Skip to content
This repository was archived by the owner on Feb 21, 2025. It is now read-only.

Commit bc85b06

Browse files
nikitabelonogovnikitabelonogov
authored
Predefined Persistent S3 bucket (#20)
1 parent e957f40 commit bc85b06

File tree

22 files changed

+261
-123
lines changed

22 files changed

+261
-123
lines changed

‎terraform/aws/TFSEC.md

+2
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,6 @@ We use GitHub Actions and [tfsec](https://github.com/aquasecurity/tfsec) to chec
99
| modules/vpc/main.tf | aws-ec2-no-public-egress-sgr | Your port is egressing data to the internet | By default worker nodes can access `0.0.0.0/0`. |
1010
| modules/vpc/main.tf | aws-ec2-require-vpc-flow-logs-for-all-vpcs | Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues | By default it's disabled, it's possible to override using `var.enable_vpc_log` |
1111
| modules/s3/main.tf | aws-s3-enable-bucket-logging | There is no way to determine the access to this bucket | By default it's disabled since only the app is allowed to access this bucket, it's possible to override using `var.enable_log_bucket` |
12+
| modules/s3/main.tf | aws-s3-enable-versioning | Impossible to restore deleted files | By default it's disabled since we don't want to store historical data, it's possible to override using `var.enable_bucket_versioning` |
13+
| modules/s3_role/main.tf | aws-iam-no-policy-wildcards | False-positive warning by tfsec | Ignore it, since it's a recommended way to define ARN policy for a bucket |
1214
| modules/load-balancer-controller/main.tf | aws-iam-no-policy-wildcards | Load balancer controller has increased access to AWS resources | By default it's disabled since we could not predict resources ARNs at this stage |

‎terraform/aws/env/.terraform.lock.hcl

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎terraform/aws/env/README.md

+13-8
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,19 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.3.6 |
7-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | = 4.46.0 |
8-
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | = 2.7.1 |
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.4.4 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | = 4.61.0 |
8+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | = 2.9.0 |
99
| <a name="requirement_kubectl"></a> [kubectl](#requirement\_kubectl) | = 1.14.0 |
10-
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | = 2.16.1 |
10+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | = 2.19.0 |
1111
| <a name="requirement_random"></a> [random](#requirement\_random) | = 3.4.3 |
1212
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | = 4.0.4 |
1313

1414
## Providers
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.46.0 |
18+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.61.0 |
1919
| <a name="provider_random"></a> [random](#provider\_random) | 3.4.3 |
2020

2121
## Modules
@@ -33,6 +33,7 @@
3333
| <a name="module_rds"></a> [rds](#module\_rds) | ../modules/rds | n/a |
3434
| <a name="module_route53"></a> [route53](#module\_route53) | ../modules/route53 | n/a |
3535
| <a name="module_s3"></a> [s3](#module\_s3) | ../modules/s3 | n/a |
36+
| <a name="module_s3_role"></a> [s3\_role](#module\_s3\_role) | ../modules/s3_role | n/a |
3637
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../modules/vpc | n/a |
3738

3839
## Resources
@@ -41,14 +42,17 @@
4142
|------|------|
4243
| [random_password.postgresql_password](https://registry.terraform.io/providers/hashicorp/random/3.4.3/docs/resources/password) | resource |
4344
| [random_password.redis_password](https://registry.terraform.io/providers/hashicorp/random/3.4.3/docs/resources/password) | resource |
44-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/4.46.0/docs/data-sources/caller_identity) | data source |
45-
| [aws_eks_cluster.eks](https://registry.terraform.io/providers/hashicorp/aws/4.46.0/docs/data-sources/eks_cluster) | data source |
46-
| [aws_eks_cluster_auth.eks](https://registry.terraform.io/providers/hashicorp/aws/4.46.0/docs/data-sources/eks_cluster_auth) | data source |
45+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/4.61.0/docs/data-sources/caller_identity) | data source |
46+
| [aws_eks_cluster.eks](https://registry.terraform.io/providers/hashicorp/aws/4.61.0/docs/data-sources/eks_cluster) | data source |
47+
| [aws_eks_cluster_auth.eks](https://registry.terraform.io/providers/hashicorp/aws/4.61.0/docs/data-sources/eks_cluster_auth) | data source |
4748

4849
## Inputs
4950

5051
| Name | Description | Type | Default | Required |
5152
|------|-------------|------|---------|:--------:|
53+
| <a name="input_aws_auth_accounts"></a> [aws\_auth\_accounts](#input\_aws\_auth\_accounts) | List of account maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
54+
| <a name="input_aws_auth_roles"></a> [aws\_auth\_roles](#input\_aws\_auth\_roles) | List of role maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
55+
| <a name="input_aws_auth_users"></a> [aws\_auth\_users](#input\_aws\_auth\_users) | List of user maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
5256
| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint | `list(string)` | <pre>[<br> "0.0.0.0/0"<br>]</pre> | no |
5357
| <a name="input_create_acm_certificate"></a> [create\_acm\_certificate](#input\_create\_acm\_certificate) | Whether to create acm certificate or use existing | `bool` | `false` | no |
5458
| <a name="input_create_r53_zone"></a> [create\_r53\_zone](#input\_create\_r53\_zone) | Create R53 zone for main public domain | `bool` | `false` | no |
@@ -86,6 +90,7 @@
8690
| <a name="input_postgresql_tls_key_file"></a> [postgresql\_tls\_key\_file](#input\_postgresql\_tls\_key\_file) | n/a | `string` | `null` | no |
8791
| <a name="input_postgresql_type"></a> [postgresql\_type](#input\_postgresql\_type) | Postgresql type | `string` | `"internal"` | no |
8892
| <a name="input_postgresql_username"></a> [postgresql\_username](#input\_postgresql\_username) | Postgresql username | `string` | `"labelstudio"` | no |
93+
| <a name="input_predefined_s3_bucket"></a> [predefined\_s3\_bucket](#input\_predefined\_s3\_bucket) | Predefined S3 Bucket | <pre>object(<br> {<br> name : string<br> region : string<br> folder : string<br> kms_arn : string<br> }<br> )</pre> | `null` | no |
8994
| <a name="input_predefined_vpc"></a> [predefined\_vpc](#input\_predefined\_vpc) | Predefined VPC | <pre>object(<br> {<br> id : string<br> subnet_public_ids : list(string)<br> subnet_private_ids : list(string)<br> security_group_id : string<br> }<br> )</pre> | `null` | no |
9095
| <a name="input_private_cidr_block"></a> [private\_cidr\_block](#input\_private\_cidr\_block) | List of private subnet cidr blocks | `list(string)` | <pre>[<br> "10.0.1.0/24",<br> "10.0.2.0/24",<br> "10.0.3.0/24"<br>]</pre> | no |
9196
| <a name="input_public_cidr_block"></a> [public\_cidr\_block](#input\_public\_cidr\_block) | List of public subnet cidr blocks | `list(string)` | <pre>[<br> "10.0.101.0/24",<br> "10.0.102.0/24",<br> "10.0.103.0/24"<br>]</pre> | no |

‎terraform/aws/env/main.tf

+28-9
Original file line numberDiff line numberDiff line change
@@ -39,16 +39,37 @@ module "iam" {
3939
region = var.region
4040
environment = var.environment
4141
tags = local.tags
42-
bucket_id = module.s3.bucket_id
42+
bucket_id = var.predefined_s3_bucket == null ? module.s3[0].bucket_name : var.predefined_s3_bucket.name
4343
}
4444

4545
# Create S3 bucket
4646
module "s3" {
4747
source = "../modules/s3"
4848

49+
count = var.predefined_s3_bucket == null ? 1 : 0
50+
4951
name = local.name_prefix
5052
environment = var.environment
5153
tags = local.tags
54+
55+
depends_on = [
56+
module.eks,
57+
]
58+
}
59+
60+
module "s3_role" {
61+
source = "../modules/s3_role"
62+
63+
name = local.name_prefix
64+
aws_s3_bucket_arn = var.predefined_s3_bucket == null ? module.s3[0].bucket_arn : "arn:aws:s3:::${var.predefined_s3_bucket.name}"
65+
aws_kms_key_bucket_arn = var.predefined_s3_bucket == null ? module.s3[0].kms_arn : var.predefined_s3_bucket.kms_arn
66+
iam_oidc_provider_arn = module.eks.iam_oidc_provider_arn
67+
iam_oidc_provider_url = module.eks.iam_oidc_provider_url
68+
69+
depends_on = [
70+
module.eks,
71+
module.s3,
72+
]
5273
}
5374

5475
# Create Elastic Kubernetes Service
@@ -70,13 +91,11 @@ module "eks" {
7091
instance_profile_name = module.iam.iam_instance_profile
7192
tags = local.tags
7293
capacity_type = var.eks_capacity_type
73-
persistence_s3_bucket_arn = module.s3.bucket_arn
74-
persistence_s3_kms_arn = module.s3.kms_arn
7594
monitoring_namespace = var.monitoring_namespace
7695
cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs
7796

78-
aws_auth_roles = var.aws_auth_roles
79-
aws_auth_users = var.aws_auth_users
97+
aws_auth_roles = var.aws_auth_roles
98+
aws_auth_users = var.aws_auth_users
8099
aws_auth_accounts = var.aws_auth_accounts
81100

82101
depends_on = [
@@ -205,10 +224,10 @@ module "label-studio" {
205224
enterprise = var.enterprise
206225
cloud_provider = "aws"
207226

208-
persistence_s3_bucket_name = module.s3.bucket_name
209-
persistence_s3_bucket_region = module.s3.bucket_region
210-
persistence_s3_bucket_folder = ""
211-
persistence_s3_role_arn = module.eks.s3_persistence_role_arn
227+
persistence_s3_bucket_name = var.predefined_s3_bucket == null ? module.s3[0].bucket_name : var.predefined_s3_bucket.name
228+
persistence_s3_bucket_region = var.predefined_s3_bucket == null ? module.s3[0].bucket_region : var.predefined_s3_bucket.region
229+
persistence_s3_bucket_folder = var.predefined_s3_bucket == null ? module.s3[0].bucket_folder : var.predefined_s3_bucket.folder
230+
persistence_s3_role_arn = module.s3_role.s3_persistence_role_arn
212231

213232
postgresql_type = var.postgresql_type
214233
postgresql_host = var.postgresql_type == "rds" ? module.rds[0].host : var.postgresql_host

‎terraform/aws/env/output.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ output "cluster_endpoint" {
1515

1616
output "bucket_id" {
1717
description = "Bucket Name (aka ID)"
18-
value = module.s3.bucket_id
18+
value = var.predefined_s3_bucket == null ? module.s3[0].bucket_name : var.predefined_s3_bucket.name
1919
}
2020

2121
output "connect_cluster" {

‎terraform/aws/env/variables.tf

+13
Original file line numberDiff line numberDiff line change
@@ -332,3 +332,16 @@ variable "cluster_endpoint_public_access_cidrs" {
332332
type = list(string)
333333
default = ["0.0.0.0/0"]
334334
}
335+
336+
# Predefined S3 Bucket
337+
variable "predefined_s3_bucket" {
338+
type = object(
339+
{
340+
name : string
341+
region : string
342+
folder : string
343+
kms_arn : string
344+
}
345+
)
346+
default = null
347+
}

‎terraform/aws/modules/eks/README.md

+7-6
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ No requirements.
88
| Name | Version |
99
|------|---------|
1010
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
11+
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | n/a |
1112
| <a name="provider_tls"></a> [tls](#provider\_tls) | n/a |
1213

1314
## Modules
@@ -27,21 +28,22 @@ No requirements.
2728
| [aws_eks_cluster.eks_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource |
2829
| [aws_eks_node_group.eks_node_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group) | resource |
2930
| [aws_iam_openid_connect_provider.aws_iam_openid_connect_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
30-
| [aws_iam_policy.persistence](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
3131
| [aws_iam_role.cni_irsa_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
3232
| [aws_iam_role.ebs_csi_irsa_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
33-
| [aws_iam_role.persistence](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
3433
| [aws_iam_role_policy_attachment.cni_irsa_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3534
| [aws_iam_role_policy_attachment.ebs_csi_irsa_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
36-
| [aws_iam_role_policy_attachment.persistence](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3735
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
36+
| [kubernetes_config_map.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map) | resource |
3837
| [aws_iam_policy.ebs_csi_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
3938
| [tls_certificate.cert](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source |
4039

4140
## Inputs
4241

4342
| Name | Description | Type | Default | Required |
4443
|------|-------------|------|---------|:--------:|
44+
| <a name="input_aws_auth_accounts"></a> [aws\_auth\_accounts](#input\_aws\_auth\_accounts) | List of account maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
45+
| <a name="input_aws_auth_roles"></a> [aws\_auth\_roles](#input\_aws\_auth\_roles) | List of role maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
46+
| <a name="input_aws_auth_users"></a> [aws\_auth\_users](#input\_aws\_auth\_users) | List of user maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
4547
| <a name="input_capacity_type"></a> [capacity\_type](#input\_capacity\_type) | Type of capacity associated with the EKS Node Group | `string` | `"ON_DEMAND"` | no |
4648
| <a name="input_cluster_endpoint_private_access"></a> [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled | `bool` | `true` | no |
4749
| <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled | `bool` | `true` | no |
@@ -57,8 +59,6 @@ No requirements.
5759
| <a name="input_min_size"></a> [min\_size](#input\_min\_size) | Minimum number of the instances in autoscaling group | `number` | n/a | yes |
5860
| <a name="input_monitoring_namespace"></a> [monitoring\_namespace](#input\_monitoring\_namespace) | Namespace for monitoring | `string` | `"monitoring"` | no |
5961
| <a name="input_name"></a> [name](#input\_name) | Name is the prefix to use for resources that needs to be created | `string` | n/a | yes |
60-
| <a name="input_persistence_s3_bucket_arn"></a> [persistence\_s3\_bucket\_arn](#input\_persistence\_s3\_bucket\_arn) | n/a | `any` | n/a | yes |
61-
| <a name="input_persistence_s3_kms_arn"></a> [persistence\_s3\_kms\_arn](#input\_persistence\_s3\_kms\_arn) | n/a | `any` | n/a | yes |
6262
| <a name="input_public_subnets"></a> [public\_subnets](#input\_public\_subnets) | List of public subnets to create the resources | `any` | n/a | yes |
6363
| <a name="input_region"></a> [region](#input\_region) | The AWS region where terraform builds resources | `string` | n/a | yes |
6464
| <a name="input_role_arn"></a> [role\_arn](#input\_role\_arn) | IAM role arn to attach the EKS cluster | `string` | n/a | yes |
@@ -75,5 +75,6 @@ No requirements.
7575
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | Name of the EKS cluster |
7676
| <a name="output_cluster_version"></a> [cluster\_version](#output\_cluster\_version) | Version of the EKS cluster |
7777
| <a name="output_iam_oidc_provider"></a> [iam\_oidc\_provider](#output\_iam\_oidc\_provider) | AWS EKS IRSA id |
78-
| <a name="output_s3_persistence_role_arn"></a> [s3\_persistence\_role\_arn](#output\_s3\_persistence\_role\_arn) | n/a |
78+
| <a name="output_iam_oidc_provider_arn"></a> [iam\_oidc\_provider\_arn](#output\_iam\_oidc\_provider\_arn) | AWS EKS IRSA arn |
79+
| <a name="output_iam_oidc_provider_url"></a> [iam\_oidc\_provider\_url](#output\_iam\_oidc\_provider\_url) | AWS EKS IRSA url |
7980
<!-- END_TF_DOCS -->

‎terraform/aws/modules/eks/addons.tf

-70
Original file line numberDiff line numberDiff line change
@@ -119,73 +119,3 @@ resource "aws_iam_role_policy_attachment" "ebs_csi_irsa_policy" {
119119
role = aws_iam_role.ebs_csi_irsa_role.name
120120
policy_arn = data.aws_iam_policy.ebs_csi_policy.arn
121121
}
122-
123-
resource "aws_iam_role" "persistence" {
124-
name = "${var.name}-s3-persistence"
125-
description = "s3 persistence role for EKS cluster ${var.name}"
126-
127-
assume_role_policy = <<POLICY
128-
{
129-
"Version": "2012-10-17",
130-
"Statement": [
131-
{
132-
"Effect": "Allow",
133-
"Principal": {
134-
"Federated": "${aws_iam_openid_connect_provider.aws_iam_openid_connect_provider.arn}"
135-
},
136-
"Action": "sts:AssumeRoleWithWebIdentity",
137-
"Condition": {
138-
"StringEquals": {
139-
"${replace(aws_iam_openid_connect_provider.aws_iam_openid_connect_provider.url, "https://", "")}:aud": "sts.amazonaws.com"
140-
}
141-
}
142-
}
143-
]
144-
}
145-
POLICY
146-
}
147-
148-
resource "aws_iam_policy" "persistence" {
149-
name = "${var.name}-s3-persistence"
150-
description = "Permissions for s3 bucket ${var.name}"
151-
policy = jsonencode({
152-
"Version" = "2012-10-17"
153-
"Statement" = [
154-
{
155-
"Effect" = "Allow"
156-
"Action" = [
157-
"s3:ListBucket"
158-
],
159-
"Resource" = [
160-
var.persistence_s3_bucket_arn
161-
]
162-
},
163-
{
164-
"Effect" : "Allow"
165-
"Action" : [
166-
"s3:PutObject",
167-
"s3:GetObject",
168-
"s3:DeleteObject"
169-
],
170-
"Resource" : [
171-
"${var.persistence_s3_bucket_arn}/*"
172-
]
173-
},
174-
{
175-
"Effect" : "Allow",
176-
"Action" : [
177-
"kms:GenerateDataKey",
178-
"kms:Decrypt"
179-
],
180-
"Resource" : [
181-
var.persistence_s3_kms_arn
182-
]
183-
}
184-
]
185-
})
186-
}
187-
188-
resource "aws_iam_role_policy_attachment" "persistence" {
189-
role = aws_iam_role.persistence.name
190-
policy_arn = aws_iam_policy.persistence.arn
191-
}

0 commit comments

Comments
 (0)