Skip to content

Commit dff3cb8

Browse files
anna-shcherbakanna-shcherbak
committed
upd: update policies 040, 497
Policy 040 was updated to check the latest EKS version. Policy 497 was updated to check extended support EKS versions.
1 parent 33ce9e1 commit dff3cb8

File tree

16 files changed

+220
-113
lines changed

16 files changed

+220
-113
lines changed

‎policies/ecc-aws-040-eks_cluster_version_latest.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,9 @@ policies:
1414
filters:
1515
- type: value
1616
key: version
17-
value: "1.29"
17+
value: "1.31"
1818
op: lt
19+
- type: value
20+
key: version
21+
value: "1.28"
22+
op: gte

‎policies/ecc-aws-497-eks_cluster_oldest_supported_version.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ policies:
99
- name: ecc-aws-497-eks_cluster_oldest_supported_version
1010
comment: '010021072000'
1111
description: |
12-
EKS cluster is using unsupported version
12+
EKS cluster is using extended support version
1313
resource: aws.eks
1414
filters:
1515
- type: value
1616
key: version
17-
value: "1.23"
17+
value: "1.28"
1818
op: lt

‎terraform/ecc-aws-040-eks_cluster_version_latest/green/eks.tf

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_eks_cluster" "this" {
22
name = "040_eks_cluster_green"
33
role_arn = aws_iam_role.this.arn
4-
version = "1.29"
4+
version = "1.31"
55

66
vpc_config {
77
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
@@ -14,7 +14,6 @@ resource "aws_eks_cluster" "this" {
1414

1515
resource "aws_iam_role" "this" {
1616
name = "eks-040-cluster-green"
17-
1817
assume_role_policy = <<POLICY
1918
{
2019
"Version": "2012-10-17",
@@ -49,11 +48,15 @@ resource "aws_vpc" "this" {
4948
resource "aws_subnet" "subnet1" {
5049
vpc_id = aws_vpc.this.id
5150
cidr_block = "10.0.1.0/24"
52-
availability_zone = "us-east-1a"
51+
availability_zone = data.aws_availability_zones.this.names[0]
5352
}
5453

5554
resource "aws_subnet" "subnet2" {
5655
vpc_id = aws_vpc.this.id
5756
cidr_block = "10.0.2.0/24"
58-
availability_zone = "us-east-1b"
57+
availability_zone = data.aws_availability_zones.this.names[1]
5958
}
59+
60+
data "aws_availability_zones" "this" {
61+
state = "available"
62+
}

‎terraform/ecc-aws-040-eks_cluster_version_latest/iam/040-policy.json

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,13 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
4-
{
5-
"Effect": "Allow",
6-
"Action": [
7-
"eks:DescribeCluster",
8-
"eks:ListClusters",
9-
"ec2:DescribeVpcs"
10-
],
11-
"Resource": "*"
12-
}
13-
]
14-
}
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"eks:ListClusters",
8+
"eks:DescribeCluster"
9+
],
10+
"Resource": "*"
11+
}
12+
]
13+
}

‎terraform/ecc-aws-040-eks_cluster_version_latest/red/eks.tf

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_eks_cluster" "this" {
22
name = "040_eks_cluster_red"
33
role_arn = aws_iam_role.this.arn
4-
version = "1.27"
4+
version = "1.28"
55

66
vpc_config {
77
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
@@ -14,7 +14,6 @@ resource "aws_eks_cluster" "this" {
1414

1515
resource "aws_iam_role" "this" {
1616
name = "eks-cluster-040-red"
17-
1817
assume_role_policy = <<POLICY
1918
{
2019
"Version": "2012-10-17",
@@ -49,12 +48,16 @@ resource "aws_vpc" "this" {
4948
resource "aws_subnet" "subnet1" {
5049
vpc_id = aws_vpc.this.id
5150
cidr_block = "10.0.1.0/24"
52-
availability_zone = "us-east-1a"
51+
availability_zone = data.aws_availability_zones.this.names[0]
5352
}
5453

5554
resource "aws_subnet" "subnet2" {
5655
vpc_id = aws_vpc.this.id
5756
cidr_block = "10.0.2.0/24"
58-
availability_zone = "us-east-1b"
57+
availability_zone = data.aws_availability_zones.this.names[1]
58+
}
59+
60+
data "aws_availability_zones" "this" {
61+
state = "available"
5962
}
6063

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/green/eks.tf

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
resource "aws_eks_cluster" "this" {
22
name = "497_eks_cluster_green"
33
role_arn = aws_iam_role.this.arn
4+
version = "1.30"
45

56
vpc_config {
67
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
@@ -13,7 +14,6 @@ resource "aws_eks_cluster" "this" {
1314

1415
resource "aws_iam_role" "this" {
1516
name = "eks-497-cluster-green"
16-
1717
assume_role_policy = <<POLICY
1818
{
1919
"Version": "2012-10-17",
@@ -48,11 +48,15 @@ resource "aws_vpc" "this" {
4848
resource "aws_subnet" "subnet1" {
4949
vpc_id = aws_vpc.this.id
5050
cidr_block = "10.0.1.0/24"
51-
availability_zone = "us-east-1a"
51+
availability_zone = data.aws_availability_zones.this.names[0]
5252
}
5353

5454
resource "aws_subnet" "subnet2" {
5555
vpc_id = aws_vpc.this.id
5656
cidr_block = "10.0.2.0/24"
57-
availability_zone = "us-east-1b"
57+
availability_zone = data.aws_availability_zones.this.names[1]
58+
}
59+
60+
data "aws_availability_zones" "this" {
61+
state = "available"
5862
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/green/provider.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
aws = {
44
source = "hashicorp/aws"
5-
version = "~> 4"
5+
version = "~> 5"
66
}
77
}
88
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/red/eks.tf

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
resource "aws_eks_cluster" "this" {
2+
name = "497_eks_cluster_red"
3+
role_arn = aws_iam_role.this.arn
4+
version = "1.27"
5+
6+
vpc_config {
7+
subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
8+
}
9+
depends_on = [
10+
aws_iam_role_policy_attachment.Cluster_Policy,
11+
aws_iam_role_policy_attachment.Service_Policy,
12+
]
13+
}
14+
15+
resource "aws_iam_role" "this" {
16+
name = "eks-497-cluster-red"
17+
assume_role_policy = <<POLICY
18+
{
19+
"Version": "2012-10-17",
20+
"Statement": [
21+
{
22+
"Effect": "Allow",
23+
"Principal": {
24+
"Service": "eks.amazonaws.com"
25+
},
26+
"Action": "sts:AssumeRole"
27+
}
28+
]
29+
}
30+
POLICY
31+
}
32+
33+
resource "aws_iam_role_policy_attachment" "Cluster_Policy" {
34+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
35+
role = aws_iam_role.this.name
36+
}
37+
38+
resource "aws_iam_role_policy_attachment" "Service_Policy" {
39+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
40+
role = aws_iam_role.this.name
41+
}
42+
43+
resource "aws_vpc" "this" {
44+
cidr_block = "10.0.0.0/16"
45+
enable_dns_hostnames = true
46+
}
47+
48+
resource "aws_subnet" "subnet1" {
49+
vpc_id = aws_vpc.this.id
50+
cidr_block = "10.0.1.0/24"
51+
availability_zone = data.aws_availability_zones.this.names[0]
52+
}
53+
54+
resource "aws_subnet" "subnet2" {
55+
vpc_id = aws_vpc.this.id
56+
cidr_block = "10.0.2.0/24"
57+
availability_zone = data.aws_availability_zones.this.names[1]
58+
}
59+
60+
data "aws_availability_zones" "this" {
61+
state = "available"
62+
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/red/provider.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = "~> 5"
6+
}
7+
}
8+
}
9+
10+
provider "aws"{
11+
profile = var.profile
12+
region = var.default-region
13+
14+
default_tags {
15+
tags = {
16+
CustodianRule = "ecc-aws-497-eks_cluster_oldest_supported_version"
17+
ComplianceStatus = "Red"
18+
}
19+
}
20+
}

‎terraform/ecc-aws-497-eks_cluster_oldest_supported_version/red/terraform.tfvars

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
profile = "c7n"
2+
default-region = "us-east-1"

0 commit comments

Comments
 (0)