Skip to content

Commit 1c835ce

Browse files
anna-shcherbakanna-shcherbak
committed
upd: update policies 040, 497
Policy 040 was updated to check the latest EKS version. Policy 497 was updated to check extended support EKS versions.
1 parent 33ce9e1 commit 1c835ce

File tree

15 files changed

+222
-112
lines changed

15 files changed

+222
-112
lines changed

‎policies/ecc-aws-040-eks_cluster_version_latest.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,9 @@ policies:
1414
filters:
1515
- type: value
1616
key: version
17-
value: "1.29"
17+
value: "1.31"
1818
op: lt
19+
- type: value
20+
key: version
21+
value: "1.28"
22+
op: gte

‎policies/ecc-aws-497-eks_cluster_oldest_supported_version.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ policies:
99
- name: ecc-aws-497-eks_cluster_oldest_supported_version
1010
comment: '010021072000'
1111
description: |
12-
EKS cluster is using unsupported version
12+
EKS cluster is using extended support version
1313
resource: aws.eks
1414
filters:
1515
- type: value
1616
key: version
17-
value: "1.23"
17+
value: "1.28"
1818
op: lt

‎terraform/ecc-aws-040-eks_cluster_version_latest/green/eks.tf

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_eks_cluster" "this" {
22
name = "040_eks_cluster_green"
33
role_arn = aws_iam_role.this.arn
4-
version = "1.29"
4+
version = "1.31"
55

66
vpc_config {
77
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
@@ -14,7 +14,6 @@ resource "aws_eks_cluster" "this" {
1414

1515
resource "aws_iam_role" "this" {
1616
name = "eks-040-cluster-green"
17-
1817
assume_role_policy = <<POLICY
1918
{
2019
"Version": "2012-10-17",
@@ -49,11 +48,15 @@ resource "aws_vpc" "this" {
4948
resource "aws_subnet" "subnet1" {
5049
vpc_id = aws_vpc.this.id
5150
cidr_block = "10.0.1.0/24"
52-
availability_zone = "us-east-1a"
51+
availability_zone = data.aws_availability_zones.this.names[0]
5352
}
5453

5554
resource "aws_subnet" "subnet2" {
5655
vpc_id = aws_vpc.this.id
5756
cidr_block = "10.0.2.0/24"
58-
availability_zone = "us-east-1b"
57+
availability_zone = data.aws_availability_zones.this.names[1]
5958
}
59+
60+
data "aws_availability_zones" "this" {
61+
state = "available"
62+
}

‎terraform/ecc-aws-040-eks_cluster_version_latest/iam/040-policy.json

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,13 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
4-
{
5-
"Effect": "Allow",
6-
"Action": [
7-
"eks:DescribeCluster",
8-
"eks:ListClusters",
9-
"ec2:DescribeVpcs"
10-
],
11-
"Resource": "*"
12-
}
13-
]
14-
}
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"eks:ListClusters",
8+
"eks:DescribeCluster"
9+
],
10+
"Resource": "*"
11+
}
12+
]
13+
}

‎terraform/ecc-aws-040-eks_cluster_version_latest/red/eks.tf

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_eks_cluster" "this" {
22
name = "040_eks_cluster_red"
33
role_arn = aws_iam_role.this.arn
4-
version = "1.27"
4+
version = "1.28"
55

66
vpc_config {
77
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
@@ -14,7 +14,6 @@ resource "aws_eks_cluster" "this" {
1414

1515
resource "aws_iam_role" "this" {
1616
name = "eks-cluster-040-red"
17-
1817
assume_role_policy = <<POLICY
1918
{
2019
"Version": "2012-10-17",
@@ -49,12 +48,16 @@ resource "aws_vpc" "this" {
4948
resource "aws_subnet" "subnet1" {
5049
vpc_id = aws_vpc.this.id
5150
cidr_block = "10.0.1.0/24"
52-
availability_zone = "us-east-1a"
51+
availability_zone = data.aws_availability_zones.this.names[0]
5352
}
5453

5554
resource "aws_subnet" "subnet2" {
5655
vpc_id = aws_vpc.this.id
5756
cidr_block = "10.0.2.0/24"
58-
availability_zone = "us-east-1b"
57+
availability_zone = data.aws_availability_zones.this.names[1]
58+
}
59+
60+
data "aws_availability_zones" "this" {
61+
state = "available"
5962
}
6063

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/green/eks.tf

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
resource "aws_eks_cluster" "this" {
22
name = "497_eks_cluster_green"
33
role_arn = aws_iam_role.this.arn
4+
version = "1.30"
45

56
vpc_config {
67
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
@@ -13,7 +14,7 @@ resource "aws_eks_cluster" "this" {
1314

1415
resource "aws_iam_role" "this" {
1516
name = "eks-497-cluster-green"
16-
17+
1718
assume_role_policy = <<POLICY
1819
{
1920
"Version": "2012-10-17",
@@ -48,11 +49,15 @@ resource "aws_vpc" "this" {
4849
resource "aws_subnet" "subnet1" {
4950
vpc_id = aws_vpc.this.id
5051
cidr_block = "10.0.1.0/24"
51-
availability_zone = "us-east-1a"
52+
availability_zone = data.aws_availability_zones.this.names[0]
5253
}
5354

5455
resource "aws_subnet" "subnet2" {
5556
vpc_id = aws_vpc.this.id
5657
cidr_block = "10.0.2.0/24"
57-
availability_zone = "us-east-1b"
58+
availability_zone = data.aws_availability_zones.this.names[1]
59+
}
60+
61+
data "aws_availability_zones" "this" {
62+
state = "available"
5863
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/green/provider.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
aws = {
44
source = "hashicorp/aws"
5-
version = "~> 4"
5+
version = "~> 5"
66
}
77
}
88
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/red/eks.tf

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
resource "aws_eks_cluster" "this" {
2+
name = "497_eks_cluster_red"
3+
role_arn = aws_iam_role.this.arn
4+
version = "1.27"
5+
6+
vpc_config {
7+
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
8+
}
9+
depends_on = [
10+
aws_iam_role_policy_attachment.Cluster_Policy,
11+
aws_iam_role_policy_attachment.Service_Policy,
12+
]
13+
}
14+
15+
resource "aws_iam_role" "this" {
16+
name = "eks-497-cluster-red"
17+
permissions_boundary = "arn:aws:iam::703671910212:policy/eo_role_boundary"
18+
19+
assume_role_policy = <<POLICY
20+
{
21+
"Version": "2012-10-17",
22+
"Statement": [
23+
{
24+
"Effect": "Allow",
25+
"Principal": {
26+
"Service": "eks.amazonaws.com"
27+
},
28+
"Action": "sts:AssumeRole"
29+
}
30+
]
31+
}
32+
POLICY
33+
}
34+
35+
resource "aws_iam_role_policy_attachment" "Cluster_Policy" {
36+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
37+
role = aws_iam_role.this.name
38+
}
39+
40+
resource "aws_iam_role_policy_attachment" "Service_Policy" {
41+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
42+
role = aws_iam_role.this.name
43+
}
44+
45+
resource "aws_vpc" "this" {
46+
cidr_block = "10.0.0.0/16"
47+
enable_dns_hostnames = true
48+
}
49+
50+
resource "aws_subnet" "subnet1" {
51+
vpc_id = aws_vpc.this.id
52+
cidr_block = "10.0.1.0/24"
53+
availability_zone = data.aws_availability_zones.this.names[0]
54+
}
55+
56+
resource "aws_subnet" "subnet2" {
57+
vpc_id = aws_vpc.this.id
58+
cidr_block = "10.0.2.0/24"
59+
availability_zone = data.aws_availability_zones.this.names[1]
60+
}
61+
62+
data "aws_availability_zones" "this" {
63+
state = "available"
64+
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/red/provider.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = "~> 5"
6+
}
7+
}
8+
}
9+
10+
provider "aws"{
11+
profile = var.profile
12+
region = var.default-region
13+
14+
default_tags {
15+
tags = {
16+
CustodianRule = "ecc-aws-497-eks_cluster_oldest_supported_version"
17+
ComplianceStatus = "Red"
18+
}
19+
}
20+
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/red/terraform.tfvars

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
profile = "c7n"
2+
default-region = "us-east-1"

0 commit comments

Comments
 (0)