FEATURE: Add etcd rolling update document #132

smalltown · 2021-09-27T06:06:45Z

Add document for how to rolling update etcd cluster
Change external module source include method
Only add ssh key pair for K8s node when debug_node is true

bridgecrew

Bridgecrew has found 8 infrastructure configuration errors in this PR ⬇️

bridgecrew · 2021-09-27T06:07:04Z

modules/aws/kube-master/main.tf

@@ -99,7 +99,7 @@ resource "aws_launch_template" "master" {
    arn = aws_iam_instance_profile.master.arn
  }

-  key_name  = var.ssh_key
+  key_name  = var.debug_mode ? var.ssh_key : ""


AWS resources that support tags do not have Tags
Resource: aws_launch_template.master | ID: BC_AWS_GENERAL_26

How to Fix

resource "aws_security_group" "sg" { name = "my-sg" ... + tags = { + Environment = "dev" + Owner = "apps-team" + } }

Description
Many different types of AWS resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.
View AWS's recommended tagging best practices here.

Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-master/main.tf aws_autoscaling_group.master mixed_instances_policy.launch_template.launch_template_specification.launch_template_id

bridgecrew · 2021-09-27T06:07:04Z

modules/aws/kube-master/main.tf

@@ -99,7 +99,7 @@ resource "aws_launch_template" "master" {
    arn = aws_iam_instance_profile.master.arn
  }

-  key_name  = var.ssh_key
+  key_name  = var.debug_mode ? var.ssh_key : ""


Instance Metadata Service version 1 is enabled
Resource: aws_launch_template.master | ID: BC_AWS_GENERAL_31

How to Fix

resource "aws_instance" "example" { ... instance_type = "t2.micro" + metadata_options { ... + http_endpoint = "enabled" + http_tokens = "required" + } ... }

Description
The Instance Metadata Service (IMDS) is an on-instance component used by code on the instance to securely access instance metadata. You can access instance metadata from a running instance using one of the following methods: * Instance Metadata Service Version 1 (IMDSv1) – a request/response method * Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method
As a request/response method IMDSv1 is prone to local misconfigurations:

Open proxies, open NATs and routers, server-side reflection vulnerabilities.

One way or another, local software might access local-only data.

Benchmarks

FEDRAMP (MODERATE) AC-6

Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-master/main.tf aws_autoscaling_group.master mixed_instances_policy.launch_template.launch_template_specification.launch_template_id

bridgecrew · 2021-09-27T06:07:04Z

modules/aws/kube-etcd/main.tf

@@ -80,7 +80,7 @@ resource "aws_instance" "etcd" {

  ami                  = var.instance_config["image_id"]
  instance_type        = var.instance_config["ec2_type"]
-  key_name             = var.ssh_key
+  key_name             = var.debug_mode ? var.ssh_key : ""


Instance Metadata Service version 1 is enabled
Resource: aws_instance.etcd | ID: BC_AWS_GENERAL_31

How to Fix

resource "aws_instance" "example" { ... instance_type = "t2.micro" + metadata_options { ... + http_endpoint = "enabled" + http_tokens = "required" + } ... }

Description
The Instance Metadata Service (IMDS) is an on-instance component used by code on the instance to securely access instance metadata. You can access instance metadata from a running instance using one of the following methods: * Instance Metadata Service Version 1 (IMDSv1) – a request/response method * Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method
As a request/response method IMDSv1 is prone to local misconfigurations:

Open proxies, open NATs and routers, server-side reflection vulnerabilities.

One way or another, local software might access local-only data.

Benchmarks

FEDRAMP (MODERATE) AC-6

Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-etcd/main.tf aws_volume_attachment.etcd instance_id

bridgecrew · 2021-09-27T06:07:04Z

modules/aws/kube-etcd/main.tf

@@ -80,7 +80,7 @@ resource "aws_instance" "etcd" {

  ami                  = var.instance_config["image_id"]
  instance_type        = var.instance_config["ec2_type"]
-  key_name             = var.ssh_key
+  key_name             = var.debug_mode ? var.ssh_key : ""


EBS volumes do not have encrypted launch configurations
Resource: aws_instance.etcd | ID: BC_AWS_GENERAL_13

How to Fix

resource "aws_launch_configuration" "example" { ... instance_type = "t2.micro" + root_block_device { + encrypted = true + } ... }

Description
Amazon Elastic Block Store (EBS) volumes allow you to create encrypted launch configurations when creating EC2 instances and auto scaling. When the entire EBS volume is encrypted, data stored at rest on the volume, disk I/O, snapshots created from the volume, and data in-transit between EBS and EC2 are all encrypted.
Benchmarks

PCI-DSS V3.2 3

Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-etcd/main.tf aws_volume_attachment.etcd instance_id

bridgecrew · 2021-09-27T06:07:05Z

modules/aws/kube-etcd/main.tf

@@ -80,7 +80,7 @@ resource "aws_instance" "etcd" {

  ami                  = var.instance_config["image_id"]
  instance_type        = var.instance_config["ec2_type"]
-  key_name             = var.ssh_key
+  key_name             = var.debug_mode ? var.ssh_key : ""


EC2 EBS is not optimized
Resource: aws_instance.etcd | ID: BC_AWS_GENERAL_68

How to Fix

resource "aws_instance" "foo" { ... + ebs_optimized = true }

Description
TBA
Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-etcd/main.tf aws_volume_attachment.etcd instance_id

bridgecrew · 2021-09-27T06:07:05Z

modules/aws/kube-worker/main.tf

@@ -113,7 +113,7 @@ resource "aws_launch_template" "worker" {
    arn = aws_iam_instance_profile.worker.arn
  }

-  key_name  = var.ssh_key
+  key_name  = var.debug_mode ? var.ssh_key : ""


Instance Metadata Service version 1 is enabled
Resource: aws_launch_template.worker | ID: BC_AWS_GENERAL_31

How to Fix

resource "aws_instance" "example" { ... instance_type = "t2.micro" + metadata_options { ... + http_endpoint = "enabled" + http_tokens = "required" + } ... }

Description
The Instance Metadata Service (IMDS) is an on-instance component used by code on the instance to securely access instance metadata. You can access instance metadata from a running instance using one of the following methods: * Instance Metadata Service Version 1 (IMDSv1) – a request/response method * Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method
As a request/response method IMDSv1 is prone to local misconfigurations:

Open proxies, open NATs and routers, server-side reflection vulnerabilities.

One way or another, local software might access local-only data.

Benchmarks

FEDRAMP (MODERATE) AC-6

Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-worker/main.tf aws_autoscaling_group.worker mixed_instances_policy.launch_template.launch_template_specification.launch_template_id

bridgecrew · 2021-09-27T06:07:05Z

modules/aws/kube-worker/main.tf

@@ -113,7 +113,7 @@ resource "aws_launch_template" "worker" {
    arn = aws_iam_instance_profile.worker.arn
  }

-  key_name  = var.ssh_key
+  key_name  = var.debug_mode ? var.ssh_key : ""


AWS resources that support tags do not have Tags
Resource: aws_launch_template.worker | ID: BC_AWS_GENERAL_26

How to Fix

resource "aws_security_group" "sg" { name = "my-sg" ... + tags = { + Environment = "dev" + Owner = "apps-team" + } }

Description
Many different types of AWS resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.
View AWS's recommended tagging best practices here.

Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-worker/main.tf aws_autoscaling_group.worker mixed_instances_policy.launch_template.launch_template_specification.launch_template_id

bridgecrew · 2021-09-27T06:07:05Z

modules/aws/kube-etcd/main.tf

@@ -80,7 +80,7 @@ resource "aws_instance" "etcd" {

  ami                  = var.instance_config["image_id"]
  instance_type        = var.instance_config["ec2_type"]
-  key_name             = var.ssh_key
+  key_name             = var.debug_mode ? var.ssh_key : ""


Detailed monitoring for EC2 instances is disabled
Resource: aws_instance.etcd | ID: BC_AWS_LOGGING_26

How to Fix

resource "aws_instance" "test" { + monitoring = true }

Description
TBA
Dependent Resources

Path Resource Connecting Attribute

/modules/aws/kube-etcd/main.tf aws_volume_attachment.etcd instance_id

add etcd rolling update document

413652e

bridgecrew bot reviewed Sep 27, 2021

View reviewed changes

smalltown merged commit 61a6518 into master Sep 27, 2021

smalltown deleted the feature/etcd_update_doc branch September 27, 2021 06:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FEATURE: Add etcd rolling update document #132

FEATURE: Add etcd rolling update document #132

smalltown commented Sep 27, 2021 •

edited

Loading

bridgecrew bot left a comment

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

FEATURE: Add etcd rolling update document #132

FEATURE: Add etcd rolling update document #132

Conversation

smalltown commented Sep 27, 2021 • edited Loading

bridgecrew bot left a comment

Choose a reason for hiding this comment

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

Benchmarks

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

Benchmarks

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

Benchmarks

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

Benchmarks

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Sep 27, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

smalltown commented Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading

bridgecrew bot Sep 27, 2021 •

edited

Loading