Skip to content

Commit c86136b

Browse files
author
AWS
committed
Release: 1.8.0
1 parent dc3eb7c commit c86136b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+776
-294
lines changed

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.7.0
1+
1.8.0

‎main.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@ module "aft_ssm_parameters" {
188188
aft_controltower_events_table_name = module.aft_account_request_framework.controltower_events_table_name
189189
account_factory_product_name = module.aft_account_request_framework.account_factory_product_name
190190
aft_invoke_aft_account_provisioning_framework_function_name = module.aft_account_request_framework.invoke_aft_account_provisioning_framework_lambda_function_name
191+
aft_cleanup_resources_function_name = module.aft_account_request_framework.aft_cleanup_resources_function_name
191192
aft_account_provisioning_framework_sfn_name = module.aft_account_request_framework.aft_account_provisioning_framework_sfn_name
192193
aft_sns_topic_arn = module.aft_account_request_framework.sns_topic_arn
193194
aft_failure_sns_topic_arn = module.aft_account_request_framework.failure_sns_topic_arn
@@ -227,7 +228,7 @@ module "aft_ssm_parameters" {
227228
aft_config_backend_secondary_region = var.tf_backend_secondary_region
228229
aft_framework_repo_url = var.aft_framework_repo_url
229230
aft_framework_repo_git_ref = local.aft_framework_repo_git_ref
230-
terraform_token = var.terraform_token
231+
terraform_token = var.terraform_token # Null default value #tfsec:ignore:general-secrets-no-plaintext-exposure
231232
terraform_version = var.terraform_version
232233
terraform_org_name = var.terraform_org_name
233234
aft_feature_cloudtrail_data_events = var.aft_feature_cloudtrail_data_events

‎modules/aft-account-provisioning-framework/iam/role-policies/iam-aft-states.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,16 @@
5252
"Resource": [
5353
"arn:${data_aws_partition_current_partition}:events:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:rule/StepFunctionsGetEventForCodeBuildStartBuildRule"
5454
]
55+
},
56+
{
57+
"Effect": "Allow",
58+
"Action": [
59+
"states:DescribeExecution"
60+
],
61+
"Resource": [
62+
"arn:${data_aws_partition_current_partition}:states:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:execution:aft-*"
63+
]
5564
}
65+
5666
]
5767
}

‎modules/aft-account-provisioning-framework/lambda.tf‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#
44

55
### CREATE ROLE FUNCTION
6-
6+
#tfsec:ignore:aws-lambda-enable-tracing
77
resource "aws_lambda_function" "create_role" {
88
filename = var.provisioning_framework_archive_path
99
function_name = "aft-account-provisioning-framework-create-aft-execution-role"
@@ -22,14 +22,15 @@ resource "aws_lambda_function" "create_role" {
2222
}
2323
}
2424

25+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
2526
resource "aws_cloudwatch_log_group" "create_role" {
2627
name = "/aws/lambda/${aws_lambda_function.create_role.function_name}"
2728
retention_in_days = var.cloudwatch_log_group_retention
2829
}
2930

3031

3132
### TAG ACCOUNT FUNCTION
32-
33+
#tfsec:ignore:aws-lambda-enable-tracing
3334
resource "aws_lambda_function" "tag_account" {
3435
filename = var.provisioning_framework_archive_path
3536
function_name = "aft-account-provisioning-framework-tag-account"
@@ -48,13 +49,14 @@ resource "aws_lambda_function" "tag_account" {
4849
}
4950
}
5051

52+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
5153
resource "aws_cloudwatch_log_group" "tag_account" {
5254
name = "/aws/lambda/${aws_lambda_function.tag_account.function_name}"
5355
retention_in_days = var.cloudwatch_log_group_retention
5456
}
5557

5658
### PERSIST METADATA FUNCTION
57-
59+
#tfsec:ignore:aws-lambda-enable-tracing
5860
resource "aws_lambda_function" "persist_metadata" {
5961
filename = var.provisioning_framework_archive_path
6062
function_name = "aft-account-provisioning-framework-persist-metadata"
@@ -73,6 +75,7 @@ resource "aws_lambda_function" "persist_metadata" {
7375
}
7476
}
7577

78+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
7679
resource "aws_cloudwatch_log_group" "persist_metadata" {
7780
name = "/aws/lambda/${aws_lambda_function.persist_metadata.function_name}"
7881
retention_in_days = var.cloudwatch_log_group_retention
@@ -81,7 +84,7 @@ resource "aws_cloudwatch_log_group" "persist_metadata" {
8184
### Account Metadata SSM Function
8285

8386

84-
87+
#tfsec:ignore:aws-lambda-enable-tracing
8588
resource "aws_lambda_function" "account_metadata_ssm" {
8689
filename = var.provisioning_framework_archive_path
8790
function_name = "aft-account-provisioning-framework-account-metadata-ssm"
@@ -100,6 +103,7 @@ resource "aws_lambda_function" "account_metadata_ssm" {
100103
}
101104
}
102105

106+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
103107
resource "aws_cloudwatch_log_group" "account_metadata_ssm" {
104108
name = "/aws/lambda/${aws_lambda_function.account_metadata_ssm.function_name}"
105109
retention_in_days = var.cloudwatch_log_group_retention

‎modules/aft-account-request-framework/iam.tf‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,8 @@ resource "aws_iam_role_policy" "aft_account_request_action_trigger" {
7171
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft-management.account_id
7272
aws_sns_topic_aft_notifications_arn = aws_sns_topic.aft_notifications.arn
7373
aws_sns_topic_aft_failure_notifications_arn = aws_sns_topic.aft_failure_notifications.arn
74-
data_aws_region_aft-management_name = data.aws_region.aft-management.name
75-
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft-management.account_id
7674
aws_lambda_function_invoke_aft_account_provisioning_framework_arn = aws_lambda_function.aft_invoke_aft_account_provisioning_framework.arn
75+
aws_lambda_function_cleanup_resources_arn = aws_lambda_function.aft_cleanup_resources.arn
7776
aws_sqs_queue_aft_account_request_arn = aws_sqs_queue.aft_account_request.arn
7877
aws_kms_key_aft_arn = aws_kms_key.aft.arn
7978
aws_dynamodb_table_aft-request_name = aws_dynamodb_table.aft_request.name
@@ -150,7 +149,7 @@ resource "aws_iam_role_policy_attachment" "aft_invoke_aft_account_provisioning_f
150149
}
151150

152151
resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework" {
153-
name = "aft-account-request-action-trigger"
152+
name = "aft-invoke-account-provisioning-framework"
154153
role = aws_iam_role.aft_invoke_aft_account_provisioning_framework.id
155154

156155
policy = templatefile("${path.module}/iam/role-policies/lambda-invoke-aft-account-provisioning-framework.tpl", {
@@ -165,6 +164,32 @@ resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework" {
165164
})
166165
}
167166

167+
######### cleanup-aft-resourcess #########
168+
resource "aws_iam_role" "aft_cleanup_resources" {
169+
name = "aft-lambda-cleanup-resources"
170+
assume_role_policy = templatefile("${path.module}/iam/trust-policies/lambda.tpl", { none = "none" })
171+
}
172+
173+
resource "aws_iam_role_policy_attachment" "aft_cleanup_resources" {
174+
count = length(local.lambda_managed_policies)
175+
role = aws_iam_role.aft_cleanup_resources.name
176+
policy_arn = local.lambda_managed_policies[count.index]
177+
}
178+
179+
resource "aws_iam_role_policy" "aft_cleanup_resources" {
180+
name = "aft-cleanup-resources"
181+
role = aws_iam_role.aft_cleanup_resources.id
182+
183+
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-cleanup-resources.tpl", {
184+
data_aws_partition_current_partition = data.aws_partition.current.partition
185+
data_aws_region_aft-management_name = data.aws_region.aft-management.name
186+
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft-management.account_id
187+
aws_sns_topic_aft_notifications_arn = aws_sns_topic.aft_notifications.arn
188+
aws_sns_topic_aft_failure_notifications_arn = aws_sns_topic.aft_failure_notifications.arn
189+
aws_dynamodb_table_aft-request-metadata_name = aws_dynamodb_table.aft_request_metadata.name
190+
aws_kms_key_aft_arn = aws_kms_key.aft.arn
191+
})
192+
}
168193

169194
######### aft_aws_backup #########
170195

‎modules/aft-account-request-framework/iam/role-policies/aft-states.tpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,14 @@
1414
"Resource": [
1515
"arn:${data_aws_partition_current_partition}:lambda:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:function:aft_*"
1616
]
17+
},
18+
{
19+
"Effect": "Allow",
20+
"Action": [
21+
"states:DescribeExecution"
22+
],
23+
"Resource": "${aft_account_provisioning_customizations_sfn_name}"
1724
}
25+
1826
]
1927
}

‎modules/aft-account-request-framework/iam/role-policies/lambda-account-request-action-trigger.tpl‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,19 @@
99
],
1010
"Resource": "arn:${data_aws_partition_current_partition}:dynamodb:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:table/${aws_dynamodb_table_aft-request-audit_name}"
1111
},
12+
{
13+
"Effect": "Allow",
14+
"Action": [
15+
"lambda:InvokeFunction"
16+
],
17+
"Resource": [
18+
"${aws_lambda_function_invoke_aft_account_provisioning_framework_arn}",
19+
"${aws_lambda_function_cleanup_resources_arn}"
20+
]
21+
},
1222
{
1323
"Effect": "Allow",
1424
"Action": [
15-
"lambda:InvokeFunction",
1625
"dynamodb:GetShardIterator",
1726
"dynamodb:DescribeStream",
1827
"dynamodb:GetRecords",
@@ -22,7 +31,6 @@
2231
],
2332
"Resource": [
2433
"arn:${data_aws_partition_current_partition}:dynamodb:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:table/${aws_dynamodb_table_aft-request_name}/stream/*",
25-
"${aws_lambda_function_invoke_aft_account_provisioning_framework_arn}",
2634
"${aws_sqs_queue_aft_account_request_arn}"
2735
]
2836
},

‎modules/aft-account-request-framework/iam/role-policies/lambda-aft-cleanup-resources.tpl‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"dynamodb:GetItem",
8+
"dynamodb:DeleteItem"
9+
],
10+
"Resource": [
11+
"arn:${data_aws_partition_current_partition}:dynamodb:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:table/${aws_dynamodb_table_aft-request-metadata_name}"
12+
]
13+
},
14+
{
15+
"Effect": "Allow",
16+
"Action": [
17+
"codepipeline:ListPipelineExecutions",
18+
"codepipeline:ListPipelines",
19+
"codepipeline:ListTagsForResource",
20+
"codepipeline:DeletePipeline"
21+
],
22+
"Resource": [
23+
"arn:${data_aws_partition_current_partition}:codepipeline:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:*"
24+
]
25+
},
26+
{
27+
"Effect": "Allow",
28+
"Action": "ssm:GetParameter",
29+
"Resource": [
30+
"arn:${data_aws_partition_current_partition}:ssm:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:parameter/aft/*"
31+
]
32+
},
33+
{
34+
"Effect": "Allow",
35+
"Action": [
36+
"sts:AssumeRole"
37+
],
38+
"Resource": [
39+
"arn:${data_aws_partition_current_partition}:iam::${data_aws_caller_identity_aft-management_account_id}:role/AWSAFTAdmin"
40+
]
41+
},
42+
{
43+
"Effect": "Allow",
44+
"Action": "sts:GetCallerIdentity",
45+
"Resource": "*"
46+
},
47+
{
48+
"Effect": "Allow",
49+
"Action": [
50+
"sns:Publish"
51+
],
52+
"Resource": [
53+
"${aws_sns_topic_aft_notifications_arn}",
54+
"${aws_sns_topic_aft_failure_notifications_arn}"
55+
]
56+
},
57+
{
58+
"Effect": "Allow",
59+
"Action": [
60+
"kms:GenerateDataKey",
61+
"kms:Encrypt",
62+
"kms:Decrypt"
63+
],
64+
"Resource": [
65+
"${aws_kms_key_aft_arn}",
66+
"arn:${data_aws_partition_current_partition}:kms:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:alias/aws/sns"
67+
]
68+
}
69+
]
70+
}

‎modules/aft-account-request-framework/lambda.tf‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
#
44
######## aft_account_request_audit_trigger ########
55

6+
#tfsec:ignore:aws-lambda-enable-tracing
67
resource "aws_lambda_function" "aft_account_request_audit_trigger" {
78

89
filename = var.request_framework_archive_path
@@ -38,14 +39,15 @@ resource "aws_lambda_event_source_mapping" "aft_account_request_audit_trigger" {
3839
maximum_retry_attempts = 1
3940
}
4041

42+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
4143
resource "aws_cloudwatch_log_group" "aft_account_request_audit_trigger" {
4244
name = "/aws/lambda/${aws_lambda_function.aft_account_request_audit_trigger.function_name}"
4345
retention_in_days = var.cloudwatch_log_group_retention
4446
}
4547

4648
######## aft_account_request_action_trigger ########
4749

48-
50+
#tfsec:ignore:aws-lambda-enable-tracing
4951
resource "aws_lambda_function" "aft_account_request_action_trigger" {
5052

5153
filename = var.request_framework_archive_path
@@ -75,14 +77,15 @@ resource "aws_lambda_event_source_mapping" "aft_account_request_action_trigger"
7577
maximum_retry_attempts = 1
7678
}
7779

80+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
7881
resource "aws_cloudwatch_log_group" "aft_account_request_action_trigger" {
7982
name = "/aws/lambda/${aws_lambda_function.aft_account_request_action_trigger.function_name}"
8083
retention_in_days = var.cloudwatch_log_group_retention
8184
}
8285

8386
######## aft_controltower_event_logger ########
8487

85-
88+
#tfsec:ignore:aws-lambda-enable-tracing
8689
resource "aws_lambda_function" "aft_controltower_event_logger" {
8790

8891
filename = var.request_framework_archive_path
@@ -111,14 +114,15 @@ resource "aws_lambda_permission" "aft_controltower_event_logger" {
111114
source_arn = aws_cloudwatch_event_rule.aft_controltower_event_trigger.arn
112115
}
113116

117+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
114118
resource "aws_cloudwatch_log_group" "aft_controltower_event_logger" {
115119
name = "/aws/lambda/${aws_lambda_function.aft_controltower_event_logger.function_name}"
116120
retention_in_days = var.cloudwatch_log_group_retention
117121
}
118122

119123
######## aft_account_request_processor ########
120124

121-
125+
#tfsec:ignore:aws-lambda-enable-tracing
122126
resource "aws_lambda_function" "aft_account_request_processor" {
123127

124128
filename = var.request_framework_archive_path
@@ -148,14 +152,15 @@ resource "aws_lambda_permission" "aft_account_request_processor" {
148152
source_arn = aws_cloudwatch_event_rule.aft_account_request_processor.arn
149153
}
150154

155+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
151156
resource "aws_cloudwatch_log_group" "aft_account_request_processor" {
152157
name = "/aws/lambda/${aws_lambda_function.aft_account_request_processor.function_name}"
153158
retention_in_days = var.cloudwatch_log_group_retention
154159
}
155160

156161
######## aft_invoke_aft_account_provisioning_framework ########
157162

158-
163+
#tfsec:ignore:aws-lambda-enable-tracing
159164
resource "aws_lambda_function" "aft_invoke_aft_account_provisioning_framework" {
160165

161166
filename = var.request_framework_archive_path
@@ -185,7 +190,38 @@ resource "aws_lambda_permission" "aft_invoke_aft_account_provisioning_framework"
185190
source_arn = aws_cloudwatch_event_rule.aft_controltower_event_trigger.arn
186191
}
187192

193+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
188194
resource "aws_cloudwatch_log_group" "aft_invoke_aft_account_provisioning_framework" {
189195
name = "/aws/lambda/${aws_lambda_function.aft_invoke_aft_account_provisioning_framework.function_name}"
190196
retention_in_days = var.cloudwatch_log_group_retention
191197
}
198+
199+
######## aft_cleanup_resources ########
200+
201+
#tfsec:ignore:aws-lambda-enable-tracing
202+
resource "aws_lambda_function" "aft_cleanup_resources" {
203+
204+
filename = var.request_framework_archive_path
205+
function_name = "aft-cleanup-resources"
206+
description = "Removes AFT pipeline resources when an account record is removed from the AFT repo"
207+
role = aws_iam_role.aft_cleanup_resources.arn
208+
handler = "aft_cleanup_resources.lambda_handler"
209+
210+
source_code_hash = var.request_framework_archive_hash
211+
memory_size = 1024
212+
runtime = "python3.8"
213+
timeout = "300"
214+
layers = [var.aft_common_layer_arn]
215+
216+
vpc_config {
217+
subnet_ids = tolist([aws_subnet.aft_vpc_private_subnet_01.id, aws_subnet.aft_vpc_private_subnet_02.id])
218+
security_group_ids = tolist([aws_security_group.aft_vpc_default_sg.id])
219+
}
220+
221+
}
222+
223+
#tfsec:ignore:aws-cloudwatch-log-group-customer-key
224+
resource "aws_cloudwatch_log_group" "aft_cleanup_resources" {
225+
name = "/aws/lambda/${aws_lambda_function.aft_cleanup_resources.function_name}"
226+
retention_in_days = var.cloudwatch_log_group_retention
227+
}

‎modules/aft-account-request-framework/outputs.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ output "account_factory_product_name" {
6262
output "invoke_aft_account_provisioning_framework_lambda_function_name" {
6363
value = aws_lambda_function.aft_invoke_aft_account_provisioning_framework.function_name
6464
}
65+
output "aft_cleanup_resources_function_name" {
66+
value = aws_lambda_function.aft_cleanup_resources.function_name
67+
}
6568
output "aft_account_provisioning_framework_sfn_name" {
6669
value = var.aft_account_provisioning_framework_sfn_name
6770
}

0 commit comments

Comments
 (0)