Skip to content

Commit

Permalink
fix
Browse files Browse the repository at this point in the history
  • Loading branch information
badra001 committed Jan 21, 2022
1 parent 9ea7fbd commit e745e30
Show file tree
Hide file tree
Showing 5 changed files with 84 additions and 93 deletions.
45 changes: 45 additions & 0 deletions .terraform-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
formatter: markdown table

header-from: main.tf
footer-from: ""

sections:
## hide: []
show:
- data-sources
- header
- footer
- inputs
- modules
- outputs
- providers
- requirements
- resources

output:
file: README.md
mode: replace
# mode: inject
# template: |-
# <!-- BEGIN_TF_DOCS -->
# {{ .Content }}
# <!-- END_TF_DOCS -->

## output-values:
## enabled: false
## from: ""
##
## sort:
## enabled: true
## by: name
##
## settings:
## anchor: true
## color: true
## default: true
## description: false
## escape: true
## indent: 2
## required: true
## sensitive: true
## type: true
116 changes: 31 additions & 85 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,96 +1,42 @@
# aws-dynamic-route53
<!-- BEGIN_TF_DOCS -->
## Requirements

## About
| Name | Version |
|------|---------|
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.66.0 |

This module will construct all the resources to allow for automated C2 DNS registration in Route53. This is largely sourced from the
AWS blog on [DNS in a Multiaccount Environment with Route53](https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/) . We have added to it to also do PTR registration, as well as
making it IPv6 ready.
## Providers

The [code](https://github.com/aws-samples/aws-lambda-ddns-function) from that blog is linked in as a submodule under [aws-lambda-ddns-function](aws-lambda-ddns-function/).
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.66.0 |

This code is intended to be deployed per region, and will handle all of the DNS registration for EC2
instances deployed, assumign specific tags exist.
## Modules

It will create:
No modules.

- DynamoDB Table (inf-dynamic-route53-{region})
- IAM Roles
- Lambda
- CloudWatch Events
- CloudWatch Log
## Resources

## Operation
| Name | Type |
|------|------|
| [aws_dynamodb_table.table](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource |
| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

See the the [blog](#blog) for full details on how it works. The short version is:
## Inputs

- Cloudwatch event on instance (starting, started, terminated)
- Run lambda
- On startup
- Get instance details (id, region, ipv4, ipv6)
- Determine zone from tag(s)
- Find zone
- Add records if found
- Log action
- Record in DDB name and details
- On terminate
- Get instance detail (id)
- search DDB table for id
- Remove records, if in table
- Log action
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
| <a name="input_component_tags"></a> [component\_tags](#input\_component\_tags) | Additional tags for Components (s3, kms, ddb) | `map(map(string))` | <pre>{<br> "ddb": {},<br> "kms": {},<br> "s3": {}<br>}</pre> | no |
| <a name="input_dynamodb_table"></a> [dynamodb\_table](#input\_dynamodb\_table) | Different DynamoDB table to override default of var.name) | `string` | `null` | no |
| <a name="input_name"></a> [name](#input\_name) | Name to use within all the created resources (default: inf-dynamic-route53) | `string` | `"inf-dynamic-route53"` | no |
| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |

## Outputs

## Tags

A number of tags will be used to affect behavior of the DNS entries.

### Tag: Name

The `Name` tag is the primary tag that will be used to determine the DNS name to create. It is expected to be a unique FQDN. If no Name
tag is provided, the hostname portion of the name will be constructed from the IP address:

* IPv4
* ip address: A.B.C.D
* hostname: ip-A-B-C-D
* IPv6 (TBD)

The domain portion of the `Name` tag must exist within Route53 in order for any records to be created.

### Tag: boc:dns:zone

The `boc:dns:zone` tag will be used in case we need to force a specific domain name on a host, either because it cannot obtain
the proper zone (domain) from the `Name` tag, of that a custom per-instance `Name` tag cannot be created. This latter condition
occurs for systems which work from a launch template, such as EMR or EKS.

### Tag: boc:dns:alias

The `boc:dns:alias` tag is used to create an alternate DNS name (CNAME), pointed to the primary name. It is an FQDN, and the same conditions
apply as with [Name](#tag--name).

# Links

## github aws-lambda-ddns-function
* https://github.com/aws-samples/aws-lambda-ddns-function
## Blog
* https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/


# Repository Setup Details

* One time

```script
git submodule add https://github.com/aws-samples/aws-lambda-ddns-function aws-lambda-ddns-function
git commit -m'add submodule' aws-lambda-ddns-function
```

* After first clone

```script
git submodule update --init
```

* Pull new stuff from submoduule

```script
git submodule foreach git pull origin master
```
No outputs.
<!-- END_TF_DOCS -->
4 changes: 2 additions & 2 deletions locals.tf
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
locals {
account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
region = data.aws_region.current.name
region = data.aws_region.current.name

base_tags = {
"boc:tf_module_version" = local._module_version
"boc:created_by" = "terraform"
}

name = format("%v-%v",var.name,local.region)
name = format("%v-%v", var.name, local.region)
}
10 changes: 5 additions & 5 deletions variables.tf
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
variable "name" {
description = "Name to use within all the created resources (default: inf-dynamic-route53)"
type = string
default = "inf-dynamic-route53"
type = string
default = "inf-dynamic-route53"
}


variable "dynamodb_table" {
description = "Different DynamoDB table to override default of var.name)
type = string
default = null
description = "Different DynamoDB table to override default of var.name)"
type = string
default = null
}


2 changes: 1 addition & 1 deletion versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,5 @@ terraform {
version = ">= 3.66.0"
}
}
# required_version = ">= 0.13"
# required_version = ">= 0.13"
}

0 comments on commit e745e30

Please sign in to comment.