the KMS key data source
69+
kms_master_key_id = aws_kms_key.secrets_key.arn
70+
}
71+
}
72+
}
73+
3974
# CloudTrail CloudWatch Log Group
4075
resource "aws_cloudwatch_log_group" "cloudtrail_log_group" {
4176
name = "CloudTrail-Log-Group"
4277
retention_in_days = 90
43-
kms_key_id = aws_kms_key.secrets_key.arn
4478
}
4579

4680
# IAM Role for CloudTrail to publish logs to CloudWatch
@@ -50,11 +84,11 @@ resource "aws_iam_role" "cloudtrail_role" {
5084
Version = "2012-10-17"
5185
Statement = [
5286
{
53-
Effect = "Allow"
87+
Effect = "Allow"
5488
Principal = {
5589
Service = "cloudtrail.amazonaws.com"
5690
}
57-
Action = "sts:AssumeRole"
91+
Action = "sts:AssumeRole"
5892
},
5993
]
6094
})
@@ -68,49 +102,32 @@ resource "aws_iam_role_policy" "cloudtrail_policy" {
68102
Version = "2012-10-17"
69103
Statement = [
70104
{
71-
Effect = "Allow"
72-
Action = [
105+
Effect = "Allow"
106+
# ADDED `logs:DescribeLogGroups` to fix the validation error
107+
Action = [
73108
"logs:CreateLogStream",
74-
"logs:PutLogEvents"
109+
"logs:PutLogEvents",
110+
"logs:DescribeLogGroups"
75111
]
76-
Resource = aws_cloudwatch_log_group.cloudtrail_log_group.arn
112+
Resource = "${aws_cloudwatch_log_group.cloudtrail_log_group.arn}:*"
77113
},
78114
]
79115
})
80116
}
81117

82118
# AWS CloudTrail Trail
83119
resource "aws_cloudtrail" "trail" {
84-
name = "management-events-trail"
85-
s3_bucket_name = aws_s3_bucket.cloudtrail_logs.id
86-
is_multi_region_trail = true
87-
enable_log_file_validation = true # Ensures log integrity
88-
# Corrected ARN - removed the trailing :*
89-
cloud_watch_logs_group_arn = aws_cloudwatch_log_group.cloudtrail_log_group.arn
90-
cloud_watch_logs_role_arn = aws_iam_role.cloudtrail_role.arn
91-
}
92-
93-
# S3 Bucket Versioning
94-
# This enables versioning on the bucket, which helps protect against accidental
95-
# deletion or modification of log files.
96-
resource "aws_s3_bucket_versioning" "cloudtrail_logs_versioning" {
97-
bucket = aws_s3_bucket.cloudtrail_logs.id
98-
versioning_configuration {
99-
status = "Enabled"
100-
}
101-
}
102-
103-
# S3 Bucket Server-Side Encryption
104-
# This enforces server-side encryption for all objects in the bucket,
105-
# ensuring your logs are encrypted at rest.
106-
resource "aws_s3_bucket_server_side_encryption_configuration" "cloudtrail_s3_bucket_sse" {
107-
bucket = aws_s3_bucket.cloudtrail_logs.id
108-
rule {
109-
apply_server_side_encryption_by_default {
110-
sse_algorithm = "aws:kms"
111-
kms_master_key_id = aws_kms_key.secrets_key.arn
112-
}
113-
}
120+
depends_on = [
121+
aws_cloudwatch_log_group.cloudtrail_log_group,
122+
aws_iam_role.cloudtrail_role,
123+
aws_iam_role_policy.cloudtrail_policy
124+
]
125+
name = "management-events-trail"
126+
s3_bucket_name = aws_s3_bucket.cloudtrail_logs.id
127+
is_multi_region_trail = true
128+
enable_log_file_validation = true
129+
cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail_log_group.arn}:*"
130+
cloud_watch_logs_role_arn = aws_iam_role.cloudtrail_role.arn
114131
}
115132

116133
# Web Application Firewall (WAF)
@@ -126,18 +143,16 @@ resource "aws_wafv2_web_acl" "web_acl" {
126143
# that protects against common exploits like SQLi and XSS.
127144
rule {
128145
# Use a unique name for this rule
129-
name = "CommonRuleSet"
130-
priority = 1
146+
name = "CommonRuleSet"
147+
priority = 1
131148
statement {
132149
managed_rule_group_statement {
133-
vendor_name = "AWS"
134-
# This is the correct managed rule group name from AWS
135150
name = "AWSManagedRulesCommonRuleSet"
151+
vendor_name = "AWS"
136152
}
137153
}
138-
action {
139-
# This action should be 'block' to protect against common exploits
140-
block {}
154+
override_action {
155+
none {}
141156
}
142157
visibility_config {
143158
cloudwatch_metrics_enabled = true
@@ -146,20 +161,19 @@ resource "aws_wafv2_web_acl" "web_acl" {
146161
}
147162
}
148163

149-
# Rule to protect against Log4j2 vulnerabilities and other bad inputs
164+
# Rule to protect against known bad inputs and scanners
150165
rule {
151166
# Use a unique name for this rule
152-
name = "KnownBadInputs"
153-
priority = 2
167+
name = "KnownBadInputs"
168+
priority = 2
154169
statement {
155170
managed_rule_group_statement {
171+
name = "AWSManagedRulesAmazonIpReputationList"
156172
vendor_name = "AWS"
157-
# This is the correct managed rule group name from AWS
158-
name = "AWSManagedRulesKnownBadInputsRuleSet"
159173
}
160174
}
161-
action {
162-
block {}
175+
override_action {
176+
none {}
163177
}
164178
visibility_config {
165179
cloudwatch_metrics_enabled = true

0 commit comments

Comments
 (0)