generated from terraform-modules/template_aws_module
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
84 additions
and
93 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| formatter: markdown table | ||
|
|
||
| header-from: main.tf | ||
| footer-from: "" | ||
|
|
||
| sections: | ||
| ## hide: [] | ||
| show: | ||
| - data-sources | ||
| - header | ||
| - footer | ||
| - inputs | ||
| - modules | ||
| - outputs | ||
| - providers | ||
| - requirements | ||
| - resources | ||
|
|
||
| output: | ||
| file: README.md | ||
| mode: replace | ||
| # mode: inject | ||
| # template: |- | ||
| # <!-- BEGIN_TF_DOCS --> | ||
| # {{ .Content }} | ||
| # <!-- END_TF_DOCS --> | ||
|
|
||
| ## output-values: | ||
| ## enabled: false | ||
| ## from: "" | ||
| ## | ||
| ## sort: | ||
| ## enabled: true | ||
| ## by: name | ||
| ## | ||
| ## settings: | ||
| ## anchor: true | ||
| ## color: true | ||
| ## default: true | ||
| ## description: false | ||
| ## escape: true | ||
| ## indent: 2 | ||
| ## required: true | ||
| ## sensitive: true | ||
| ## type: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,96 +1,42 @@ | ||
| # aws-dynamic-route53 | ||
| <!-- BEGIN_TF_DOCS --> | ||
| ## Requirements | ||
|
|
||
| ## About | ||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.66.0 | | ||
|
|
||
| This module will construct all the resources to allow for automated C2 DNS registration in Route53. This is largely sourced from the | ||
| AWS blog on [DNS in a Multiaccount Environment with Route53](https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/) . We have added to it to also do PTR registration, as well as | ||
| making it IPv6 ready. | ||
| ## Providers | ||
|
|
||
| The [code](https://github.com/aws-samples/aws-lambda-ddns-function) from that blog is linked in as a submodule under [aws-lambda-ddns-function](aws-lambda-ddns-function/). | ||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.66.0 | | ||
|
|
||
| This code is intended to be deployed per region, and will handle all of the DNS registration for EC2 | ||
| instances deployed, assumign specific tags exist. | ||
| ## Modules | ||
|
|
||
| It will create: | ||
| No modules. | ||
|
|
||
| - DynamoDB Table (inf-dynamic-route53-{region}) | ||
| - IAM Roles | ||
| - Lambda | ||
| - CloudWatch Events | ||
| - CloudWatch Log | ||
| ## Resources | ||
|
|
||
| ## Operation | ||
| | Name | Type | | ||
| |------|------| | ||
| | [aws_dynamodb_table.table](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource | | ||
| | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | ||
| | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | ||
| | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | | ||
|
|
||
| See the the [blog](#blog) for full details on how it works. The short version is: | ||
| ## Inputs | ||
|
|
||
| - Cloudwatch event on instance (starting, started, terminated) | ||
| - Run lambda | ||
| - On startup | ||
| - Get instance details (id, region, ipv4, ipv6) | ||
| - Determine zone from tag(s) | ||
| - Find zone | ||
| - Add records if found | ||
| - Log action | ||
| - Record in DDB name and details | ||
| - On terminate | ||
| - Get instance detail (id) | ||
| - search DDB table for id | ||
| - Remove records, if in table | ||
| - Log action | ||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no | | ||
| | <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no | | ||
| | <a name="input_component_tags"></a> [component\_tags](#input\_component\_tags) | Additional tags for Components (s3, kms, ddb) | `map(map(string))` | <pre>{<br> "ddb": {},<br> "kms": {},<br> "s3": {}<br>}</pre> | no | | ||
| | <a name="input_dynamodb_table"></a> [dynamodb\_table](#input\_dynamodb\_table) | Different DynamoDB table to override default of var.name) | `string` | `null` | no | | ||
| | <a name="input_name"></a> [name](#input\_name) | Name to use within all the created resources (default: inf-dynamic-route53) | `string` | `"inf-dynamic-route53"` | no | | ||
| | <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no | | ||
| | <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no | | ||
|
|
||
| ## Outputs | ||
|
|
||
| ## Tags | ||
|
|
||
| A number of tags will be used to affect behavior of the DNS entries. | ||
|
|
||
| ### Tag: Name | ||
|
|
||
| The `Name` tag is the primary tag that will be used to determine the DNS name to create. It is expected to be a unique FQDN. If no Name | ||
| tag is provided, the hostname portion of the name will be constructed from the IP address: | ||
|
|
||
| * IPv4 | ||
| * ip address: A.B.C.D | ||
| * hostname: ip-A-B-C-D | ||
| * IPv6 (TBD) | ||
|
|
||
| The domain portion of the `Name` tag must exist within Route53 in order for any records to be created. | ||
|
|
||
| ### Tag: boc:dns:zone | ||
|
|
||
| The `boc:dns:zone` tag will be used in case we need to force a specific domain name on a host, either because it cannot obtain | ||
| the proper zone (domain) from the `Name` tag, of that a custom per-instance `Name` tag cannot be created. This latter condition | ||
| occurs for systems which work from a launch template, such as EMR or EKS. | ||
|
|
||
| ### Tag: boc:dns:alias | ||
|
|
||
| The `boc:dns:alias` tag is used to create an alternate DNS name (CNAME), pointed to the primary name. It is an FQDN, and the same conditions | ||
| apply as with [Name](#tag--name). | ||
|
|
||
| # Links | ||
|
|
||
| ## github aws-lambda-ddns-function | ||
| * https://github.com/aws-samples/aws-lambda-ddns-function | ||
| ## Blog | ||
| * https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/ | ||
|
|
||
|
|
||
| # Repository Setup Details | ||
|
|
||
| * One time | ||
|
|
||
| ```script | ||
| git submodule add https://github.com/aws-samples/aws-lambda-ddns-function aws-lambda-ddns-function | ||
| git commit -m'add submodule' aws-lambda-ddns-function | ||
| ``` | ||
|
|
||
| * After first clone | ||
|
|
||
| ```script | ||
| git submodule update --init | ||
| ``` | ||
|
|
||
| * Pull new stuff from submoduule | ||
|
|
||
| ```script | ||
| git submodule foreach git pull origin master | ||
| ``` | ||
| No outputs. | ||
| <!-- END_TF_DOCS --> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,12 @@ | ||
| locals { | ||
| account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id | ||
| account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew" | ||
| region = data.aws_region.current.name | ||
| region = data.aws_region.current.name | ||
|
|
||
| base_tags = { | ||
| "boc:tf_module_version" = local._module_version | ||
| "boc:created_by" = "terraform" | ||
| } | ||
|
|
||
| name = format("%v-%v",var.name,local.region) | ||
| name = format("%v-%v", var.name, local.region) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,14 @@ | ||
| variable "name" { | ||
| description = "Name to use within all the created resources (default: inf-dynamic-route53)" | ||
| type = string | ||
| default = "inf-dynamic-route53" | ||
| type = string | ||
| default = "inf-dynamic-route53" | ||
| } | ||
|
|
||
|
|
||
| variable "dynamodb_table" { | ||
| description = "Different DynamoDB table to override default of var.name) | ||
| type = string | ||
| default = null | ||
| description = "Different DynamoDB table to override default of var.name)" | ||
| type = string | ||
| default = null | ||
| } | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,5 +5,5 @@ terraform { | |
| version = ">= 3.66.0" | ||
| } | ||
| } | ||
| # required_version = ">= 0.13" | ||
| # required_version = ">= 0.13" | ||
| } | ||