Skip to content

Commit d396834

Browse files
saquino0827saquino0827
authored
Merge branch 'develop' into release/v2023.3.0
2 parents bd5979d + 20a1266 commit d396834

File tree

6 files changed

+75
-66
lines changed

6 files changed

+75
-66
lines changed

‎.github/workflows/checkov-tf.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
pull_request:
55
branches:
66
- develop
7+
8+
env:
9+
CHECKOV_OUTPUT_CODE_LINE_LIMIT: 255
10+
711
jobs:
812
build:
913

‎infrastructure/new-relic/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,18 @@ terraform {
1010
required_providers {
1111
aws = {
1212
source = "hashicorp/aws"
13-
version = "=3.70.0"
13+
version = "=4.55.0"
1414
}
1515
}
16-
required_version = "1.0.0"
16+
required_version = "1.5.0"
17+
}
18+
19+
locals {
20+
myregion = "us-east-1"
1721
}
1822

1923
provider "aws" {
20-
region = "us-east-1"
24+
region = local.myregion
2125
}
2226

2327
data "aws_caller_identity" "current" {}
@@ -57,7 +61,7 @@ resource "aws_iam_policy" "new_relic_budget_policy" {
5761
{
5862
"Effect": "Allow",
5963
"Action": ["budgets:ViewBudget"],
60-
"Resource": "*"
64+
"Resource": "arn:aws:${local.myregion}:*:*:*"
6165
}
6266
]
6367
}

‎infrastructure/terraform/modules/iam.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -342,7 +342,7 @@ resource "aws_iam_policy" "conversiontool_svc_policy" {
342342
"iam:GetRole",
343343
"iam:PassRole"
344344
],
345-
"Resource": "*"
345+
"Resource": "arn:aws:ecs:${var.region}:*:*"
346346
},
347347
{
348348
"Sid": "AllowS3",
@@ -384,7 +384,7 @@ resource "aws_iam_policy" "conversiontool_svc_policy" {
384384
"Sid": "ECRauthorization",
385385
"Effect": "Allow",
386386
"Action": "ecr:GetAuthorizationToken",
387-
"Resource": "*"
387+
"Resource": "arn:aws:ecr:${var.region}:*:*"
388388
},
389389
{
390390
"Sid": "ECRPermissions",

‎infrastructure/terraform/modules/newrelic/provider.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
required_providers {
77
newrelic = {
88
source = "newrelic/newrelic"
9-
version = "2.49.0"
9+
version = "3.25.2"
1010
}
1111
}
1212
}

‎infrastructure/terraform/modules/openid-connect/gha_openid.tf

Lines changed: 52 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ terraform {
22
required_providers {
33
aws = {
44
source = "hashicorp/aws"
5-
version = "=3.70.0"
5+
version = "=4.55.0"
66
}
77
}
8-
required_version = "1.0.0"
8+
required_version = "1.5.0"
99
}
1010

1111
provider "aws" {
@@ -70,58 +70,58 @@ resource "aws_iam_policy" "github_actions_conversiontool_policy" {
7070
"iam:GetRole",
7171
"iam:PassRole"
7272
],
73-
"Resource": "*"
73+
"Resource": "arn:aws:ecs:${var.region}:*:*"
7474
},
75-
{
76-
"Action": [
77-
"acm:ListCertificates",
78-
"acm:ExportCertificate",
79-
"acm:GetCertificate",
80-
"acm:DescribeCertificate"
81-
],
82-
"Effect": "Allow",
83-
"Resource": ["arn:aws:acm:${var.region}:${data.aws_caller_identity.current.account_id}:certificate/*"],
84-
"Sid": "ACMPermissions"
85-
},
86-
{
87-
"Sid": "ECRauthorization",
88-
"Effect": "Allow",
89-
"Action": "ecr:GetAuthorizationToken",
90-
"Resource": "*"
91-
},
75+
{
76+
"Action": [
77+
"acm:ListCertificates",
78+
"acm:ExportCertificate",
79+
"acm:GetCertificate",
80+
"acm:DescribeCertificate"
81+
],
82+
"Effect": "Allow",
83+
"Resource": ["arn:aws:acm:${var.region}:${data.aws_caller_identity.current.account_id}:certificate/*"],
84+
"Sid": "ACMPermissions"
85+
},
86+
{
87+
"Sid": "ECRauthorization",
88+
"Effect": "Allow",
89+
"Action": "ecr:GetAuthorizationToken",
90+
"Resource": "arn:aws:ecr:${var.region}:*:*"
91+
},
9292
{
93-
"Sid": "ECRPermissions",
94-
"Effect": "Allow",
95-
"Action": [
96-
"ecr:GetDownloadUrlForLayer",
97-
"ecr:BatchGetImage",
98-
"ecr:CompleteLayerUpload",
99-
"ecr:UploadLayerPart",
100-
"ecr:InitiateLayerUpload",
101-
"ecr:BatchCheckLayerAvailability",
102-
"ecr:PutImage"
103-
],
104-
"Resource":[
105-
"arn:aws:ecr:us-east-1:003384571330:repository/new-qpp-conversion-tool",
106-
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/dev",
107-
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/devpre",
108-
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/impl",
109-
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/prod"
110-
]
111-
},
112-
{
113-
"Action": [
114-
"ssm:GetParameters",
115-
"ssm:PutParameter",
116-
"ssm:GetParameterHistory",
117-
"ssm:GetParametersByPath",
118-
"ssm:GetParameter",
119-
"ssm:DescribeParameters"
120-
],
121-
"Effect": "Allow",
122-
"Resource": ["arn:aws:ssm:${var.region}:${data.aws_caller_identity.current.account_id}:parameter/qppar-sf/*"],
123-
"Sid": "SSMPermissions"
124-
}
93+
"Sid": "ECRPermissions",
94+
"Effect": "Allow",
95+
"Action": [
96+
"ecr:GetDownloadUrlForLayer",
97+
"ecr:BatchGetImage",
98+
"ecr:CompleteLayerUpload",
99+
"ecr:UploadLayerPart",
100+
"ecr:InitiateLayerUpload",
101+
"ecr:BatchCheckLayerAvailability",
102+
"ecr:PutImage"
103+
],
104+
"Resource":[
105+
"arn:aws:ecr:us-east-1:003384571330:repository/new-qpp-conversion-tool",
106+
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/dev",
107+
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/devpre",
108+
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/impl",
109+
"003384571330.dkr.ecr.us-east-1.amazonaws.com/qppsf/conversion-tool/prod"
110+
]
111+
},
112+
{
113+
"Action": [
114+
"ssm:GetParameters",
115+
"ssm:PutParameter",
116+
"ssm:GetParameterHistory",
117+
"ssm:GetParametersByPath",
118+
"ssm:GetParameter",
119+
"ssm:DescribeParameters"
120+
],
121+
"Effect": "Allow",
122+
"Resource": ["arn:aws:ssm:${var.region}:${data.aws_caller_identity.current.account_id}:parameter/qppar-sf/*"],
123+
"Sid": "SSMPermissions"
124+
}
125125
]
126126
})
127127
}

‎infrastructure/terraform/modules/s3.tf

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -156,15 +156,16 @@ resource "aws_s3_bucket_lifecycle_configuration" "log_bucket" {
156156
# }
157157
}
158158

159-
resource "aws_s3_bucket_ownership_controls" "log_bucket" {
160-
bucket = aws_s3_bucket.log_bucket.id
161-
rule {
162-
object_ownership = "BucketOwnerPreferred"
163-
}
164-
}
159+
# QPPSE-1461
160+
# resource "aws_s3_bucket_ownership_controls" "log_bucket" {
161+
# bucket = aws_s3_bucket.log_bucket.id
162+
# rule {
163+
# object_ownership = "BucketOwnerPreferred"
164+
# }
165+
# }
165166

166167
resource "aws_s3_bucket_acl" "log_bucket" {
167-
depends_on = [aws_s3_bucket_ownership_controls.log_bucket]
168+
# depends_on = [aws_s3_bucket_ownership_controls.log_bucket]
168169

169170
bucket = aws_s3_bucket.log_bucket.id
170171

0 commit comments

Comments
 (0)