diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..19b5625
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,17 @@
+repos:
+- repo: https://github.com/antonbabenko/pre-commit-terraform
+ rev: v1.31.0
+ hooks:
+# - id: terraform_validate
+ - id: terraform_fmt
+ - id: terraform_docs_replace
+ args: ['table']
+ exclude: common/.*
+ exclude: version.tf
+
+- repo: https://github.com/pre-commit/pre-commit-hooks
+ rev: v3.1.0
+ hooks:
+ - id: check-symlinks
+ - id: detect-aws-credentials
+ - id: detect-private-key
diff --git a/it-linux-base/README.md b/it-linux-base/README.md
new file mode 100644
index 0000000..2ef8e0e
--- /dev/null
+++ b/it-linux-base/README.md
@@ -0,0 +1,56 @@
+# About it-linux-base
+
+This describes how to use the aws-common-security-groups submodule for it-linux-base.
+
+Commonly used ports and services are set up here, including ICMP, SSH, NTP, DNS, SNMP,
+monit, munin, iperf, netperf, NetBackup and Opsware.
+
+## Usage
+
+```hcl
+module "it-linux-base" {
+ source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//it-linux-base"
+
+ # name = "m-it-linux-base"
+ vpc_id = var.vpc_id
+ # Name, CostAllocation, and Environment are pre-set, but they can be overriden
+ # tags = { }
+}
+```
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | >= 0.12 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | n/a |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| \_module\_version | Module version number | `string` | `"1.0.1"` | no |
+| description | Security Group Description | `string` | `"Linux Common Base Security Group"` | no |
+| egress\_networks | List of egress networks (all ports) | `list(string)` | [
"0.0.0.0/0"
]
| no |
+| egress\_security\_groups | List of egress security groups (all ports) | `list(string)` | `[]` | no |
+| enable\_self | Enable\|Disable self full access | `bool` | `false` | no |
+| ingress\_networks | List of ingress networks for external access (not all ports) | `list(string)` | [
"0.0.0.0/0"
]
| no |
+| ingress\_security\_groups | List of ingress security groups for all ports | `list(string)` | `[]` | no |
+| name | Security Group Name | `string` | `"it-linux-base"` | no |
+| short\_description | Security Group Short Description | `string` | `"Linux"` | no |
+| tags | Extra security group tags | `map` | {
"CostAllocation": "csvd:infrastructure",
"Environment": "csvd-infrastructure"
} | no |
+| use\_vpc\_cidr | Enable\|Disable use of VPC CIDR block in the ingress\_networks | `bool` | `false` | no |
+| vpc\_full\_name | VPC Name | `string` | `""` | no |
+| vpc\_id | VPC ID Number | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| this\_security\_group\_arn | Created security group ARN |
+| this\_security\_group\_id | Created security group ID |
diff --git a/it-linux-base/main.tf b/it-linux-base/main.tf
index cadecc8..8b23560 100644
--- a/it-linux-base/main.tf
+++ b/it-linux-base/main.tf
@@ -1,3 +1,25 @@
+/**
+* # About it-linux-base
+*
+* This describes how to use the aws-common-security-groups submodule for it-linux-base.
+*
+* Commonly used ports and services are set up here, including ICMP, SSH, NTP, DNS, SNMP,
+* monit, munin, iperf, netperf, NetBackup and Opsware.
+*
+* ## Usage
+*
+* ```hcl
+* module "it-linux-base" {
+* source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//it-linux-base"
+*
+* # name = "m-it-linux-base"
+* vpc_id = var.vpc_id
+* # Name, CostAllocation, and Environment are pre-set, but they can be overriden
+* # tags = { }
+* }
+* ```
+*/
+
data "aws_vpc" "this_vpc" {
count = var.use_vpc_cidr ? 1 : 0
id = var.vpc_id
diff --git a/it-linux-base/ports.tf b/it-linux-base/ports.tf
index 995332d..0c48c65 100644
--- a/it-linux-base/ports.tf
+++ b/it-linux-base/ports.tf
@@ -12,27 +12,27 @@ locals {
n_mgmt = ["148.129.162.0/24", "148.129.95.0/24"]
source_groups = ["all", "external"]
name = var.name
- ports = [
- [ -1, -1, "icmp", "ICMP", local.n_all, ["external"] ],
- [ 22, 22, "tcp", "SSH", local.n_census, ["external"] ],
- [ 25, 25, "tcp", "SMTP", local.n_all, ["external"] ],
- [ 123, 123, "udp", "NTP", local.n_all, ["external"] ],
- [ 161, 161, "udp", "SNMP", local.n_all, ["external"] ],
- [ 443, 443, "tcp", "https", local.n_all, ["external"] ],
- [ 4949, 4949, "tcp", "Munin", local.n_mgmt, ["external"] ],
- [ 5001, 5003, "tcp", "iperf", local.n_all, ["external"] ],
- [ 5001, 5003, "udp", "iperf", local.n_all, ["external"] ],
+ ports = [
+ [-1, -1, "icmp", "ICMP", local.n_all, ["external"]],
+ [22, 22, "tcp", "SSH", local.n_census, ["external"]],
+ [25, 25, "tcp", "SMTP", local.n_all, ["external"]],
+ [123, 123, "udp", "NTP", local.n_all, ["external"]],
+ [161, 161, "udp", "SNMP", local.n_all, ["external"]],
+ [443, 443, "tcp", "https", local.n_all, ["external"]],
+ [4949, 4949, "tcp", "Munin", local.n_mgmt, ["external"]],
+ [5001, 5003, "tcp", "iperf", local.n_all, ["external"]],
+ [5001, 5003, "udp", "iperf", local.n_all, ["external"]],
- [ 1556, 1556, "tcp", "Netbackup", local.n_all, ["external"] ],
- [ 13724, 13724, "tcp", "Netbackup", local.n_all, ["external"] ],
- [ 13782, 13782, "tcp", "Netbackup", local.n_all, ["external"] ],
+ [1556, 1556, "tcp", "Netbackup", local.n_all, ["external"]],
+ [13724, 13724, "tcp", "Netbackup", local.n_all, ["external"]],
+ [13782, 13782, "tcp", "Netbackup", local.n_all, ["external"]],
- [ 1830, 1830, "tcp", "Oracle-OEM", ["10.193.8.0/23" ], ["external"]],
+ [1830, 1830, "tcp", "Oracle-OEM", ["10.193.8.0/23"], ["external"]],
- [ 1002, 1002, "tcp", "OPSware-Control", local.n_all, ["external"] ],
- [ 9080, 9080, "tcp", "", [local.n_census[2] ], ["external"]],
- [ 10082, 10082, "tcp", "", local.n_all, ["external"] ],
- [ 10102, 10102, "tcp", "", local.n_all, ["external"] ],
+ [1002, 1002, "tcp", "OPSware-Control", local.n_all, ["external"]],
+ [9080, 9080, "tcp", "", [local.n_census[2]], ["external"]],
+ [10082, 10082, "tcp", "Netbackup-spoold", local.n_all, ["external"]],
+ [10102, 10102, "tcp", "Netbackup-spad", local.n_all, ["external"]],
]
# these are ignored
diff --git a/it-linux-base/version.tf b/it-linux-base/version.tf
index 84fd21a..3c275e9 100644
--- a/it-linux-base/version.tf
+++ b/it-linux-base/version.tf
@@ -1,5 +1,5 @@
variable "_module_version" {
description = "Module version number"
type = string
- default = "1.0"
+ default = "1.0.1"
}
diff --git a/it-windows-base/CHANGELOG.md b/it-windows-base/CHANGELOG.md
new file mode 100644
index 0000000..c849699
--- /dev/null
+++ b/it-windows-base/CHANGELOG.md
@@ -0,0 +1,3 @@
+# v1.0 -- 20200731
+
+* create from running security group it-windows-base for use throughout
diff --git a/it-windows-base/README.md b/it-windows-base/README.md
new file mode 100644
index 0000000..c315a44
--- /dev/null
+++ b/it-windows-base/README.md
@@ -0,0 +1,56 @@
+# About it-windows-base
+
+This describes how to use the aws-common-security-groups submodule for it-windows-base.
+
+Commonly used ports and services are set up here, including ICMP, AD, RDP, NTP, DNS, SNMP,
+monit, munin, iperf, netperf, NetBackup and Opsware.
+
+## Usage
+
+```hcl
+module "it-windows-base" {
+ source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//it-windows-base"
+
+ # name = "it-windows-base"
+ vpc_id = var.vpc_id
+ # Name, CostAllocation, and Environment are pre-set, but they can be overriden
+ # tags = { }
+}
+```
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | >= 0.12 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | n/a |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| \_module\_version | Module version number | `string` | `"1.0"` | no |
+| description | Security Group Description | `string` | `"Windows Common Base Security Group"` | no |
+| egress\_networks | List of egress networks (all ports) | `list(string)` | [
"0.0.0.0/0"
]
| no |
+| egress\_security\_groups | List of egress security groups (all ports) | `list(string)` | `[]` | no |
+| enable\_self | Enable\|Disable self full access | `bool` | `false` | no |
+| ingress\_networks | List of ingress networks for external access (not all ports) | `list(string)` | [
"0.0.0.0/0"
]
| no |
+| ingress\_security\_groups | List of ingress security groups for all ports | `list(string)` | `[]` | no |
+| name | Security Group Name | `string` | `"it-windows-base"` | no |
+| short\_description | Security Group Short Description | `string` | `"Windows"` | no |
+| tags | Extra security group tags | `map` | {
"CostAllocation": "csvd:infrastructure",
"Environment": "csvd-infrastructure"
} | no |
+| use\_vpc\_cidr | Enable\|Disable use of VPC CIDR block in the ingress\_networks | `bool` | `false` | no |
+| vpc\_full\_name | VPC Name | `string` | `""` | no |
+| vpc\_id | VPC ID Number | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| this\_security\_group\_arn | Created security group ARN |
+| this\_security\_group\_id | Created security group ID |
diff --git a/it-windows-base/main.tf b/it-windows-base/main.tf
new file mode 100644
index 0000000..ee37c88
--- /dev/null
+++ b/it-windows-base/main.tf
@@ -0,0 +1,120 @@
+/**
+* # About it-windows-base
+*
+* This describes how to use the aws-common-security-groups submodule for it-windows-base.
+*
+* Commonly used ports and services are set up here, including ICMP, AD, RDP, NTP, DNS, SNMP,
+* monit, munin, iperf, netperf, NetBackup and Opsware.
+*
+* ## Usage
+*
+* ```hcl
+* module "it-windows-base" {
+* source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//it-windows-base"
+*
+* # name = "it-windows-base"
+* vpc_id = var.vpc_id
+* # Name, CostAllocation, and Environment are pre-set, but they can be overriden
+* # tags = { }
+* }
+* ```
+*/
+
+data "aws_vpc" "this_vpc" {
+ count = var.use_vpc_cidr ? 1 : 0
+ id = var.vpc_id
+}
+
+data "aws_security_group" "ingress_security_groups" {
+ count = length(var.ingress_security_groups)
+ id = element(var.ingress_security_groups, count.index)
+}
+
+data "aws_security_group" "egress_security_groups" {
+ count = length(var.egress_security_groups)
+ id = element(var.egress_security_groups, count.index)
+}
+
+locals {
+ vpc_networks = var.use_vpc_cidr ? [data.aws_vpc.this_vpc[0].cidr_block] : []
+ external_ingress_networks = compact(concat(local.vpc_networks, local.ingress_networks))
+ ingress_sg_names = zipmap(var.ingress_security_groups, data.aws_security_group.ingress_security_groups[*].name)
+ egress_sg_names = zipmap(var.egress_security_groups, data.aws_security_group.egress_security_groups[*].name)
+ self = var.enable_self ? [1] : []
+ short_description = var.short_description == "" ? var.description : var.short_description
+}
+
+resource "aws_security_group" "this_security_group" {
+ name = local.name
+ description = var.description
+ vpc_id = var.vpc_id
+ # vpc_id = "${data.aws_vpc.selected.id}"
+
+ # ingresss external port list (list + vpc if enabaled)
+ dynamic "ingress" {
+ for_each = local.port_map["external"]
+ iterator = p
+ content {
+ description = "${local.short_description}: ${p.value["description"]}"
+ from_port = p.value["from"]
+ to_port = p.value["to"]
+ protocol = p.value["proto"]
+ cidr_blocks = length(p.value["cidr"]) == 0 ? local.external_ingress_networks : p.value["cidr"]
+ }
+ }
+
+ # ingress security group ids (all)
+ dynamic "ingress" {
+ for_each = local.ingress_sg
+ iterator = sg
+ content {
+ description = "${local.short_description}: ${local.ingress_sg_names[sg.value]}"
+ from_port = 0
+ to_port = 0
+ protocol = -1
+ security_groups = [sg.value]
+ }
+ }
+
+ # ingress self (list with one or zero items)
+ dynamic "ingress" {
+ for_each = local.self
+ iterator = sg
+ content {
+ description = "${local.short_description}: from self"
+ from_port = 0
+ to_port = 0
+ protocol = -1
+ self = true
+ }
+ }
+
+ # egress all
+ egress {
+ description = "${local.short_description}: All"
+ from_port = 0
+ to_port = 0
+ protocol = -1
+ cidr_blocks = local.egress_networks
+ }
+
+ # egress security group ids (all)
+ dynamic "egress" {
+ for_each = local.egress_sg
+ iterator = sg
+ content {
+ description = "${local.short_description}: ${local.egress_sg_names[sg]}"
+ from_port = 0
+ to_port = 0
+ protocol = -1
+ security_groups = [sg]
+ }
+ }
+
+ tags = merge(
+ map("Name", "sg-${local.name}"),
+ var.tags,
+ map("boc:tf_module_version", var._module_version),
+ map("boc:vpc:info", join(" ", compact(list(var.vpc_id, var.vpc_full_name)))),
+ )
+}
diff --git a/it-windows-base/output.tf b/it-windows-base/output.tf
new file mode 100644
index 0000000..fbdd35a
--- /dev/null
+++ b/it-windows-base/output.tf
@@ -0,0 +1,9 @@
+output "this_security_group_id" {
+ description = "Created security group ID"
+ value = aws_security_group.this_security_group.id
+}
+
+output "this_security_group_arn" {
+ description = "Created security group ARN"
+ value = aws_security_group.this_security_group.arn
+}
diff --git a/it-windows-base/ports.tf b/it-windows-base/ports.tf
new file mode 100644
index 0000000..b148f73
--- /dev/null
+++ b/it-windows-base/ports.tf
@@ -0,0 +1,50 @@
+# ports = list of list of
+# from_port
+# to_port
+# proto
+# description
+# cidr_block
+# list of: all, external (more added as needed)
+
+## % python modify-security-groups.py list sg-00fb5065
+## sg_id=sg-00fb5065 sg_name='it-windows-base' vpc_id=vpc-2ea5664b sg_description='Windows Common Base Security Group'
+## direction=ingress pft=udp,161,161 range=0.0.0.0/0
+## direction=ingress pft=tcp,1556,1556 range=10.193.0.0/22
+## direction=ingress pft=tcp,5986,5986 range=172.24.12.239/32
+## direction=ingress pft=tcp,3389,3389 range=148.129.0.0/16,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
+## direction=ingress pft=icmp,-1,-1 range=0.0.0.0/0
+## direction=egress pft=all range=0.0.0.0/0
+
+## this adds iperf3
+locals {
+ n_all = ["0.0.0.0/0"]
+ n_census = ["148.129.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]
+ n_mgmt = ["148.129.162.0/24", "148.129.95.0/24"]
+ n_backup = ["10.193.0.0/22"]
+ n_ansible = ["172.24.12.239/32"]
+ source_groups = ["all", "external"]
+ name = var.name
+ ports = [
+ [-1, -1, "icmp", "ICMP", local.n_all, ["external"]],
+ [161, 161, "udp", "SNMP", local.n_all, ["external"]],
+ [5201, 5201, "tcp", "iperf3", local.n_all, ["external"]],
+ [5201, 5201, "udp", "iperf3", local.n_all, ["external"]],
+ [1556, 1556, "tcp", "Netbackup", local.n_backup, ["external"]],
+ [3389, 3389, "tcp", "RDP", local.n_census, ["external"]],
+ [5986, 5986, "tcp", "WinRM-https", local.n_ansible, ["external"]],
+ ]
+
+ # these are ignored
+ ingress_networks = var.ingress_networks
+ egress_networks = var.egress_networks
+
+ # these are ignored
+ ingress_sg = var.ingress_security_groups
+ egress_sg = var.egress_security_groups
+
+ p_fields = ["from", "to", "proto", "description", "cidr", "source_group"]
+ p_map = [for p in local.ports : zipmap(local.p_fields, p)]
+ port_map = { for s in local.source_groups :
+ s => [for p in local.p_map : p if contains(p["source_group"], s)]
+ }
+}
diff --git a/it-windows-base/variables.tf b/it-windows-base/variables.tf
new file mode 100644
index 0000000..0e4f382
--- /dev/null
+++ b/it-windows-base/variables.tf
@@ -0,0 +1,83 @@
+#---
+# change between different modules as needed
+#---
+variable "name" {
+ description = "Security Group Name"
+ type = string
+ default = "it-windows-base"
+}
+
+variable "description" {
+ description = "Security Group Description"
+ type = string
+ default = "Windows Common Base Security Group"
+}
+
+variable "short_description" {
+ description = "Security Group Short Description"
+ type = string
+ default = "Windows"
+}
+
+variable "enable_self" {
+ description = "Enable|Disable self full access"
+ type = bool
+ default = false
+}
+
+variable "use_vpc_cidr" {
+ description = "Enable|Disable use of VPC CIDR block in the ingress_networks"
+ type = bool
+ default = false
+}
+
+#---
+# others with defaults
+#---
+variable "vpc_id" {
+ description = "VPC ID Number"
+ type = string
+}
+
+data "aws_vpc" "selected" {
+ id = "${var.vpc_id}"
+}
+
+variable "vpc_full_name" {
+ description = "VPC Name"
+ type = string
+ default = ""
+}
+
+variable "ingress_networks" {
+ description = "List of ingress networks for external access (not all ports)"
+ type = list(string)
+ default = ["0.0.0.0/0"]
+}
+
+variable "egress_networks" {
+ description = "List of egress networks (all ports)"
+ type = list(string)
+ default = ["0.0.0.0/0"]
+}
+
+variable "ingress_security_groups" {
+ description = "List of ingress security groups for all ports"
+ type = list(string)
+ default = []
+}
+
+variable "egress_security_groups" {
+ description = "List of egress security groups (all ports)"
+ type = list(string)
+ default = []
+}
+
+variable "tags" {
+ description = "Extra security group tags"
+ type = map
+ default = {
+ "CostAllocation" = "csvd:infrastructure"
+ "Environment" = "csvd-infrastructure"
+ }
+}
diff --git a/it-windows-base/version.tf b/it-windows-base/version.tf
new file mode 100644
index 0000000..84fd21a
--- /dev/null
+++ b/it-windows-base/version.tf
@@ -0,0 +1,5 @@
+variable "_module_version" {
+ description = "Module version number"
+ type = string
+ default = "1.0"
+}
diff --git a/it-windows-base/versions.tf b/it-windows-base/versions.tf
new file mode 100644
index 0000000..ac97c6a
--- /dev/null
+++ b/it-windows-base/versions.tf
@@ -0,0 +1,4 @@
+
+terraform {
+ required_version = ">= 0.12"
+}
diff --git a/ois-scanner/CHANGELOG.md b/ois-scanner/CHANGELOG.md
new file mode 100644
index 0000000..08af3d7
--- /dev/null
+++ b/ois-scanner/CHANGELOG.md
@@ -0,0 +1,7 @@
+# v1.16 -- 20200604
+
+* add version number, update tags
+
+# v1.17 -- 20200731
+
+* add variables from [it-windows-base](../it-windows-base)
diff --git a/ois-scanner/README.md b/ois-scanner/README.md
index 6e2ea16..e52c791 100644
--- a/ois-scanner/README.md
+++ b/ois-scanner/README.md
@@ -1,8 +1,8 @@
# About
-This describes how to use the aws-common-security-groups submodule for ois-scanner. This sets up
-a module for a security group in the respective VPC. When construting a new VPC, we want to include
-this module. This should be in each VPC we have, in production. We probably need a similar one
+This describes how to use the aws-common-security-groups submodule for ois-scanner. This sets up
+a module for a security group in the respective VPC. When construting a new VPC, we want to include
+this module. This should be in each VPC we have, in production. We probably need a similar one
for the CAT environment, but we'll tackle that when we get to it.
# Usage
@@ -18,45 +18,39 @@ module "ois-scanner" {
}
```
-## Required Inputs
+## Requirements
-The following input variables are required:
+| Name | Version |
+|------|---------|
+| terraform | >= 0.12 |
-### vpc\_id
+## Providers
-Description: VPC ID Number
+| Name | Version |
+|------|---------|
+| aws | n/a |
-Type: `string`
+## Inputs
-## Optional Inputs
-
-The following input variables are optional (have default values):
-
-### name
-
-Description: Security group Name
-
-Type: `string`
-
-Default: `"ois-scanner"`
-
-### tags
-
-Description: Extra security group tags
-
-Type: `map`
-
-Default: `