From 9a299fd38acb0a8ecafca39a4728c1b32ebfeac8 Mon Sep 17 00:00:00 2001
From: Timo Hajati <20628630+hajati@users.noreply.github.com>
Date: Wed, 6 Nov 2024 11:12:18 +0100
Subject: [PATCH 1/3] Allows blocking public access (by default)
---
README.md | 17 +++++++++++++++++
rds-s3-dumps.tf | 11 +++++++++++
variables.tf | 16 ++++++++++++++++
3 files changed, 44 insertions(+)
diff --git a/README.md b/README.md
index 16afa1a..8bdbf9a 100644
--- a/README.md
+++ b/README.md
@@ -1312,6 +1312,23 @@ Type: `string`
Default: `""`
+### [rds\_s3\_dump\_block\_public\_access](#input\_rds\_s3\_dump\_block\_public\_access)
+
+Description: Object that defines which public access should be blocked
+
+Type: `object({})`
+
+Default:
+
+```json
+{
+ "block_public_acls": true,
+ "block_public_policy": true,
+ "ignore_public_acls": true,
+ "restrict_public_buckets": true
+}
+```
+
### [rds\_s3\_dump\_lifecycle\_rules](#input\_rds\_s3\_dump\_lifecycle\_rules)
Description: RDS S3 Dump Lifecycle rules
diff --git a/rds-s3-dumps.tf b/rds-s3-dumps.tf
index c1377fe..527ae3f 100644
--- a/rds-s3-dumps.tf
+++ b/rds-s3-dumps.tf
@@ -158,6 +158,17 @@ resource "aws_s3_bucket_acl" "rds_dumps" {
acl = "private"
}
+resource "aws_s3_bucket_public_access_block" "archive" {
+ count = local.rds_dumps_enabled ? 1 : 0
+
+ bucket = aws_s3_bucket.rds_dumps[count.index].id
+
+ block_public_acls = var.rds_s3_dump_block_public_access.block_public_acls
+ block_public_policy = var.rds_s3_dump_block_public_access.block_public_policy
+ ignore_public_acls = var.rds_s3_dump_block_public_access.ignore_public_acls
+ restrict_public_buckets = var.rds_s3_dump_block_public_access.restrict_public_buckets
+}
+
resource "aws_iam_role_policy" "rds_dumps_role" {
count = local.rds_dumps_enabled && var.rds_s3_dump_role_arn == "" ? 1 : 0
diff --git a/variables.tf b/variables.tf
index 167ab98..390d793 100644
--- a/variables.tf
+++ b/variables.tf
@@ -787,6 +787,22 @@ variable "rds_s3_dump_role_arn" {
default = ""
}
+variable "rds_s3_dump_block_public_access" {
+ description = "Object that defines which public access should be blocked"
+ type = object({
+ block_public_acls = bool
+ block_public_policy = bool
+ ignore_public_acls = bool
+ restrict_public_buckets = bool
+ })
+ default = {
+ block_public_acls = true
+ block_public_policy = true
+ ignore_public_acls = true
+ restrict_public_buckets = true
+ }
+}
+
variable "rds_s3_dump_lifecycle_rules" {
description = "RDS S3 Dump Lifecycle rules"
default = []
From 77f3e965fde9ff393d1db943b3c6aa584c73c4a2 Mon Sep 17 00:00:00 2001
From: Timo Hajati <20628630+hajati@users.noreply.github.com>
Date: Wed, 6 Nov 2024 11:13:35 +0100
Subject: [PATCH 2/3] Fixes automatic subdomain name generation by adjusting
renamed output of rds module
---
route53.tf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/route53.tf b/route53.tf
index 338175a..b170c29 100644
--- a/route53.tf
+++ b/route53.tf
@@ -4,7 +4,7 @@
locals {
public_endpoint_enabled = var.aws_route53_zone_endpoints_enabled && var.aws_route53_zone_public_endpoint_enabled
private_endpoint_enabled = var.aws_route53_zone_endpoints_enabled && var.aws_route53_zone_private_endpoint_enabled
- subdomain_name = length(var.aws_route53_rds_subdomain_override) > 0 ? var.aws_route53_rds_subdomain_override : join(".", [module.rds.db_instance_id, local.rds_dns_subdomains[var.rds_engine]])
+ subdomain_name = length(var.aws_route53_rds_subdomain_override) > 0 ? var.aws_route53_rds_subdomain_override : join(".", [module.rds.db_instance_identifier, local.rds_dns_subdomains[var.rds_engine]])
}
data "aws_route53_zone" "public_endpoint" {
From d8a4f0bbcc3b897031d9ca2074d80e8c3c223551 Mon Sep 17 00:00:00 2001
From: Timo Hajati <20628630+hajati@users.noreply.github.com>
Date: Wed, 6 Nov 2024 11:29:59 +0100
Subject: [PATCH 3/3] fmt
---
README.md | 11 ++++++++++-
variables.tf | 2 +-
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/README.md b/README.md
index 8bdbf9a..5697c5d 100644
--- a/README.md
+++ b/README.md
@@ -1316,7 +1316,16 @@ Default: `""`
Description: Object that defines which public access should be blocked
-Type: `object({})`
+Type:
+
+```hcl
+object({
+ block_public_acls = bool
+ block_public_policy = bool
+ ignore_public_acls = bool
+ restrict_public_buckets = bool
+ })
+```
Default:
diff --git a/variables.tf b/variables.tf
index 390d793..7ad8fcd 100644
--- a/variables.tf
+++ b/variables.tf
@@ -789,7 +789,7 @@ variable "rds_s3_dump_role_arn" {
variable "rds_s3_dump_block_public_access" {
description = "Object that defines which public access should be blocked"
- type = object({
+ type = object({
block_public_acls = bool
block_public_policy = bool
ignore_public_acls = bool