mirror of
https://github.com/Sea-Haven-Industries/apm-wo-analysis.git
synced 2026-09-30 07:43:15 +00:00
f13d2e3ff1
Some checks are pending
Deploy / Deploy to prod (push) Waiting to run
* feat(infra): migrate pipeline and Grafana to HCP Terraform (PLAT-75) Move apm-wo-analysis into seahaven-prod under workspace apm-wo-analysis-prod with in-repo hcptf/githubdeploy IAM, stub Lambdas, and GitHub Actions zip CD. * chore(iam): add Checkov skip comments for HCP IAM documents Pre-push HIGH findings are the DLM snapshot describe, tagged EC2 creates, exec boundary DescribeLogGroups star, and the drop-uploader user policy.
132 lines
2.8 KiB
HCL
132 lines
2.8 KiB
HCL
# Exports bucket: raw/ (incoming), analytics/ (Parquet), meta/ (JSON),
|
|
# athena-results/, grafana-config/. RETAIN equivalent: no force_destroy.
|
|
|
|
resource "aws_s3_bucket" "exports" {
|
|
bucket = local.exports_bucket_name
|
|
|
|
tags = {
|
|
Purpose = "APM WO export snapshots and Grafana config"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_public_access_block" "exports" {
|
|
bucket = aws_s3_bucket.exports.id
|
|
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
resource "aws_s3_bucket_ownership_controls" "exports" {
|
|
bucket = aws_s3_bucket.exports.id
|
|
|
|
rule {
|
|
object_ownership = "BucketOwnerEnforced"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "exports" {
|
|
bucket = aws_s3_bucket.exports.id
|
|
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "AES256"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_lifecycle_configuration" "exports" {
|
|
bucket = aws_s3_bucket.exports.id
|
|
|
|
rule {
|
|
id = "expire-raw-exports"
|
|
status = "Enabled"
|
|
|
|
filter {
|
|
prefix = "raw/"
|
|
}
|
|
|
|
expiration {
|
|
days = 90
|
|
}
|
|
}
|
|
|
|
rule {
|
|
id = "expire-athena-results"
|
|
status = "Enabled"
|
|
|
|
filter {
|
|
prefix = "athena-results/"
|
|
}
|
|
|
|
expiration {
|
|
days = 30
|
|
}
|
|
}
|
|
|
|
rule {
|
|
id = "abort-incomplete-multipart"
|
|
status = "Enabled"
|
|
|
|
filter {}
|
|
|
|
abort_incomplete_multipart_upload {
|
|
days_after_initiation = 7
|
|
}
|
|
}
|
|
}
|
|
|
|
data "aws_iam_policy_document" "exports" {
|
|
statement {
|
|
sid = "DenyInsecureTransport"
|
|
effect = "Deny"
|
|
|
|
principals {
|
|
type = "*"
|
|
identifiers = ["*"]
|
|
}
|
|
|
|
actions = ["s3:*"]
|
|
resources = [
|
|
aws_s3_bucket.exports.arn,
|
|
"${aws_s3_bucket.exports.arn}/*",
|
|
]
|
|
|
|
condition {
|
|
test = "Bool"
|
|
variable = "aws:SecureTransport"
|
|
values = ["false"]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_policy" "exports" {
|
|
bucket = aws_s3_bucket.exports.id
|
|
policy = data.aws_iam_policy_document.exports.json
|
|
|
|
depends_on = [aws_s3_bucket_public_access_block.exports]
|
|
}
|
|
|
|
# Drop-folder identity. Access keys are created out of band
|
|
# (aws iam create-access-key) and stored in the local apm-wo-drop profile.
|
|
resource "aws_iam_user" "drop_uploader" {
|
|
name = "apm-wo-drop-uploader"
|
|
path = "/tf-managed/"
|
|
}
|
|
|
|
data "aws_iam_policy_document" "drop_uploader" {
|
|
statement {
|
|
sid = "PutRawExportsOnly"
|
|
effect = "Allow"
|
|
actions = ["s3:PutObject"]
|
|
resources = ["${aws_s3_bucket.exports.arn}/raw/*"]
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_user_policy" "drop_uploader" {
|
|
# checkov:skip=CKV_AWS_40: Drop-folder identity is an IAM user by design (local launchd profile). Policy is s3:PutObject on raw/* only.
|
|
name = "PutRawExportsOnly"
|
|
user = aws_iam_user.drop_uploader.name
|
|
policy = data.aws_iam_policy_document.drop_uploader.json
|
|
}
|