Browse Source

Updates tags for DynamoDB code to mirror console | tfsec/checkov updates

Minor tweaks in the TF code to mirror the Console especially concerning AWS owned keys for the Lock table in Teleport and the table in Vault. The syntax is now aligned to the console. tfsec/checkov ignore comments as well.

Point in time recovery should be enabled to protect DynamoDB table. Point-in-time recovery is not enabled.
ID - aws-dynamodb-enable-recovery
Severity - Medium
Impact - Accidental or malicious writes and deletes can't be rolled back
Resolution - Enable point in time recovery

tfsec ref - https://aquasecurity.github.io/tfsec/v1.26.3/checks/aws/dynamodb/enable-recovery/
checkov - https://docs.bridgecrew.io/docs/general_6
AWS - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery.html

=================================================================================

False Positive -> DAX Cluster and tables should always encrypt data at rest. Table encryption is not enabled.
ID - aws-dynamodb-enable-at-rest-encryption
Severity - High
Impact - Data can be freely read if compromised
Resolution - Enable encryption at rest for DAX Cluster

tfsec ref - https://aquasecurity.github.io/tfsec/v1.26.3/checks/aws/dynamodb/enable-at-rest-encryption/
checkov - https://docs.bridgecrew.io/docs/ensure-that-dynamodb-tables-are-encrypted
AWS - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html
Jeremy Cooper [AFS MBP] 3 năm trước cách đây
mục cha
commit
4e56361fb7

+ 1 - 1
prod/aws-us-gov/mdr-prod-c2/090-instance-teleport/terragrunt.hcl

@@ -13,7 +13,7 @@ locals {
 # working directory, into a temporary folder, and execute your Terraform commands in that folder.
 terraform {
   # Double slash is intentional and required to show root of modules
-  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/teleport-single-instance?ref=v5.0.8"
+  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/teleport-single-instance?ref=v5.1.8"
 }
 
 dependency "vpc-system-services" {

+ 1 - 1
prod/aws-us-gov/mdr-prod-c2/090-instance-vault/terragrunt.hcl

@@ -13,7 +13,7 @@ locals {
 # working directory, into a temporary folder, and execute your Terraform commands in that folder.
 terraform {
   # Double slash is intentional and required to show root of modules
-  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/vault?ref=v5.1.6"
+  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/vault?ref=v5.1.8"
 }
 
 dependency "vpc-system-services" {

+ 1 - 1
test/aws-us-gov/mdr-test-c2/090-instance-teleport/terragrunt.hcl

@@ -13,7 +13,7 @@ locals {
 # working directory, into a temporary folder, and execute your Terraform commands in that folder.
 terraform {
   # Double slash is intentional and required to show root of modules
-  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/teleport-single-instance?ref=v5.0.5"
+  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/teleport-single-instance?ref=v5.1.8"
 }
 
 dependency "vpc-system-services" {

+ 1 - 1
test/aws-us-gov/mdr-test-c2/090-instance-vault/terragrunt.hcl

@@ -13,7 +13,7 @@ locals {
 # working directory, into a temporary folder, and execute your Terraform commands in that folder.
 terraform {
   # Double slash is intentional and required to show root of modules
-  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/vault?ref=v5.1.6"
+  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/vault?ref=v5.1.8"
 }
 
 dependency "vpc-system-services" {