* 2.8.0 -- 2024-12-16

  - ec2-settings
    - add settings for ebs (encrypt by default) and ec2 (enable imdsv2), block public sharing of ami and snapshots

CHANGELOG.md

@@ -378,3 +378,7 @@
 * 2.7.0 -- 2024-11-13
   - inventory
     - add inventory code for use in decommission (not a submodule at this time)
+
+* 2.8.0 -- 2024-12-16
+  - ec2-settings
+    - add settings for ebs (encrypt by default) and ec2 (enable imdsv2), block public sharing of ami and snapshots

common/version.tf

@@ -1,3 +1,3 @@
 locals {
-  _module_version = "2.7.0"
+  _module_version = "2.8.0"
 }

ec2-settings/README.md

@@ -0,0 +1,122 @@
+# aws-inf-setup :: iam-account-settings
+
+# Usage
+Here is a simple example, the one most commonly expected to be used.
+
+```hcl
+module "settings" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//iam-account-settings"
+
+  account_alias = "ma5-gov"
+  account_usage = "GovCloud Management Account"
+}
+```
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_account_alias.alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_alias) | resource |
+| [aws_iam_account_password_policy.account_settings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy) | resource |
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+| [aws_regions.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/regions) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_account_settings"></a> [account\_settings](#input\_account\_settings) | Map of account setting values to change.  See resource docs for aws\_iam\_account\_password\_policy for values | `map(string)` | `{}` | no |
+| <a name="input_account_usage"></a> [account\_usage](#input\_account\_usage) | AWS Account Usage (what we are using it for) | `string` | `""` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component (efs, s3, ebs, kms, role, policy, security-group). This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_console_url"></a> [console\_url](#output\_console\_url) | AWS Console URL |
+
+<!-- BEGIN_TF_DOCS -->
+# aws-inf-setup :: ec2-settings
+This module will setup several default per account and region.  It must be used in each region.
+
+* EBS
+  * default key (alias/aws/ebs)
+  * encrypt by default (using above key)
+  * blocks public sharing of snapshots
+* EC2
+  * blocks public sharing of AMIs
+  * sets instance metdata to allow v1 and v2
+  * makes imds token optional
+  * sets imds hop limit to 2
+  * enables metadata tags
+
+# Usage
+This module takes no attributes.
+
+```hcl
+module "ec2-settings" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//ec2-settings?ref=tf-upgrade"
+}
+```
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_ebs_default_kms_key.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_default_kms_key) | resource |
+| [aws_ebs_encryption_by_default.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_encryption_by_default) | resource |
+| [aws_ebs_snapshot_block_public_access.sharing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_snapshot_block_public_access) | resource |
+| [aws_ec2_image_block_public_access.sharing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_image_block_public_access) | resource |
+| [aws_ec2_instance_metadata_defaults.imds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_instance_metadata_defaults) | resource |
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_kms_key.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_key) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+| [aws_regions.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/regions) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component (efs, s3, ebs, kms, role, policy, security-group). This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+
+## Outputs
+
+No outputs.
+<!-- END_TF_DOCS -->

ec2-settings/_module_name.tf

@@ -0,0 +1,3 @@
+locals {
+  _module_name = "aws-inf-setup/ec2-settings"
+}

ec2-settings/data.tf

@@ -0,0 +1 @@
+../common/data.tf

ec2-settings/defaults.tf

@@ -0,0 +1 @@
+../common/defaults.tf

ec2-settings/main.tf

@@ -0,0 +1,68 @@
+/*
+* # aws-inf-setup :: ec2-settings
+* This module will setup several default per account and region.  It must be used in each region.
+*
+* * EBS
+*   * default key (alias/aws/ebs)
+*   * encrypt by default (using above key)
+*   * blocks public sharing of snapshots
+* * EC2
+*   * blocks public sharing of AMIs
+*   * sets instance metdata to allow v1 and v2
+*   * makes imds token optional
+*   * sets imds hop limit to 2
+*   * enables metadata tags
+*
+* # Usage
+* This module takes no attributes.
+*
+* ```hcl
+* module "ec2-settings" {
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//ec2-settings?ref=tf-upgrade"
+* }
+* ```
+*/
+
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+
+  base_tags = {
+    "boc:created_by"        = "terraform"
+    "boc:tf_module_version" = local._module_version
+    "boc:tf_module_name"    = local._module_name
+  }
+}
+
+#---
+# EBS
+#---
+data "aws_kms_key" "default" {
+  key_id = "alias/aws/ebs"
+}
+
+resource "aws_ebs_default_kms_key" "default" {
+  key_arn = aws_kms_key.default.arn
+}
+
+resource "aws_ebs_encryption_by_default" "default" {
+  enabled = true
+}
+
+resource "aws_ebs_snapshot_block_public_access" "sharing" {
+  state = "block-all-sharing"
+}
+
+#---
+# EC2
+#---
+resource "aws_ec2_image_block_public_access" "sharing" {
+  state = "block-new-sharing"
+}
+
+resource "aws_ec2_instance_metadata_defaults" "imds" {
+  http_endpoint               = "enabled"
+  http_tokens                 = "optional"
+  http_put_response_hop_limit = 2
+  instance_metadata_tags      = "enabled"
+}

ec2-settings/prefixes.tf

@@ -0,0 +1 @@
+../common/prefixes.tf

ec2-settings/variables.common.tf

@@ -0,0 +1 @@
+../common/variables.common.tf

ec2-settings/version.tf

@@ -0,0 +1 @@
+../common/version.tf

inventory/get-billing.sh

@@ -1,14 +1,13 @@
 #!/bin/bash
 
-VERSION="1.0.1"
+VERSION="1.0.2"
 
 caller=$(tf-aws sts get-caller-identity --query 'Arn' 2> /dev/null)
 if [ $(echo $caller | grep -c aws-us-gov) != 0 ]
 then
   echo "# partition is not commercial, exiting"
   exit 1
 fi
-exit
 
 lastmonth=$(date --date="-1 month" +%Y-%m-01)
 nextmonth=$(date --date="+1 month" +%Y-%m-01)