diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index e9e3a7dc..00000000 Binary files a/.DS_Store and /dev/null differ diff --git a/README.md b/README.md index 8d6903c6..052d9357 100644 --- a/README.md +++ b/README.md @@ -1,46 +1,104 @@ -## Overview +# Deploying NGINX Ingress Controller with NGINX WAFv5 in AWS +--------------------------------------------------------------- -This is a consolidated automation repo for different verified designs customer use case examples using `F5 Nginx`. Users can use this to test a specific use case end to end by using the automation code available in this repo.
-
-**NOTE: To learn about each use case check the devcentral article link provided in each scenario folder README**
-
+Introduction : +--------------- +This demo guide offers a step-by-step walkthrough for configuring the NGINX Ingress Controller with NGINX App Protect v5 on AWS Cloud, using Terraform scripts to automate the deployment. For more information, refer to the devcentral article: +## Getting Started + ## Prerequisites -* [AWS Account](https://aws.amazon.com) - Due to the assets being created, free tier will not work. - * The F5 NGINX App Protect AMI being used from the [AWS Marketplace](https://aws.amazon.com/marketplace) should be subsribed to your account - * Please make sure resources like VPC and Elastic IP's are below the threshold limit in that aws region +* [NGINX Plus with App Protect and NGINX Ingress Controller license](https://www.nginx.com/free-trial-request/) +* [AWS Account](https://aws.amazon.com) - Due to the assets being created, the free tier will not work. * [GitHub Account](https://github.com) -## Steps to execute +## Assets + +* **nap:** NGINX Ingress Controller for Kubernetes with NGINX App Protect (WAF and API Protection) +* **infra:** AWS Infrastructure (VPC, IGW, etc.) +* **eks:** AWS Elastic Kubernetes Service +* **arcadia:** Arcadia Finance test web application and API +* **policy:** NGINX WAF Compiler Docker and Policy +* **S3:** Amazon S3 bucket and IAM role and policy for storage. + +## Tools + +* **Cloud Provider:** AWS +* **IAC:** Terraform +* **IAC State:** Amazon S3 +* **CI/CD:** GitHub Actions + + +## GitHub Secrets Configuration + +This workflow requires the following secrets to be configured in your GitHub repository: + +### Required Secrets + +| Secret Name | Type | Description | Example Value/Format | +|------------------------|---------|-----------------------------------------------------------------------------|----------------------------| +| `AWS_ACCESS_KEY_ID` | Secret | AWS IAM user access key ID with sufficient permissions | `AKIAXXXXXXXXXXXXXXXX` | +| `AWS_SECRET_ACCESS_KEY` | Secret | Corresponding secret access key for the AWS IAM user | (40-character mixed case string) | +| `AWS_SESSION_TOKEN` | Secret | Session token for temporary AWS credentials (if using MFA) | (Base64-encoded string) | +| `NGINX_JWT` | Secret | JSON Web Token for NGINX license authentication | `eyJhbGciOi...` (JWT format) | +| `NGINX_CRT` | Secret | NGINX Certificate in PKCS#12 format | `api.p12` file contents | +| `NGINX_KEY` | Secret | Private key for securing HTTPS and verifying SSL/TLS certificates | YourCertificatePasrivatekey| + +### How to Add Secrets + +1. Navigate to your GitHub repository +2. Go to **Settings** → **Secrets and variables** → **Actions** +3. Click **New repository secret** +4. Enter the secret name exactly as shown above +5. Paste the secret value +6. Click **Add secret** + + +## Workflow Runs + +**STEP 1:** Check out a branch for the workflow you wish to run using the following naming convention. + + **DEPLOY** + + | Workflow | Branch Name | + | ------------ | ---------------- | + | NGINX V5-NIC/NAP Apply| apply-NIC/NAP | -1. Clone the repo locally and update AWS credentials like `access keys`, `secret key` and `session token` be in `settings` --> `Secrets` --> `Actions` section
-![image](https://user-images.githubusercontent.com/6093830/209962425-1c3452ec-9b32-4509-adb5-cc85d4a67a10.png) -> Note: Above values typically expire in every 12 hours. If you are not using session token please remove this field accordingly in workflow file step name-`configure aws credentials` in all jobs + + **DESTROY** + + | Workflow | Branch Name | + | ------------ | ----------------- | + | NGINX V5-NIC/NAP Destroy| destroy-NIC/NAP | -2. EC2 keys should be updated properly in `settings` --> `Secrets` --> `Actions` section
-> Note: Make sure passwords follow company security standards like alpha numeric, etc.
-3. EC2 key related pem and pub file should be copied to terraform folder in your use case
-4. Make sure you have subscribed to the `NGINX App Protect AMI` in AWS account
+**STEP 2:** Rename `infra/terraform.tfvars.examples` to `infra/terraform.tfvars` and add the following data: + * project_prefix = "Your project identifier name in **lower case** letters only - this will be applied as a prefix to all assets" + * resource_owner = "Your-name" + * aws_region = "AWS Region" ex. us-east-1 + * azs = ["us-east-1a", "us-east1b"] - Change to Correct Availability Zones based on selected Region + * Also update assets boolean value as per your work-flows -5. Update your `ENV` variables in `/data/testbed-data.json` file in your use case folder
+**STEP 3:** In the `S3 directory`, inside the `variable.tf` file modify the following data + * description = "S3 bucket for Terraform remote state storage" + * default = "your-unique-bucket-name" # Replace with your actual bucket name + -6. Install self hosted runner and add it to this repo
+**STEP 4:** Commit and push your build branch to your forked repo + * Build will run and can be monitored in the GitHub Actions tab and TF Cloud console -7. Make sure `awscli`, `kubectl`, `ansible-playbook`, `pytest`, `git` and other required tools are installed in this private custom runner. Refer `requirements.txt` file for more details
-> Note: Please install and make sure python packages like `pytest-html`, `awscli==1.18.105` and `botocore==1.17.28` are available with their correct versions in runner to avoid failures
+**STEP 5:** Once the pipeline is complete, verify that your assets were deployed or destroyed based on your workflow. -8. Go to `Actions` tab and select your article work-flow
+ **NOTE:** The autocert process takes time. It may be 5 to 10 minutes before Let's Encrypt has provided the cert. -9. Click on `Run Workflow` option and execute it
-10. Check the CI/CD jobs execution and check the artifacts for more details
-
+## Development +Outline any requirements to setup a development environment if someone would like to contribute. You may also link to another file for this information. ## Support @@ -56,7 +114,7 @@ Please refer to the [F5 DevCentral Community Code of Conduct](code_of_conduct.md ## Copyright -Copyright 2014-2023 F5 Networks Inc. +Copyright 2014-2020 F5 Networks Inc. ### F5 Networks Contributor License Agreement diff --git a/arcadia/arcadia-oas3-2.0.1.json b/arcadia/arcadia-oas3-2.0.1.json new file mode 100644 index 00000000..75d4889d --- /dev/null +++ b/arcadia/arcadia-oas3-2.0.1.json @@ -0,0 +1,274 @@ +{ + "openapi": "3.0.3", + "info": { + "title": "API Arcadia Finance", + "description": "Arcadia OpenAPI", + "version": "2.0.2-oas3" + }, + "servers": [ + { + "url": "/" + } + ], + "paths": { + "/api/lower_bar.php": { + "get": { + "summary": "get lower bar", + "responses": { + "200": { + "description": "200 response" + } + } + } + }, + "/api/side_bar.php": { + "get": { + "summary": "get side bar", + "responses": { + "200": { + "description": "200 response" + } + } + } + }, + "/api/side_bar_accounts.php": { + "get": { + "summary": "get side bar", + "responses": { + "200": { + "description": "200 response" + } + } + } + }, + "/trading/rest/portfolio.php": { + "get": { + "summary": "get portfolio", + "responses": { + "200": { + "description": "200 response" + } + } + } + }, + "/trading/rest/buy_stocks.php": { + "post": { + "summary": "Add stocks to your portfolio", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/buy" + }, + "example": { + "trans_value": "312", + "qty": "16", + "company": "MSFT", + "action": "buy", + "stock_price": "198" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "200 response", + "content": { + "application/json": { + "example": { + "status": "success", + "name": "Microsoft", + "qty": "16", + "amount": "312", + "transid": "855415223" + } + } + } + } + } + } + }, + "/trading/rest/sell_stocks.php": { + "post": { + "summary": "Sell stocks that you own", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/sell" + }, + "example": { + "trans_value": "212", + "qty": "16", + "company": "MSFT", + "action": "sell", + "stock_price": "158" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "200 response", + "content": { + "application/json": { + "example": { + "status": "success", + "name": "Microsoft", + "qty": "16", + "amount": "212", + "transid": "658854124" + } + } + } + } + } + } + }, + "/trading/transactions.php": { + "get": { + "summary": "Get the latests transactions that have happened", + "responses": { + "200": { + "description": "200 response", + "content": { + "application/json": { + "example": { + "YourLastTransaction": "MFST 2000" + } + } + } + } + } + } + }, + "/api/rest/execute_money_transfer.php": { + "post": { + "summary": "Transfer money to a friend", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/money_transfer" + }, + "example": { + "amount": "92", + "account": "2075894", + "currency": "GBP", + "friend": "Vincent" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "200 response", + "content": { + "application/json": { + "example": { + "name": "Vincent", + "status": "success", + "currency": "GBP", + "transid": "524569855", + "msg": "The money transfer has been successfully completed" + } + } + } + } + } + } + } + }, + "components": { + "schemas": { + "buy": { + "required": [ + "action", + "company", + "qty", + "stock_price", + "trans_value" + ], + "type": "object", + "properties": { + "trans_value": { + "type": "integer", + "format": "int64" + }, + "qty": { + "type": "integer", + "format": "int64" + }, + "company": { + "type": "string" + }, + "action": { + "type": "string" + }, + "stock_price": { + "type": "integer", + "format": "int64" + } + } + }, + "sell": { + "required": [ + "action", + "company", + "qty", + "stock_price", + "trans_value" + ], + "type": "object", + "properties": { + "trans_value": { + "type": "integer", + "format": "int64" + }, + "qty": { + "type": "integer", + "format": "int64" + }, + "company": { + "type": "string" + }, + "action": { + "type": "string" + }, + "stock_price": { + "type": "integer", + "format": "int64" + } + } + }, + "money_transfer": { + "required": [ + "account", + "amount", + "currency", + "friend" + ], + "type": "object", + "properties": { + "amount": { + "type": "integer", + "format": "int64" + }, + "account": { + "type": "integer", + "format": "int64" + }, + "currency": { + "type": "string" + }, + "friend": { + "type": "string" + } + } + } + } + } +} \ No newline at end of file diff --git a/arcadia/arcadia.tf b/arcadia/arcadia.tf new file mode 100644 index 00000000..58b21210 --- /dev/null +++ b/arcadia/arcadia.tf @@ -0,0 +1,137 @@ +resource "kubernetes_deployment" "main" { + metadata { + name = "main" + labels = { + app = "main" + } + } + spec { + replicas = 1 + selector { + match_labels = { + app = "main" + } + } + template { + metadata { + labels = { + app = "main" + } + } + spec { + container { + name = "main" + image = "registry.gitlab.com/arcadia-application/main-app/mainapp:latest" + + port { + container_port = 80 + } + image_pull_policy = "IfNotPresent" + } + } + } + } +} +resource "kubernetes_deployment" "backend" { + metadata { + name = "backend" + labels = { + app = "backend" + } + } + spec { + replicas = 1 + + selector { + match_labels = { + app = "backend" + } + } + template { + metadata { + labels = { + app = "backend" + } + } + spec { + container { + name = "backend" + image = "registry.gitlab.com/arcadia-application/back-end/backend:latest" + port { + container_port = 80 + } + image_pull_policy = "IfNotPresent" + } + } + } + } +} +resource "kubernetes_deployment" "app_2" { + metadata { + name = "app2" + labels = { + app = "app2" + } + } + spec { + replicas = 1 + selector { + match_labels = { + app = "app2" + } + } + template { + metadata { + labels = { + app = "app2" + } + } + spec { + container { + name = "app2" + image = "registry.gitlab.com/arcadia-application/app2/app2:latest" + port { + container_port = 80 + } + image_pull_policy = "IfNotPresent" + } + } + } + } +} +resource "kubernetes_deployment" "app_3" { + metadata { + name = "app3" + labels = { + app = "app3" + } + } + + spec { + replicas = 1 + selector { + match_labels = { + app = "app3" + } + } + + template { + metadata { + labels = { + app = "app3" + } + } + + spec { + container { + name = "app3" + image = "registry.gitlab.com/arcadia-application/app3/app3:latest" + port { + container_port = 80 + } + image_pull_policy = "IfNotPresent" + } + } + } + } +} diff --git a/arcadia/data.tf b/arcadia/data.tf new file mode 100644 index 00000000..dbe26856 --- /dev/null +++ b/arcadia/data.tf @@ -0,0 +1,21 @@ +data "tfe_outputs" "infra" { + organization = var.tf_cloud_organization + workspace = "infra" +} +data "tfe_outputs" "eks" { + organization = var.tf_cloud_organization + workspace = "eks" +} +data "tfe_outputs" "nap" { + count = data.tfe_outputs.infra.values.nap ? 1 : 0 + organization = var.tf_cloud_organization + workspace = "nap" +} +data "tfe_outputs" "nic" { + count = data.tfe_outputs.infra.values.nic ? 1 : 0 + organization = var.tf_cloud_organization + workspace = "nic" +} +data "aws_eks_cluster_auth" "auth" { + name = data.tfe_outputs.eks.values.cluster_name +} diff --git a/arcadia/ingress.tf b/arcadia/ingress.tf new file mode 100644 index 00000000..d4197e1e --- /dev/null +++ b/arcadia/ingress.tf @@ -0,0 +1,58 @@ +resource "kubernetes_ingress_v1" "arcadia-ingress" { + metadata { + name = "arcadia-ingress" + } + spec { + ingress_class_name = "nginx" + rule { + #host = try(data.tfe_outputs.nap.values.external_name, data.tfe_outputs.nic.values.external_name, "arcadia-cd-demo.sr.f5-cloud-demo.com") + host = try(data.tfe_outputs.nap[0].values.external_name, data.tfe_outputs.nic[0].values.external_name) + http { + path { + path = "/" + backend { + service { + name = kubernetes_service.main.metadata.0.name + port { + number = 80 + } + } + } + } + path { + path = "/files" + backend { + service { + name = kubernetes_service.backend.metadata.0.name + port { + number = 80 + } + } + } + } + path { + path = "/api" + backend { + service { + name = kubernetes_service.app_2.metadata.0.name + port { + number = 80 + } + } + } + } + path { + path = "/app3" + backend { + service { + name = kubernetes_service.app_3.metadata.0.name + port { + number = 80 + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/nic/locals.tf b/arcadia/locals.tf similarity index 55% rename from nic/locals.tf rename to arcadia/locals.tf index f266df70..e38109f0 100644 --- a/nic/locals.tf +++ b/arcadia/locals.tf @@ -1,9 +1,9 @@ locals { project_prefix = data.tfe_outputs.infra.values.project_prefix - build_suffix = data.tfe_outputs.infra.values.build_suffix + #external_name = try(data.tfe_outputs.nap.values.external_name, data.tfe_outputs.nic.values.external_name, "arcadia-cd-demo.sr.f5-cloud-demo.com") + external_name = try(data.tfe_outputs.nap[0].values.external_name, data.tfe_outputs.nic[0].values.external_name) aws_region = data.tfe_outputs.infra.values.aws_region host = data.tfe_outputs.eks.values.cluster_endpoint cluster_ca_certificate = data.tfe_outputs.eks.values.kubeconfig-certificate-authority-data cluster_name = data.tfe_outputs.eks.values.cluster_name - app = format("%s-nic-%s", local.project_prefix, local.build_suffix) -} +} \ No newline at end of file diff --git a/nic/main.tf b/arcadia/main.tf similarity index 68% rename from nic/main.tf rename to arcadia/main.tf index 5e728fa3..361f5f35 100644 --- a/nic/main.tf +++ b/arcadia/main.tf @@ -12,10 +12,4 @@ provider "helm" { cluster_ca_certificate = base64decode(local.cluster_ca_certificate) token = data.aws_eks_cluster_auth.auth.token } -} -provider "kubectl" { - host = local.host - cluster_ca_certificate = base64decode(local.cluster_ca_certificate) - token = data.aws_eks_cluster_auth.auth.token - load_config_file = false } \ No newline at end of file diff --git a/arcadia/service.tf b/arcadia/service.tf new file mode 100644 index 00000000..45ab4f14 --- /dev/null +++ b/arcadia/service.tf @@ -0,0 +1,80 @@ +resource "kubernetes_service" "main" { + metadata { + name = "main" + labels = { + app = "main" + service = "main" + } + } + spec { + port { + protocol = "TCP" + port = 80 + target_port = "80" + } + selector = { + app = "main" + } + type = "ClusterIP" + } +} +resource "kubernetes_service" "backend" { + metadata { + name = "backend" + labels = { + app = "backend" + service = "backend" + } + } + spec { + port { + protocol = "TCP" + port = 80 + target_port = "80" + } + selector = { + app = "backend" + } + type = "ClusterIP" + } +} +resource "kubernetes_service" "app_2" { + metadata { + name = "app2" + labels = { + app = "app2" + service = "app2" + } + } + spec { + port { + protocol = "TCP" + port = 80 + target_port = "80" + } + selector = { + app = "app2" + } + type = "ClusterIP" + } +} +resource "kubernetes_service" "app_3" { + metadata { + name = "app3" + labels = { + app = "app3" + service = "app3" + } + } + spec { + port { + protocol = "TCP" + port = 80 + target_port = "80" + } + selector = { + app = "app3" + } + type = "ClusterIP" + } +} \ No newline at end of file diff --git a/arcadia/variables.tf b/arcadia/variables.tf new file mode 100644 index 00000000..4643ec9e --- /dev/null +++ b/arcadia/variables.tf @@ -0,0 +1,9 @@ +#TF Cloud +variable "tf_cloud_organization" { + type = string + description = "TF cloud org (Value set in TF cloud)" +} +variable "ssh_key" { + type = string + description = "Unneeded for arcadia, only present for warning handling with TF cloud variable set" +} \ No newline at end of file diff --git a/nic/versions.tf b/arcadia/versions.tf similarity index 74% rename from nic/versions.tf rename to arcadia/versions.tf index a19b134a..49810ae2 100644 --- a/nic/versions.tf +++ b/arcadia/versions.tf @@ -10,9 +10,5 @@ terraform { source = "hashicorp/helm" version = ">=2.7.0" } - kubectl = { - source = "gavinbunney/kubectl" - version = ">= 1.7.0" - } } } \ No newline at end of file diff --git a/code_of_conduct.md b/code_of_conduct.md deleted file mode 100644 index eba53b6c..00000000 --- a/code_of_conduct.md +++ /dev/null @@ -1,129 +0,0 @@ - -# Contributor Covenant Code of Conduct - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in our -community a harassment-free experience for everyone, regardless of age, body -size, visible or invisible disability, ethnicity, sex characteristics, gender -identity and expression, level of experience, education, socio-economic status, -nationality, personal appearance, race, religion, or sexual identity -and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, -diverse, inclusive, and healthy community. - -## Our Standards - -Examples of behavior that contributes to a positive environment for our -community include: - -* Demonstrating empathy and kindness toward other people -* Being respectful of differing opinions, viewpoints, and experiences -* Giving and gracefully accepting constructive feedback -* Accepting responsibility and apologizing to those affected by our mistakes, - and learning from the experience -* Focusing on what is best not just for us as individuals, but for the - overall community - -Examples of unacceptable behavior include: - -* The use of sexualized language or imagery, and sexual attention or - advances of any kind -* Trolling, insulting or derogatory comments, and personal or political attacks -* Public or private harassment -* Publishing others' private information, such as a physical or email - address, without their explicit permission -* Other conduct which could reasonably be considered inappropriate in a - professional setting - -## Enforcement Responsibilities - -Community leaders are responsible for clarifying and enforcing our standards of -acceptable behavior and will take appropriate and fair corrective action in -response to any behavior that they deem inappropriate, threatening, offensive, -or harmful. - -Community leaders have the right and responsibility to remove, edit, or reject -comments, commits, code, wiki edits, issues, and other contributions that are -not aligned to this Code of Conduct, and will communicate reasons for moderation -decisions when appropriate. - -## Scope - -This Code of Conduct applies within all community spaces, and also applies when -an individual is officially representing the community in public spaces. -Examples of representing our community include using an official e-mail address, -posting via an official social media account, or acting as an appointed -representative at an online or offline event. - -## Enforcement - -Instances of abusive, harassing, or otherwise unacceptable behavior may be -reported to the community leaders responsible for enforcement at -[INSERT CONTACT METHOD]. -All complaints will be reviewed and investigated promptly and fairly. - -All community leaders are obligated to respect the privacy and security of the -reporter of any incident. - -## Enforcement Guidelines - -Community leaders will follow these Community Impact Guidelines in determining -the consequences for any action they deem in violation of this Code of Conduct: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behavior deemed -unprofessional or unwelcome in the community. - -**Consequence**: A private, written warning from community leaders, providing -clarity around the nature of the violation and an explanation of why the -behavior was inappropriate. A public apology may be requested. - -### 2. Warning - -**Community Impact**: A violation through a single incident or series -of actions. - -**Consequence**: A warning with consequences for continued behavior. No -interaction with the people involved, including unsolicited interaction with -those enforcing the Code of Conduct, for a specified period of time. This -includes avoiding interactions in community spaces as well as external channels -like social media. Violating these terms may lead to a temporary or -permanent ban. - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including -sustained inappropriate behavior. - -**Consequence**: A temporary ban from any sort of interaction or public -communication with the community for a specified period of time. No public or -private interaction with the people involved, including unsolicited interaction -with those enforcing the Code of Conduct, is allowed during this period. -Violating these terms may lead to a permanent ban. - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community -standards, including sustained inappropriate behavior, harassment of an -individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within -the community. - -## Attribution - -This Code of Conduct is adapted from the [Contributor Covenant][homepage], -version 2.0, available at -https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. - -Community Impact Guidelines were inspired by [Mozilla's code of conduct -enforcement ladder](https://github.com/mozilla/diversity). - -[homepage]: https://www.contributor-covenant.org - -For answers to common questions about this code of conduct, see the FAQ at -https://www.contributor-covenant.org/faq. Translations are available at -https://www.contributor-covenant.org/translations. diff --git a/eks-cluster/eks_cluster.tf b/eks-cluster/eks_cluster.tf index f20c0fc0..bf00a428 100644 --- a/eks-cluster/eks_cluster.tf +++ b/eks-cluster/eks_cluster.tf @@ -4,7 +4,7 @@ resource "aws_eks_cluster" "eks-tf" { name = local.cluster_name role_arn = aws_iam_role.eks-iam-role.arn - version = "1.29" + version = "1.32" vpc_config { security_group_ids = flatten([aws_security_group.eks_cluster.id, aws_security_group.eks_nodes.id]) @@ -25,7 +25,7 @@ resource "aws_eks_node_group" "private-node-group-1-tf" { node_group_name = format("%s-private-ng-1-%s", local.project_prefix, local.build_suffix) node_role_arn = aws_iam_role.workernodes.arn subnet_ids = [for i in aws_subnet.eks-internal: i.id] - instance_types = ["t3.small"] + instance_types = ["t3.medium"] scaling_config { desired_size = 2 @@ -58,7 +58,7 @@ resource "aws_eks_node_group" "private-node-group-2-tf" { node_role_arn = aws_iam_role.workernodes.arn subnet_ids = [for i in aws_subnet.eks-internal: i.id] ami_type = "AL2_x86_64" - instance_types = ["t3.small"] + instance_types = ["t3.medium"] scaling_config { desired_size = 2 diff --git a/infra/main.tf b/infra/main.tf new file mode 100644 index 00000000..acba9cd7 --- /dev/null +++ b/infra/main.tf @@ -0,0 +1,9 @@ +#Main +#AWS Provider +provider "aws" { + region = var.aws_region +} +# Create a random id +resource "random_id" "build_suffix" { + byte_length = 2 +} diff --git a/infra/network.tf b/infra/network.tf new file mode 100644 index 00000000..1f9bb8b6 --- /dev/null +++ b/infra/network.tf @@ -0,0 +1,99 @@ +############################ VPC ############################ + +# Create VPC, subnets, route tables, and IGW +data "aws_availability_zones" "available" { + state = "available" +} + +locals { + valid_azs = [for az in data.aws_availability_zones.available.names : az if az != "us-west-1a"] +} + +module "vpc" { + source = "terraform-aws-modules/vpc/aws" + version = ">= 4.0" + name = "${var.project_prefix}-vpc-${random_id.build_suffix.hex}" + cidr = var.cidr + azs = local.valid_azs + enable_dns_support = true + enable_dns_hostnames = true + tags = { + resource_owner = var.resource_owner + Name = "${var.project_prefix}-vpc-${random_id.build_suffix.hex}" + } +} + +resource "aws_internet_gateway" "igw" { + vpc_id = module.vpc.vpc_id + tags = { + Name = "${var.project_prefix}-igw-${random_id.build_suffix.hex}" + } +} + +module subnet_addrs { + for_each = toset(local.valid_azs) + source = "hashicorp/subnets/cidr" + version = ">= 1.0.0" + base_cidr_block = cidrsubnet(module.vpc.vpc_cidr_block,4,index(local.valid_azs,each.key)) + networks = [ + { name = "management", new_bits = 8 }, + { name = "internal", new_bits = 6 }, + { name = "external", new_bits = 6 }, + { name = "app-cidr", new_bits = 4 } + ] +} + +resource "aws_subnet" "internal" { + for_each = toset(local.valid_azs) + vpc_id = module.vpc.vpc_id + cidr_block = module.subnet_addrs[each.key].network_cidr_blocks["internal"] + availability_zone = each.key + tags = { Name = format("%s-int-subnet-%s", var.project_prefix, each.key) } +} + +resource "aws_subnet" "management" { + for_each = toset(local.valid_azs) + vpc_id = module.vpc.vpc_id + cidr_block = module.subnet_addrs[each.key].network_cidr_blocks["management"] + availability_zone = each.key + tags = { Name = format("%s-mgmt-subnet-%s", var.project_prefix, each.key) } +} + +resource "aws_subnet" "external" { + for_each = toset(local.valid_azs) + vpc_id = module.vpc.vpc_id + cidr_block = module.subnet_addrs[each.key].network_cidr_blocks["external"] + map_public_ip_on_launch = true + availability_zone = each.key + tags = { Name = format("%s-ext-subnet-%s", var.project_prefix, each.key) } +} + +resource "aws_route_table" "main" { + vpc_id = module.vpc.vpc_id + route { + cidr_block = "0.0.0.0/0" + gateway_id = aws_internet_gateway.igw.id + } + tags = { + Name = "${var.project_prefix}-rt-${random_id.build_suffix.hex}" + } +} + +resource "aws_route_table_association" "subnet-association-internal" { + for_each = toset(local.valid_azs) + subnet_id = aws_subnet.internal[each.key].id + route_table_id = aws_route_table.main.id +} + +resource "aws_route_table_association" "subnet-association-management" { + for_each = toset(local.valid_azs) + subnet_id = aws_subnet.management[each.key].id + route_table_id = aws_route_table.main.id +} + +resource "aws_route_table_association" "subnet-association-external" { + for_each = toset(local.valid_azs) + subnet_id = aws_subnet.external[each.key].id + route_table_id = aws_route_table.main.id +} + diff --git a/infra/outputs.tf b/infra/outputs.tf new file mode 100644 index 00000000..a6c7d3a7 --- /dev/null +++ b/infra/outputs.tf @@ -0,0 +1,100 @@ +#Global +output "project_prefix" { + value = var.project_prefix +} +output "resource_owner" { + value = var.resource_owner +} +output "build_suffix" { + value = random_id.build_suffix.hex +} +#Outputs +output "aws_region" { + value = var.aws_region +} +output "azs" { + value = var.azs +} +output "vpc_cidr_block" { + description = "CIDR Block" + value = module.vpc.vpc_cidr_block +} +output "vpc_id" { + description = "VPC ID" + value = module.vpc.vpc_id +} +output "vpc_main_route_table_id" { + value = aws_route_table.main.id +} +output "public_subnet_ids" { + value = [values(aws_subnet.external)[0].id, values(aws_subnet.external)[1].id] +} +output "private_cidr_blocks" { + value = [values(aws_subnet.internal)[0].cidr_block, values(aws_subnet.internal)[1].cidr_block] +} +output "public_cidr_blocks" { + value = [values(aws_subnet.external)[0].cidr_block, values(aws_subnet.external)[1].cidr_block] +} +output "management_cidr_blocks" { + value = [values(aws_subnet.management)[0].cidr_block, values(aws_subnet.management)[1].cidr_block] +} +output "private_subnet_ids" { + value = [values(aws_subnet.internal)[0].id, values(aws_subnet.internal)[1].id] +} +output "public_az1_cidr_block" { +value = values(aws_subnet.external)[0].cidr_block +} +output "private_az1_cidr_block" { +value = values(aws_subnet.internal)[0].cidr_block +} +output "app_cidr" { + description = "Application server(Juice Shop) CIDR block" + value = values(module.subnet_addrs)[0].network_cidr_blocks.app-cidr +} +output "eks_cidr" { + description = "Application server(EKS) CIDR block" + value = values(module.subnet_addrs)[1].network_cidr_blocks.app-cidr +} + +output "ext_subnet_az1" { + description = "ID of External subnet AZ1" + value = values(aws_subnet.external)[0].id +} +output "ext_subnet_az2" { + description = "ID of External subnet AZ2" + value = values(aws_subnet.external)[1].id +} +output "int_subnet_az1" { + description = "ID of Internal subnet AZ1" + value = values(aws_subnet.internal)[0].id +} +output "int_subnet_az2" { + description = "ID of Internal subnet AZ2" + value = values(aws_subnet.internal)[1].id +} +output "mgmt_subnet_az1" { + description = "ID of Management subnet AZ1" + value = values(aws_subnet.management)[0].id +} +output "mgmt_subnet_az2" { + description = "ID of Management subnet AZ2" + value = values(aws_subnet.management)[1].id +} + +output "external_sg_id" { + value = aws_security_group.external.id +} +output "management_sg_id" { + value = aws_security_group.management.id +} +output "internal_sg_id" { + value = aws_security_group.internal.id +} + +output "nap" { + value = var.nap +} +output "nic" { + value = var.nic +} + diff --git a/infra/security_groups.tf b/infra/security_groups.tf new file mode 100644 index 00000000..ab07a8f7 --- /dev/null +++ b/infra/security_groups.tf @@ -0,0 +1,143 @@ +#Restrict Default VPC SG +resource "aws_default_security_group" "restrict_dsg" { + vpc_id = module.vpc.vpc_id + tags = { + Name = format("%s-default-sg-%s", var.project_prefix, random_id.build_suffix.hex) + Owner = var.resource_owner + } +} + +#Security Group External +resource "aws_security_group" "external" { + name = format("%s-sg-ext-%s", var.project_prefix, random_id.build_suffix.hex) + vpc_id = module.vpc.vpc_id + + tags = { + Name = format("%s-sg-ext-%s", var.project_prefix, random_id.build_suffix.hex) + Owner = var.resource_owner + } +} + +#Security Group External - traffic rules +resource "aws_security_group_rule" "sg_ingress_public_443" { + security_group_id = aws_security_group.external.id + type = "ingress" + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] +} +resource "aws_security_group_rule" "sg_ingress_public_8443" { + security_group_id = aws_security_group.external.id + type = "ingress" + from_port = 8443 + to_port = 8443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] +} +resource "aws_security_group_rule" "sg_ingress_public_80" { + security_group_id = aws_security_group.external.id + type = "ingress" + from_port = 80 + to_port = 80 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] +} +resource "aws_security_group_rule" "sg_egress_public" { + security_group_id = aws_security_group.external.id + type = "egress" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] +} + +#Security Group - MGMT +resource "aws_security_group" "management" { + name = format("%s-sg-mgmt-%s", var.project_prefix, random_id.build_suffix.hex) + vpc_id = module.vpc.vpc_id + + tags = { + Name = format("%s-sg-mgmt-%s", var.project_prefix, random_id.build_suffix.hex) + Owner = var.resource_owner + } +} + +#Security Group External - traffic rules +resource "aws_security_group_rule" "sg_ingress_management_443" { + security_group_id = aws_security_group.management.id + type = "ingress" + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] +} +resource "aws_security_group_rule" "sg_ingress_management_8443" { + security_group_id = aws_security_group.management.id + type = "ingress" + from_port = 8443 + to_port = 8443 + protocol = "tcp" + cidr_blocks = [var.admin_src_addr] +} +resource "aws_security_group_rule" "sg_ingress_management_22" { + security_group_id = aws_security_group.management.id + type = "ingress" + from_port = 22 + to_port = 22 + protocol = "tcp" + cidr_blocks = [var.admin_src_addr] +} +resource "aws_security_group_rule" "sg_egress_management" { + security_group_id = aws_security_group.management.id + type = "egress" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] +} + +#Security Group - Internal +resource "aws_security_group" "internal" { + name = format("%s-sg-int-%s", var.project_prefix, random_id.build_suffix.hex) + vpc_id = module.vpc.vpc_id + + tags = { + Name = format("%s-sg-int-%s", var.project_prefix, random_id.build_suffix.hex) + Owner = var.resource_owner + + } +} +#Security Group Internal - traffic rules +resource "aws_security_group_rule" "sg_ingress_internal" { + security_group_id = aws_security_group.internal.id + type = "ingress" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = [module.vpc.vpc_cidr_block] +} +resource "aws_security_group_rule" "sg_ingress_internal_443" { + security_group_id = aws_security_group.internal.id + type = "ingress" + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] +} +resource "aws_security_group_rule" "sg_ingress_internal_80" { + security_group_id = aws_security_group.internal.id + type = "ingress" + from_port = 80 + to_port = 80 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] +} +resource "aws_security_group_rule" "sg_egress_internal" { + security_group_id = aws_security_group.internal.id + type = "egress" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] +} \ No newline at end of file diff --git a/infra/terraform.tfvars b/infra/terraform.tfvars new file mode 100644 index 00000000..ee55ed2c --- /dev/null +++ b/infra/terraform.tfvars @@ -0,0 +1,8 @@ +project_prefix = "aws-automation" +resource_owner = "akash" +aws_region = "us-east-1" +azs = ["us-east-1a", "us-east-1b"] + +# Set the following feature flags for this use case +nic = false +nap = true diff --git a/infra/variables.tf b/infra/variables.tf new file mode 100644 index 00000000..37b27367 --- /dev/null +++ b/infra/variables.tf @@ -0,0 +1,70 @@ +# Variables + +variable "project_prefix" { + type = string +# default = "demo" + description = "This value is inserted at the beginning of each AWS object (alpha-numeric, no special character)" +} +variable "aws_region" { + description = "aws region" + type = string + default = "us-east-1" +} +variable "resource_owner" { + type = string + description = "owner of the deployment, for tagging purposes" + default = "myName" +} +variable "tf_cloud_organization" { + type = string + description = "TF cloud org (Value set in TF cloud)" +} +variable "ssh_key" { + type = string + description = "key used for authentication in ssh-rsa format" +} +variable cidr { + description = "the CIDR block for the Virtual Private Cloud (VPC) of the deployment" + default = "10.0.0.0/16" + type = string + validation { + condition = can(regex("^([0-9]{1,3}.){3}[0-9]{1,3}($|/(16|24))$",var.cidr)) + error_message = "The value must conform to a CIDR block format." + } +} +variable "azs" { + description = "Availability Zones" + type = list +} +variable "create_nat_gateway" { + type = bool + default = false + description = "Set to true if a NGW is needed" +} +variable "admin_src_addr" { + type = string + description = "Allowed Admin source IP prefix" + default = "0.0.0.0/0" +} +variable "mgmt_address_prefixes" { + type = list(any) + default = ["10.1.1.0/24", "10.1.100.0/24"] + description = "Management subnet address prefixes" +} +variable "ext_address_prefixes" { + type = list(any) + default = ["10.1.10.0/24", "10.1.110.0/24"] + description = "External subnet address prefixes" +} +variable "int_address_prefixes" { + type = list(any) + default = ["10.1.20.0/24", "10.1.120.0/24"] + description = "Internal subnet address prefixes" +} +variable "nap" { + type = bool +} +variable "nic" { + type = bool +} + diff --git a/infra/versions.tf b/infra/versions.tf new file mode 100644 index 00000000..e12333b1 --- /dev/null +++ b/infra/versions.tf @@ -0,0 +1,6 @@ +terraform { + required_version = ">= 0.14.0" + required_providers { + aws = ">= 4" + } +} diff --git a/nap/data.tf b/nap/data.tf index 1c0221eb..d83783f8 100644 --- a/nap/data.tf +++ b/nap/data.tf @@ -12,6 +12,6 @@ data "aws_eks_cluster_auth" "auth" { data "kubernetes_service_v1" "nginx-service" { metadata { name = try(format("%s-%s-controller", helm_release.nginx-plus-ingress.0.name, helm_release.nginx-plus-ingress.0.chart)) - namespace = try(helm_release.nginx-plus-ingress[0].namespace, helm_release.nginx-plus-ingresslink[0].namespace) + namespace = try(helm_release.nginx-plus-ingress[0].namespace) } } diff --git a/nap/grafana.tf b/nap/grafana.tf index d4cd86a9..6c64bca8 100644 --- a/nap/grafana.tf +++ b/nap/grafana.tf @@ -1,9 +1,8 @@ resource "helm_release" "grafana" { - name = format("%s-gfa-%s", local.project_prefix, local.build_suffix) - repository = "https://grafana.github.io/helm-charts" - chart = "grafana" - version = "6.50.7" - namespace = kubernetes_namespace.monitoring.metadata[0].name - #values = [templatefile("./charts/grafana/values.yaml", { external_name = "${data.kubernetes_service_v1.nginx-service.status.0.load_balancer.0.ingress.0.hostname}"})] - values = [file("./charts/grafana/values.yaml")] -} \ No newline at end of file + name = format("%s-gfa-%s", local.project_prefix, local.build_suffix) + repository = "https://grafana.github.io/helm-charts" + chart = "grafana" + version = "6.50.7" + namespace = kubernetes_namespace.monitoring.metadata[0].name + values = [file("./charts/grafana/values.yaml")] +} diff --git a/nap/nap.tf b/nap/nap.tf index 7f286015..cfaa0c7e 100644 --- a/nap/nap.tf +++ b/nap/nap.tf @@ -1,14 +1,33 @@ resource "helm_release" "nginx-plus-ingress" { - count = local.bigip_cis ? 0 : 1 - name = format("%s-nap-%s", local.project_prefix, local.build_suffix) - repository = "https://helm.nginx.com/stable" - chart = "nginx-ingress" - #version = "0.16.2" - namespace = kubernetes_namespace.nginx-ingress.metadata[0].name - values = [file("./charts/nginx-app-protect/values.yaml")] - - depends_on = [ - kubernetes_secret.docker-registry - ] + name = format("%s-nap-%s", local.project_prefix, local.build_suffix) + repository = "https://helm.nginx.com/stable" + chart = "nginx-ingress" + version = "2.0.1" + namespace = kubernetes_namespace.nginx-ingress.metadata[0].name + values = [file("./charts/nginx-app-protect/values.yaml")] + timeout = 500 + + depends_on = [ + kubernetes_secret.docker-registry, + null_resource.nap_complete + ] +} + +resource "null_resource" "nap_complete" { + triggers = { + nap_complete = "true" + } } +resource "null_resource" "copy_compiled_policy" { + depends_on = [ + helm_release.nginx-plus-ingress # Ensure this runs after the Helm release + ] + + provisioner "local-exec" { + command = < Secrets --> Actions --> New repository secrets. - * AWS_ACCESS_KEY_ID (AWS credentials which you will get under aws --> users --> Command line or programmatic access info) - * AWS_SECRET_ACCESS_KEY - * AWS_SESSION_TOKEN - * AWS_DEFAULT_REGION - Note: Above values typically expire in every 12 hours. - ![image](https://user-images.githubusercontent.com/6093830/209962425-1c3452ec-9b32-4509-adb5-cc85d4a67a10.png) - * EC2 key related pem and pub file should be copied to nginx/nap-deployment-aws-cloud/terraform folder - * Make sure the Arcadia application hosted instance that you mentioned under nginx/nap-deployment-aws-cloud/terraform/nginx.conf is UP and running. - Note: Arcadia in ohio with 8080, run ./start_arcadia.sh in the instance - * Update the `ENV` variables in `verified_designs_examples/nginx/nap-deployment-aws-cloud/data/testbed-data.json` - * Make sure your self hosted runner is installed and added to this repo - * Make sure `awscli`, `pytest` and other required tools are installed in this private custom runner. Refer `requirements.txt` file for more details - -## Steps to run the workflow: -* Navigate to Actions tab in the repository and select the workflow "Deploy Nginx App Protect in AWS" to execute. -* Click on Run workflow on the right side of the UI -### Steps: -![image](https://user-images.githubusercontent.com/39581520/205597185-2b160fb6-65c1-4192-a42d-66fc5f3746fd.png) -### Jobs: -![image](https://user-images.githubusercontent.com/39581520/205597316-d54a7f67-dd3f-4d48-9c64-d810cac43908.png) -### Jobs In-detail: -![image](https://user-images.githubusercontent.com/39581520/205601145-79079495-d8de-490b-ad7a-a5453e086cdf.png) - -### Debugging steps: -* No pipeline job is getting executed - Check if self hosted runner is available -* Pipeline fails with credential/token error - Check if credentials are valid and not expired -* Testing job fails - Check if any errors in Testing job failed TC's in Report.html file and rerun testing job -* Deploy job fails with already exists errors - Check if components in this article are not cleaned properly because of some intermittent network issues. If some components are stil available please delete them like VPC or EC2 instance diff --git a/nginx/nap-deployment-aws-cloud/clean_env.py b/nginx/nap-deployment-aws-cloud/clean_env.py deleted file mode 100644 index d1dbcfe2..00000000 --- a/nginx/nap-deployment-aws-cloud/clean_env.py +++ /dev/null @@ -1,18 +0,0 @@ -'''clean infra env key before running scripts.''' - -import os -import json -import awslib -from var import * - - -cwd = os.getcwd() -print(" CWD: ", cwd) -data_dir = cwd+"/data/" -print(" DATADir: ", data_dir) -testbed_data_path = data_dir + "testbed-data.json" -testbed_data = json.load(open(testbed_data_path, 'r')) -ec2_key_name = TF_VAR_EC2_KEY_NAME -print("ec2_key_name:", ec2_key_name) - -#awslib.del_kpair(ec2_key_name) diff --git a/nginx/nap-deployment-aws-cloud/data/.gitkeep b/nginx/nap-deployment-aws-cloud/data/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/nginx/nap-deployment-aws-cloud/data/__init__.py b/nginx/nap-deployment-aws-cloud/data/__init__.py deleted file mode 100644 index 0e5f913d..00000000 --- a/nginx/nap-deployment-aws-cloud/data/__init__.py +++ /dev/null @@ -1,4 +0,0 @@ -"""Path to our data folder.""" - -import sys -sys.path.append('data') diff --git a/nginx/nap-deployment-aws-cloud/data/as3.json b/nginx/nap-deployment-aws-cloud/data/as3.json deleted file mode 100644 index ddcfc3d7..00000000 --- a/nginx/nap-deployment-aws-cloud/data/as3.json +++ /dev/null @@ -1,74 +0,0 @@ -{ - "class": "AS3", - "action": "deploy", - "persist": true, - "declaration": { - "class": "ADC", - "schemaVersion": "3.2.0", - "id": "Prod_API_AS3", - "API-Prod": { - "class": "Tenant", - "defaultRouteDomain": 0, - "API": { - "class": "Application", - "template": "generic", - "VS_API": { - "class": "Service_HTTPS", - "remark": "Accepts HTTPS/TLS connections on port 443", - "virtualAddresses": [ - "10.0.0.100" - ], - "redirect80": false, - "pool": "pool_NGINX_API_AS3", - "policyWAF": { - "use": "Arcadia_WAF_API_policy" - }, - "securityLogProfiles": [ - { - "bigip": "/Common/Log all requests" - } - ], - "profileTCP": { - "egress": "wan", - "ingress": { - "use": "TCP_Profile" - } - }, - "profileHTTP": { - "use": "custom_http_profile" - }, - "serverTLS": { - "bigip": "/Common/clientssl" - } - }, - "Arcadia_WAF_API_policy": { - "class": "WAF_Policy", - "url": "https://raw.githubusercontent.com/f5devcentral/f5-asm-policy-templates/master/application_ready_template/SharePoint_2016/Sharepoint_2016_Template_6.1.2_v13.xml", - "ignoreChanges": true - }, - "pool_NGINX_API_AS3": { - "class": "Pool", - "monitors": [ - "http" - ], - "members": [ - { - "servicePort": 80, - "serverAddresses": [ - "10.1.1.246" - ] - } - ] - }, - "custom_http_profile": { - "class": "HTTP_Profile", - "xForwardedFor": true - }, - "TCP_Profile": { - "class": "TCP_Profile", - "idleTimeout": 60 - } - } - } - } -} diff --git a/nginx/nap-deployment-aws-cloud/data/buy_stocks.json b/nginx/nap-deployment-aws-cloud/data/buy_stocks.json deleted file mode 100644 index 12c5b4e1..00000000 --- a/nginx/nap-deployment-aws-cloud/data/buy_stocks.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "trans_value":12, - "qty":16, - "company":"MSFT", - "action":"buy", - "stock_price":198 -} diff --git a/nginx/nap-deployment-aws-cloud/data/default.conf b/nginx/nap-deployment-aws-cloud/data/default.conf deleted file mode 100644 index 773bb4bd..00000000 --- a/nginx/nap-deployment-aws-cloud/data/default.conf +++ /dev/null @@ -1,81 +0,0 @@ -upstream mainapp { - - server mainapp; - -} - -upstream backend { - - server backend; - -} - -upstream app2 { - - server app2; - -} - -upstream app3 { - - server app3; - -} - -server { - - listen 80 default_server; - - #charset koi8-r; - - #access_log /var/log/nginx/host.access.log main; - - location / { - - proxy_pass http://mainapp/; - - } - - location /files { - - proxy_pass http://backend/files/; - - } - - location /api { - - proxy_pass http://app2/api/; - - } - - location /app3 { - - proxy_pass http://app3/app3/; - - } - - #error_page 404 /404.html; - - # redirect server error pages to the static page /50x.html - - # - - error_page 500 502 503 504 /50x.html; - - location = /50x.html { - - root /usr/share/nginx/html; - - } - - # proxy the PHP scripts to Apache listening on 127.0.0.1:80 - - # - - #location ~ \.php$ { - - # proxy_pass http://127.0.0.1; - - #} - - } \ No newline at end of file diff --git a/nginx/nap-deployment-aws-cloud/data/elk_dashboard.json b/nginx/nap-deployment-aws-cloud/data/elk_dashboard.json deleted file mode 100644 index 5de33cf2..00000000 --- a/nginx/nap-deployment-aws-cloud/data/elk_dashboard.json +++ /dev/null @@ -1,13 +0,0 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"title":"Requests Rate","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Requests Rate\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(split=request_status.keyword:20, index=waf-logs-*).label(\\\"Request Status: $1\\\", \\\"^.*:(.*) >.*\\\")\",\"interval\":\"auto\"},\"aggs\":[]}"},"id":"92a3e950-3438-11ea-983a-f74b5d6c2f97","migrationVersion":{"visualization":"7.4.2"},"references":[],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEyOCwyXQ=="} -{"attributes":{"fields":"[{\"name\":\"@timestamp\",\"type\":\"date\",\"esTypes\":[\"date\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@version\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@version.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"@version\",\"subType\":\"multi\"},{\"name\":\"ASM:unit_hostname\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"ASM:unit_hostname.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"ASM:unit_hostname\",\"subType\":\"multi\"},{\"name\":\"_id\",\"type\":\"string\",\"esTypes\":[\"_id\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"esTypes\":[\"_index\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"esTypes\":[\"_source\"],\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"esTypes\":[\"_type\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"attack_type\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"attack_type.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"attack_type\",\"subType\":\"multi\"},{\"name\":\"blocking_exception_reason\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"blocking_exception_reason.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"blocking_exception_reason\",\"subType\":\"multi\"},{\"name\":\"captcha_result\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"captcha_result.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"captcha_result\",\"subType\":\"multi\"},{\"name\":\"date_time\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"date_time.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"date_time\",\"subType\":\"multi\"},{\"name\":\"dest_ip\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"dest_ip.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"dest_ip\",\"subType\":\"multi\"},{\"name\":\"dest_port\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"dest_port.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"dest_port\",\"subType\":\"multi\"},{\"name\":\"device_id\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"device_id.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"device_id\",\"subType\":\"multi\"},{\"name\":\"facility\",\"type\":\"number\",\"esTypes\":[\"long\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"facility_label\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"facility_label.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"facility_label\",\"subType\":\"multi\"},{\"name\":\"fragment\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"fragment.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"fragment\",\"subType\":\"multi\"},{\"name\":\"geo_location\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geo_location.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geo_location\",\"subType\":\"multi\"},{\"name\":\"geoip.city_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.city_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.city_name\",\"subType\":\"multi\"},{\"name\":\"geoip.continent_code\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.continent_code.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.continent_code\",\"subType\":\"multi\"},{\"name\":\"geoip.country_code2\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.country_code2.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.country_code2\",\"subType\":\"multi\"},{\"name\":\"geoip.country_code3\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.country_code3.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.country_code3\",\"subType\":\"multi\"},{\"name\":\"geoip.country_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.country_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.country_name\",\"subType\":\"multi\"},{\"name\":\"geoip.dma_code\",\"type\":\"number\",\"esTypes\":[\"long\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geoip.ip\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.ip.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.ip\",\"subType\":\"multi\"},{\"name\":\"geoip.latitude\",\"type\":\"number\",\"esTypes\":[\"float\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geoip.location.lat\",\"type\":\"number\",\"esTypes\":[\"float\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geoip.location.lon\",\"type\":\"number\",\"esTypes\":[\"float\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geoip.longitude\",\"type\":\"number\",\"esTypes\":[\"float\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geoip.postal_code\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.postal_code.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.postal_code\",\"subType\":\"multi\"},{\"name\":\"geoip.region_code\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.region_code.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.region_code\",\"subType\":\"multi\"},{\"name\":\"geoip.region_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.region_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.region_name\",\"subType\":\"multi\"},{\"name\":\"geoip.timezone\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"geoip.timezone.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"geoip.timezone\",\"subType\":\"multi\"},{\"name\":\"host\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"host\",\"subType\":\"multi\"},{\"name\":\"http_class_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"http_class_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"http_class_name\",\"subType\":\"multi\"},{\"name\":\"ip_address_intelligence\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"ip_address_intelligence.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"ip_address_intelligence\",\"subType\":\"multi\"},{\"name\":\"ip_client\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"ip_client.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"ip_client\",\"subType\":\"multi\"},{\"name\":\"logsource\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"logsource.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"logsource\",\"subType\":\"multi\"},{\"name\":\"management_ip_address\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"management_ip_address.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"management_ip_address\",\"subType\":\"multi\"},{\"name\":\"management_ip_address_2\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"management_ip_address_2.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"management_ip_address_2\",\"subType\":\"multi\"},{\"name\":\"message\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"message.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"message\",\"subType\":\"multi\"},{\"name\":\"method\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"method.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"method\",\"subType\":\"multi\"},{\"name\":\"microservice\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"microservice.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"microservice\",\"subType\":\"multi\"},{\"name\":\"policy_apply_date\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"policy_apply_date.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"policy_apply_date\",\"subType\":\"multi\"},{\"name\":\"policy_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"policy_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"policy_name\",\"subType\":\"multi\"},{\"name\":\"priority\",\"type\":\"number\",\"esTypes\":[\"long\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"protocol\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"protocol.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"protocol\",\"subType\":\"multi\"},{\"name\":\"query_string\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"query_string.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"query_string\",\"subType\":\"multi\"},{\"name\":\"request\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"request\",\"subType\":\"multi\"},{\"name\":\"request_status\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request_status.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"request_status\",\"subType\":\"multi\"},{\"name\":\"response\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"response\",\"subType\":\"multi\"},{\"name\":\"response_code\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response_code.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"response_code\",\"subType\":\"multi\"},{\"name\":\"route_domain\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"route_domain.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"route_domain\",\"subType\":\"multi\"},{\"name\":\"session_id\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"session_id.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"session_id\",\"subType\":\"multi\"},{\"name\":\"severity\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"severity.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"severity\",\"subType\":\"multi\"},{\"name\":\"severity_label\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"severity_label.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"severity_label\",\"subType\":\"multi\"},{\"name\":\"sig_cves\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"sig_cves.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"sig_cves\",\"subType\":\"multi\"},{\"name\":\"sig_ids\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"sig_ids.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"sig_ids\",\"subType\":\"multi\"},{\"name\":\"sig_names\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"sig_names.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"sig_names\",\"subType\":\"multi\"},{\"name\":\"src_port\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"src_port.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"src_port\",\"subType\":\"multi\"},{\"name\":\"staged_sig_cves\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"staged_sig_cves.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"staged_sig_cves\",\"subType\":\"multi\"},{\"name\":\"staged_sig_ids\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"staged_sig_ids.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"staged_sig_ids\",\"subType\":\"multi\"},{\"name\":\"staged_sig_names\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"staged_sig_names.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"staged_sig_names\",\"subType\":\"multi\"},{\"name\":\"staged_threat_campaign_names\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"staged_threat_campaign_names.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"staged_threat_campaign_names\",\"subType\":\"multi\"},{\"name\":\"sub_violations\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"sub_violations.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"sub_violations\",\"subType\":\"multi\"},{\"name\":\"support_id\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"support_id.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"support_id\",\"subType\":\"multi\"},{\"name\":\"tags\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"tags.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"tags\",\"subType\":\"multi\"},{\"name\":\"tap_event_id\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"tap_event_id.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"tap_event_id\",\"subType\":\"multi\"},{\"name\":\"tap_vid\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"tap_vid.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"tap_vid\",\"subType\":\"multi\"},{\"name\":\"threat_campaign_names\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"threat_campaign_names.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"threat_campaign_names\",\"subType\":\"multi\"},{\"name\":\"timestamp\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"timestamp.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"timestamp\",\"subType\":\"multi\"},{\"name\":\"uri\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"uri.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"uri\",\"subType\":\"multi\"},{\"name\":\"username\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"username.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"username\",\"subType\":\"multi\"},{\"name\":\"violation_rating\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"violation_rating.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"violation_rating\",\"subType\":\"multi\"},{\"name\":\"violations\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"violations.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"violations\",\"subType\":\"multi\"},{\"name\":\"virus_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"virus_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"virus_name\",\"subType\":\"multi\"},{\"name\":\"vs_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"vs_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"vs_name\",\"subType\":\"multi\"},{\"name\":\"web_application_name\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"web_application_name.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"web_application_name\",\"subType\":\"multi\"},{\"name\":\"websocket_direction\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"websocket_direction.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"websocket_direction\",\"subType\":\"multi\"},{\"name\":\"websocket_message_type\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"websocket_message_type.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"websocket_message_type\",\"subType\":\"multi\"},{\"name\":\"x_forwarded_for_header_value\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"x_forwarded_for_header_value.keyword\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"parent\":\"x_forwarded_for_header_value\",\"subType\":\"multi\"}]","timeFieldName":"@timestamp","title":"waf-logs-*"},"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","migrationVersion":{"index-pattern":"6.5.0"},"references":[],"type":"index-pattern","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEyOSwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Requests Distribution","uiStateJSON":"{\"vis\":{\"colors\":{\"Blocked\":\"#BF1B00\",\"Alarmed\":\"#EAB839\",\"Alerted\":\"#E5AC0E\"}}}","version":1,"visState":"{\"title\":\"Requests Distribution\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"segment\",\"params\":{\"filters\":[{\"input\":{\"query\":\"violations.keyword : N/A and request_status : passed\",\"language\":\"kuery\"},\"label\":\"Clean\"},{\"input\":{\"query\":\"request_status : blocked\",\"language\":\"kuery\"},\"label\":\"Blocked\"},{\"input\":{\"query\":\"request_status : alerted\",\"language\":\"kuery\"},\"label\":\"Alerted\"}]}}]}"},"id":"7e5c83d0-2056-11ea-bcff-c3c564493235","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:51.361Z","version":"WzE0MiwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"title":"Response Codes Rate","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Response Codes Rate\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(split=response_code.keyword:20, index=waf-logs-*).label(\\\"Response Code: $1\\\", \\\"^.*:(.*) >.*\\\")\",\"interval\":\"auto\"},\"aggs\":[]}"},"id":"d990f700-3702-11ea-a241-09ab559b62bd","migrationVersion":{"visualization":"7.4.2"},"references":[],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzMSwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Response Codes Distribution","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Response Codes Distribution\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"response_code.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}"},"id":"5e376660-3703-11ea-a241-09ab559b62bd","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzMiwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Top Talkers","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Top Talkers\",\"type\":\"histogram\",\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":15},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"grid\":{\"categoryLines\":false},\"labels\":{\"show\":false},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ip_client.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Client IPs\"}}]}"},"id":"5eee5660-366b-11ea-a241-09ab559b62bd","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzMywyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Top URLs","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"URLs\",\"field\":\"uri.keyword\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":10},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},\"y\":[{\"accessor\":1,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{\"show\":false},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Top URLs\",\"type\":\"histogram\"}"},"id":"2b7fd200-3642-11ea-983a-f74b5d6c2f97","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzNCwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Top Violator IPs","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Top Violator IPs\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ip_client.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Violator IPs\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"violations.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"exclude\":\"N/A\"}}]}"},"id":"e97cb520-2053-11ea-bcff-c3c564493235","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzNSwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Signatures Distribution","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signatures Distribution\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"sig_ids.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"exclude\":\"N/A\",\"customLabel\":\"Signature ID\"}}]}"},"id":"8ace9ec0-2054-11ea-bcff-c3c564493235","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzNiwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Violations Distribution","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Violations Distribution\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"violations.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"exclude\":\"N/A\",\"customLabel\":\"Violation\"}}]}"},"id":"9b6276f0-2052-11ea-bcff-c3c564493235","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzNywyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"GEO","uiStateJSON":"{\"mapZoom\":1,\"mapCenter\":[64.5498936275396,0]}","version":1,"visState":"{\"title\":\"GEO\",\"type\":\"region_map\",\"params\":{\"addTooltip\":true,\"bucket\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"colorSchema\":\"Green to Red\",\"emsHotLink\":\"https://maps.elastic.co/v7.4?locale=en#file/world_countries\",\"isDisplayWarning\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapZoom\":2,\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"outlineWeight\":1,\"selectedJoinField\":{\"type\":\"id\",\"name\":\"iso2\",\"description\":\"ISO 3166-1 alpha-2 code\"},\"showAllShapes\":true,\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"selectedTmsLayer\":{\"origin\":\"elastic_maps_service\",\"id\":\"road_map\",\"minZoom\":0,\"maxZoom\":20,\"attribution\":\"

OpenStreetMap contributors | OpenMapTiles | MapTiler | Elastic Maps Service

\"}},\"selectedLayer\":{\"name\":\"World Countries\",\"origin\":\"elastic_maps_service\",\"id\":\"world_countries\",\"created_at\":\"2017-04-26T17:12:15.978370\",\"attribution\":\"Made with NaturalEarth | Elastic Maps Service\",\"fields\":[{\"type\":\"id\",\"name\":\"iso2\",\"description\":\"ISO 3166-1 alpha-2 code\"},{\"type\":\"id\",\"name\":\"iso3\",\"description\":\"ISO 3166-1 alpha-3 code\"},{\"type\":\"property\",\"name\":\"name\",\"description\":\"name\"}],\"format\":{\"type\":\"geojson\"},\"layerId\":\"elastic_maps_service.World Countries\",\"isEMS\":true}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Request Count\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"geoip.country_code3.keyword\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}"},"id":"d19c31a0-3666-11ea-a241-09ab559b62bd","migrationVersion":{"visualization":"7.4.2"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzOCwyXQ=="} -{"attributes":{"columns":["method","uri","violations","response_code","request_status","ip_client"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"support_id : * \"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"title":"All Requests","version":1},"id":"e3e0a060-343d-11ea-983a-f74b5d6c2f97","migrationVersion":{"search":"7.4.0"},"references":[{"id":"b6896160-1ade-11ea-bb19-634fb23c25ea","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","updated_at":"2020-06-16T22:07:16.336Z","version":"WzEzOSwyXQ=="} -{"attributes":{"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"hidePanelTitles\":false,\"useMargins\":true}","panelsJSON":"[{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"d7699f7c-f08d-49a6-bba4-391818076fc2\",\"w\":36,\"x\":0,\"y\":0},\"panelIndex\":\"d7699f7c-f08d-49a6-bba4-391818076fc2\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"colors\":{\"Alarmed\":\"#EAB839\",\"Blocked\":\"#BF1B00\"},\"legendOpen\":false,\"vis\":{\"colors\":{\"Alarmed\":\"#EAB839\",\"Blocked\":\"#BF1B00\"},\"legendOpen\":true}},\"gridData\":{\"h\":7,\"i\":\"be9d107d-a926-4151-b184-cc8ce56a84f4\",\"w\":12,\"x\":36,\"y\":0},\"panelIndex\":\"be9d107d-a926-4151-b184-cc8ce56a84f4\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"52a4031f-1321-4cf8-a649-bb3b87ee24d2\",\"w\":36,\"x\":0,\"y\":7},\"panelIndex\":\"52a4031f-1321-4cf8-a649-bb3b87ee24d2\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"b542bf0d-be9e-415d-bb88-5749cff274a3\",\"w\":12,\"x\":36,\"y\":7},\"panelIndex\":\"b542bf0d-be9e-415d-bb88-5749cff274a3\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":11,\"i\":\"cceda060-776b-40cb-b045-5649ace38816\",\"w\":24,\"x\":0,\"y\":14},\"panelIndex\":\"cceda060-776b-40cb-b045-5649ace38816\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":11,\"i\":\"37bc87ed-cb35-48fb-84fe-1142f57de563\",\"w\":24,\"x\":24,\"y\":14},\"panelIndex\":\"37bc87ed-cb35-48fb-84fe-1142f57de563\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":10,\"i\":\"494496f1-d1fd-4ea6-abaa-69c8728c5dec\",\"w\":17,\"x\":0,\"y\":25},\"panelIndex\":\"494496f1-d1fd-4ea6-abaa-69c8728c5dec\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"legendOpen\":false,\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":10,\"i\":\"8ae28754-12f5-4508-85bc-c99c40f45139\",\"w\":15,\"x\":17,\"y\":25},\"panelIndex\":\"8ae28754-12f5-4508-85bc-c99c40f45139\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{\"legendOpen\":false,\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":10,\"i\":\"c8041f88-a91e-4904-9991-6a891a4bbb2e\",\"w\":16,\"x\":32,\"y\":25},\"panelIndex\":\"c8041f88-a91e-4904-9991-6a891a4bbb2e\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{\"mapCenter\":null,\"mapZoom\":2},\"gridData\":{\"h\":14,\"i\":\"93ed98ec-fb4c-4171-a847-85f6a6c38e7d\",\"w\":48,\"x\":0,\"y\":35},\"panelIndex\":\"93ed98ec-fb4c-4171-a847-85f6a6c38e7d\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":15,\"i\":\"45501e8d-621a-4908-90b8-c2db02b3e82b\",\"w\":48,\"x\":0,\"y\":49},\"panelIndex\":\"45501e8d-621a-4908-90b8-c2db02b3e82b\",\"version\":\"7.4.0\",\"panelRefName\":\"panel_10\"}]","timeRestore":false,"title":"Overview","version":1},"id":"140fbf30-363e-11ea-983a-f74b5d6c2f97","migrationVersion":{"dashboard":"7.3.0"},"references":[{"id":"92a3e950-3438-11ea-983a-f74b5d6c2f97","name":"panel_0","type":"visualization"},{"id":"7e5c83d0-2056-11ea-bcff-c3c564493235","name":"panel_1","type":"visualization"},{"id":"d990f700-3702-11ea-a241-09ab559b62bd","name":"panel_2","type":"visualization"},{"id":"5e376660-3703-11ea-a241-09ab559b62bd","name":"panel_3","type":"visualization"},{"id":"5eee5660-366b-11ea-a241-09ab559b62bd","name":"panel_4","type":"visualization"},{"id":"2b7fd200-3642-11ea-983a-f74b5d6c2f97","name":"panel_5","type":"visualization"},{"id":"e97cb520-2053-11ea-bcff-c3c564493235","name":"panel_6","type":"visualization"},{"id":"8ace9ec0-2054-11ea-bcff-c3c564493235","name":"panel_7","type":"visualization"},{"id":"9b6276f0-2052-11ea-bcff-c3c564493235","name":"panel_8","type":"visualization"},{"id":"d19c31a0-3666-11ea-a241-09ab559b62bd","name":"panel_9","type":"visualization"},{"id":"e3e0a060-343d-11ea-983a-f74b5d6c2f97","name":"panel_10","type":"search"}],"type":"dashboard","updated_at":"2020-06-16T22:07:16.336Z","version":"WzE0MCwyXQ=="} \ No newline at end of file diff --git a/nginx/nap-deployment-aws-cloud/data/nginx-waffler.conf b/nginx/nap-deployment-aws-cloud/data/nginx-waffler.conf deleted file mode 100644 index 3c5eeec1..00000000 --- a/nginx/nap-deployment-aws-cloud/data/nginx-waffler.conf +++ /dev/null @@ -1,27 +0,0 @@ -user nginx; -worker_processes auto; -load_module modules/ngx_http_app_protect_module.so; -error_log /var/log/nginx/error.log notice; -pid /var/run/nginx.pid; - -events { - worker_connections 1024; -} - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - access_log /var/log/nginx/access.log main; - app_protect_enable on; # This is how you enable NGINX App Protect in the relevant context/block - app_protect_policy_file "/etc/app_protect/conf/NginxDefaultPolicy.json"; # This is a reference to the policy file to use. If not defined, the default policy is used - app_protect_security_log_enable on; # This section enables the logging capability - app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=127.0.0.1:515; - sendfile on; - keepalive_timeout 65; - include /etc/nginx/conf.d/*.conf; -} diff --git a/nginx/nap-deployment-aws-cloud/data/nginx.conf b/nginx/nap-deployment-aws-cloud/data/nginx.conf deleted file mode 100644 index 5d135d0d..00000000 --- a/nginx/nap-deployment-aws-cloud/data/nginx.conf +++ /dev/null @@ -1,36 +0,0 @@ -user nginx; -worker_processes 4; - -load_module modules/ngx_http_app_protect_module.so; - -error_log /var/log/nginx/error.log debug; - -events { - worker_connections 65536; -} - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - sendfile on; - keepalive_timeout 65; - - app_protect_enable on; # This is how you enable NGINX App Protect in the relevant context/block - app_protect_policy_file "/etc/app_protect/conf/NginxDefaultPolicy.json"; # This is a reference to the policy file to use. If not defined, the default policy is used - app_protect_security_log_enable on; # This section enables the logging capability - app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=127.0.0.1:5144; # This is where the remote logger is defined in terms of: logging options (defined in the referenced file), log server IP, log server port - limit_req_zone $binary_remote_addr zone=one:10m rate=6000r/m; - server { - listen 80; - server_name localhost; - proxy_http_version 1.1; - - location / { - limit_req zone=one; - limit_req_status 429; - client_max_body_size 0; - default_type text/html; - proxy_pass http://172.29.38.211:80$request_uri; - } - } -} diff --git a/nginx/nap-deployment-aws-cloud/data/sell_stocks.json b/nginx/nap-deployment-aws-cloud/data/sell_stocks.json deleted file mode 100644 index 51a12423..00000000 --- a/nginx/nap-deployment-aws-cloud/data/sell_stocks.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "trans_value":212, - "qty":16, - "company":"MSFT", - "action":"sell", - "stock_price":158 -} diff --git a/nginx/nap-deployment-aws-cloud/data/testbed-data.json b/nginx/nap-deployment-aws-cloud/data/testbed-data.json deleted file mode 100644 index 33f58160..00000000 --- a/nginx/nap-deployment-aws-cloud/data/testbed-data.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "AWS_ACCOUNT": "AWS-Acc-Name" - "s3_bucket": "apisecurity-bucket", - "region": "ap-south-1", - "region_snap": "ap-south-1", - "main_vpc_cidr": "10.0.0.0/16", - "mgmt_subnet1": "10.0.0.0/24", - "public_subnet2": "10.0.10.0/24", - "private_subnet3": "10.0.20.0/24", - "bigip_ami_name": "F5 BIGIP-*.*.*-*.*.* PAYG-Adv WAF Plus 200Mbps-*", - "f5_username": "admin", - "BIGIP_INSTANCE_TYPE": "t3.large", - "INSTANCE_NAME": "apisecurity_automation_instance", - "INSTANCE_NAME2": "apisecurity_automation_instance2", - "INSTANCE_TYPE": "t3.small", - "ELK_INSTANCE_TYPE": "t3.large", - "MAX_INST": 1, - "SG_NAME": "apisecurity_automation_sg", - "NAP_image_name": "nginx-plus-app-protect-ubuntu-18.04-v2.7-x86_64-premium-*", - "eks_cluster_name": "apisecurity_automation_eks", - "UBUNTU_IMAGE_NAME": "ubuntu-20.04-pke-docker-1.21.0-*", - "python_ec2_key": "automation-python-key", - "bigip_build_public": "true", - "public_subnet_a_cidr": "10.0.8.0/24", - "public_subnet_b_cidr": "10.0.255.0/24", - "subnet_a_cidr": "10.0.1.0/24", - "subnet_b_cidr": "10.0.0.0/24" -} diff --git a/nginx/nap-deployment-aws-cloud/data/transfer_money.json b/nginx/nap-deployment-aws-cloud/data/transfer_money.json deleted file mode 100644 index 955b85a5..00000000 --- a/nginx/nap-deployment-aws-cloud/data/transfer_money.json +++ /dev/null @@ -1 +0,0 @@ -{"amount":1,"account":2075894,"currency":"GBP","friend":"Vincent"} diff --git a/nginx/nap-deployment-aws-cloud/lib/.gitkeep b/nginx/nap-deployment-aws-cloud/lib/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/nginx/nap-deployment-aws-cloud/lib/__init__.py b/nginx/nap-deployment-aws-cloud/lib/__init__.py deleted file mode 100644 index 34f3fee7..00000000 --- a/nginx/nap-deployment-aws-cloud/lib/__init__.py +++ /dev/null @@ -1,4 +0,0 @@ -"""Path to our libs.""" - -import sys -sys.path.append('lib') diff --git a/nginx/nap-deployment-aws-cloud/lib/arcadialib.py b/nginx/nap-deployment-aws-cloud/lib/arcadialib.py deleted file mode 100644 index 24c6c0a4..00000000 --- a/nginx/nap-deployment-aws-cloud/lib/arcadialib.py +++ /dev/null @@ -1,93 +0,0 @@ -"""Arcadia app library functions.""" - -import requests -import os -import re - -headers = {'Content-type': 'application/json'} -current_folder_path = os.path.dirname(__file__) -parent_folder_path = os.path.dirname(current_folder_path) -data_folder_path = os.path.join(parent_folder_path, "data/") - - -def check_arcadia(pub_ip, secure=False): - """Check if application is running successfully.""" - if secure: - req = requests.get('https://' + str(pub_ip), verify=False) - else: - req = requests.get('http://' + str(pub_ip)) - if req.status_code != 200: - return "not able to access arcadia server!" - txt = req.text - s = re.search("Welcome to Arcadia Finance website", txt) - if s: - return 'Arcadia application running successfully.' - else: - return "arcadia application inaccessible!" - - -def check_snap(dns, secure=False): - """Check if snap page is accessible.""" - if secure: - req = requests.get('https://' + str(dns), verify=False) - else: - req = requests.get('http://' + str(dns)) - if req.status_code != 200: - return "not able to access snap server!" - txt = req.text - s = re.search("Welcome to serverless NGINX App Protect", txt) - if s: - return 'snap default page running successfully.' - else: - return "snap default page inaccessible." - - -def buy_stocks(pub_ip, json_file, secure=False): - """Buy stock request.""" - json_file_path = data_folder_path + json_file - if secure: - req = requests.post('https://' + str(pub_ip) + "/trading/rest/buy_stocks.php", - data=open(json_file_path, 'rb'), headers=headers, verify=False) - else: - req = requests.post('http://' + str(pub_ip) + "/trading/rest/buy_stocks.php", - data=open(json_file_path, 'rb'), headers=headers) - if req.status_code != 200: - return "Unable to buy stocks in arcadia server!" - return req.text - - -def sell_stocks(pub_ip, json_file, secure=False): - """Sell stock request.""" - json_file_path = data_folder_path + json_file - if secure: - req = requests.post('https://' + str(pub_ip) + "/trading/rest/sell_stocks.php", data=open(json_file_path, 'rb'), - headers=headers, verify=False) - else: - req = requests.post('http://' + str(pub_ip) + "/trading/rest/sell_stocks.php", data=open(json_file_path, 'rb'), - headers=headers) - if req.status_code != 200: - return "Unable to sell stocks in arcadia server!" - return req.text - - -def transfer_money(pub_ip, json_file, secure=False): - """Transfer money request.""" - json_file_path = data_folder_path + json_file - if secure: - req = requests.post('https://' + str(pub_ip) + "/trading/rest/execute_money_transfer.php", - data=open(json_file_path, 'rb'), headers=headers, verify=False) - else: - req = requests.post('http://' + str(pub_ip) + "/trading/rest/execute_money_transfer.php", - data=open(json_file_path, 'rb'), headers=headers) - return req - - -def last_transactions(pub_ip, secure=False): - """Get last transactions details.""" - if secure: - req = requests.get('https://' + str(pub_ip) + "/trading/transactions.php", verify=False) - else: - req = requests.post('http://' + str(pub_ip) + "/trading/transactions.php") - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text diff --git a/nginx/nap-deployment-aws-cloud/lib/attackslib.py b/nginx/nap-deployment-aws-cloud/lib/attackslib.py deleted file mode 100644 index ad53df30..00000000 --- a/nginx/nap-deployment-aws-cloud/lib/attackslib.py +++ /dev/null @@ -1,529 +0,0 @@ -"""Attack library functions.""" - -import requests -import threading -import re - -blind_sql_payload = "AND SELECT SUBSTRING(column_name,1,1) FROM information_schema.columns > 'A'" -nosql_payload = "{$where: function() { return db.getCollectionNames(); }}" -insecure_deserialization_node_payload = "_$$ND_FUNC$$_function (){require('child_process').exec('ls /', " \ - "function(error, stdout, stderr) { console.log(stdout) });}()" -insecure_deserialization_php_payload = "O:6:\" attack \":3:{s:4:\" file \";s:9:\" shell.php \";s:4:\" data " \ - "\";s:19:\" < ? php phpinfo();? > \";}" - - -def cross_script_attack(pub_ip, secure=False): - """Cross scripting attack via params.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + '?', verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + '?') - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_url(pub_ip, secure=False): - """Cross scripting attack via url.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + '/', verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + '/') - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_header(pub_ip, secure=False): - """Cross scripting attack via header.""" - if secure: - req1 = requests.get(url='https://' + str(pub_ip), headers={"Host": ""}, verify=False) - else: - req1 = requests.get(url='http://' + str(pub_ip), headers={"Host": ""}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_mouse_over_param(pub_ip, secure=False): - """Cross scripting attack using mouse over code and using params field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "?onmouseover='var a=1;'", verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "? onmouseover='var a=1;'") - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_mouse_over_url(pub_ip, secure=False): - """Cross scripting attack using mouse over code and using url field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "/onmouseover='var a=1;", verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "/onmouseover='var a=1;") - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_mouse_over_headers(pub_ip, secure=False): - """Cross scripting attack using mouse over code and using headers field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip), headers={"Host": "onmouseover='var a=1;"}, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip), headers={"Host": "onmouseover='var a=1;"}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_eval_param(pub_ip, secure=False): - """Cross scripting attack using eval code and using params field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "?x=eval;x(1)", verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "?x=eval;x(1)") - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_eval_url(pub_ip, secure=False): - """Cross scripting attack using eval code and using url field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "/x=eval;x(1)", verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "/x=eval;x(1)") - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def cross_script_attack_eval_headers(pub_ip, secure=False): - """Cross scripting attack using eval code and using headers field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip), headers={"Host": "x=eval;x(1)"}, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip), headers={"Host": "x=eval;x(1)"}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def sql_injection_attack(pub_ip, secure=False): - """SQL injection attack.""" - values = {'username': "' or 1=1 --", - 'password': ' '} - if secure: - url1 = 'https://' + str(pub_ip) + '/trading/login.php' - req1 = requests.post(url1, data=values, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '/trading/login.php' - req1 = requests.post(url1, data=values) - return req1.text - - -def sql_injection_attack_union_param(pub_ip, secure=False): - """SQL injection attack using union code and using params field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "?9999999 UNION SELECT 1,2", verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "?9999999 UNION SELECT 1,2") - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def sql_injection_attack_union_url(pub_ip, secure=False): - """SQL injection attack using union code and using url field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "/9999999 UNION SELECT 1,2", verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "/9999999 UNION SELECT 1,2") - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def sql_injection_attack_union_headers(pub_ip, secure=False): - """SQL injection attack using union code and using headers field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip), headers={"Host": "9999999 UNION SELECT 1,2"}, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip), headers={"Host": "9999999 UNION SELECT 1,2"}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def sql_injection_attack_blind_param(pub_ip, secure=False): - """SQL injection attack using blind code and using params field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "?" + blind_sql_payload, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "?" + blind_sql_payload) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def sql_injection_attack_blind_url(pub_ip, secure=False): - """SQL injection attack using blind code and using url field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "/"+blind_sql_payload, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "/"+blind_sql_payload) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def sql_injection_attack_blind_headers(pub_ip, secure=False): - """SQL injection attack using blind code and using headers field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip), headers={"Host": blind_sql_payload}, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip), headers={"Host": blind_sql_payload}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def nosql_injection_attack_param(pub_ip, secure=False): - """No SQL injection attack using params field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "?" + nosql_payload, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "?" + nosql_payload) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def nosql_injection_attack_url(pub_ip, secure=False): - """No SQL injection attack using url field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip) + "/" + nosql_payload, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip) + "/" + nosql_payload) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def nosql_injection_attack_headers(pub_ip, secure=False): - """No SQL injection attack using headers field.""" - if secure: - req1 = requests.get('https://' + str(pub_ip), headers={"Host": nosql_payload}, verify=False) - else: - req1 = requests.get('http://' + str(pub_ip), headers={"Host": nosql_payload}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def command_injection_attack(pub_ip, secure=False): - """Command injection attack.""" - if secure: - url1 = 'https://' + str(pub_ip) + '/&ifconfig -a' - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '/&ifconfig -a' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def command_injection_attack_param(pub_ip, secure=False): - """Command injection attack.""" - if secure: - url1 = 'https://' + str(pub_ip) + '?i&fconfig -a' - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '?&ifconfig -a' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def command_injection_attack_header(pub_ip, secure=False): - """Command injection attack.""" - if secure: - url1 = 'https://' + str(pub_ip) - req1 = requests.get(url1, headers={"Host": "ifconfig -a"}, verify=False) - else: - url1 = 'http://' + str(pub_ip) - req1 = requests.get(url1, headers={"Host": "ifconfig -a"}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def command_injection_attack_powershell_url(pub_ip, secure=False): - """Command injection attack using powershell and url param.""" - if secure: - url1 = 'https://' + str(pub_ip) + '/%26%20powershell-WindowStyle%20Hidden%20-encod' - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '/%26%20powershell-WindowStyle%20Hidden%20-encod' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def command_injection_attack_powershell_param(pub_ip, secure=False): - """Command injection attack using powershell and param field.""" - if secure: - url1 = 'https://' + str(pub_ip) + '?%26%20powershell-WindowStyle%20Hidden%20-encod' - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '?%26%20powershell-WindowStyle%20Hidden%20-encod' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def command_injection_attack_powershell_header(pub_ip, secure=False): - """Command injection attack usinf powershell and header field.""" - if secure: - url1 = 'https://' + str(pub_ip) - req1 = requests.get(url1, headers={"Host": "%26%20powershell-WindowStyle%20Hidden%20-encod"}, verify=False) - else: - url1 = 'http://' + str(pub_ip) - req1 = requests.get(url1, headers={"Host": "%26%20powershell-WindowStyle%20Hidden%20-encod"}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def directory_traversal_attack(pub_ip, secure=False): - """Directory traversal attack.""" - if secure: - url1 = 'https://' + str(pub_ip) + '/?file=../../' - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '/?file=../../' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def directory_traversal_attack_header(pub_ip, secure=False): - """Directory traversal attack with header field.""" - if secure: - url1 = 'https://' + str(pub_ip) - req1 = requests.get(url1, headers={"Host": "../../etc/passwd"}, verify=False) - else: - url1 = 'http://' + str(pub_ip) - req1 = requests.get(url1, headers={"Host": "../../etc/passwd"}) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def predictable_attack(pub_ip, secure=False): - """Predictable attack.""" - if secure: - url1 = 'https://' + str(pub_ip) + '/backup' - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + '/backup' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def compliance_attack(pub_ip, secure=False): - """Compliance attack with param field.""" - if secure: - url1 = 'https://' + str(pub_ip) + r"?exploit.php\u0000.jpg" - req1 = requests.get(url1, verify=False) - else: - url1 = 'http://' + str(pub_ip) + r'?exploit.php\u0000.jpg' - req1 = requests.get(url1) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def evasion_attack(pub_ip, secure=False): - """Evasion attack with param field.""" - if secure: - url1 = 'https://' + str(pub_ip) + '?test.aspx::$DATA' - req1 = requests.get(url1, verify=False) - else: - url = 'http://' + str(pub_ip) + '?test.aspx::$DATA' - req1 = requests.get(url) - if req1.status_code != 200: - return "not able to access arcadia server!" - return req1.text - - -def ssrf_attack_aws(pub_ip, secure=False): - """SSRF attack with param field.""" - if secure: - url = 'https://' + str(pub_ip) + '?http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name' - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '?http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name' - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def insecure_deserialization_attack(pub_ip, secure=False): - """Check Insecure Deserialization attack using url.""" - if secure: - url = 'https://' + str(pub_ip) + '?' + insecure_deserialization_node_payload - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '?' + insecure_deserialization_node_payload - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def insecure_deserialization_attack_url(pub_ip, secure=False): - """Check Insecure Deserialization attack using url.""" - if secure: - url = 'https://' + str(pub_ip) + '/' + insecure_deserialization_node_payload - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '/' + insecure_deserialization_node_payload - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def insecure_deserialization_attack_headers(pub_ip, secure=False): - """Check Insecure Deserialization attack using header.""" - if secure: - url = 'https://' + str(pub_ip) - req = requests.get(url, headers={"Host": insecure_deserialization_node_payload}) - else: - url = 'http://' + str(pub_ip) - req = requests.get(url, headers={"Host": insecure_deserialization_node_payload}) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def insecure_deserialization_attack_php_param(pub_ip, secure=False): - """Check Insecure Deserialization attack using param.""" - if secure: - url = 'https://' + str(pub_ip) + '?' + insecure_deserialization_php_payload - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '?' + insecure_deserialization_php_payload - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def insecure_deserialization_attack_php_url(pub_ip, secure=False): - """Check Insecure Deserialization attack using url.""" - if secure: - url = 'https://' + str(pub_ip) + '/' + insecure_deserialization_php_payload - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '/' + insecure_deserialization_php_payload - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def insecure_deserialization_attack_php_header(pub_ip, secure=False): - """Check Insecure Deserialization attack using header.""" - if secure: - url = 'https://' + str(pub_ip) - req = requests.get(url, headers={"Host": insecure_deserialization_php_payload}, verify=False) - else: - url = 'http://' + str(pub_ip) - req = requests.get(url, headers={"Host": insecure_deserialization_php_payload}) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def xml_external_entity(pub_ip, secure=False): - """XML external attack.""" - if secure: - url = 'https://' + str(pub_ip) + '/?file=]>&xxe;' - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '/?file=]>&xxe;' - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def file_inclusion_attack(pub_ip, secure=False): - """File inclusion attack.""" - if secure: - url = 'https://' + str(pub_ip) + '/?file=../../abc.txt' - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '/?file=../../abc.txt' - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def code_injection_attack(pub_ip, secure=False): - """Code injection attack.""" - if secure: - url = "https://" + str(pub_ip) + "/?attack=exec('ls -l');" - req = requests.get(url, verify=False) - else: - url = "http://" + str(pub_ip) + "/?attack=exec('ls -l');" - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def csrf(pub_ip, secure=False): - """CSRF attack.""" - if secure: - url = 'https://' + str(pub_ip) + '?http://' + str(pub_ip) + '/trading/index.php' - req = requests.get(url, verify=False) - else: - url = 'http://' + str(pub_ip) + '?http://' + str(pub_ip) + '/trading/index.php' - req = requests.get(url) - if req.status_code != 200: - return "not able to access arcadia server!" - return req.text - - -def attack(pub_ip, secure=False): - """Attack script.""" - if secure: - req = requests.get('https://'+str(pub_ip), verify=False) - else: - req = requests.get('http://'+str(pub_ip)) - if "support ID" in req.text(): - print("DoS", re.search("support ID is: [0-9]+", req.text).group()) - - -def attack_runner(pub_ip, secure=False): - """DOS attack script.""" - for i in range(5): - assert i < 5 - thread = threading.Thread(target=attack, args=(pub_ip, secure)) - thread.start() diff --git a/nginx/nap-deployment-aws-cloud/lib/awslib.py b/nginx/nap-deployment-aws-cloud/lib/awslib.py deleted file mode 100644 index c5f2211a..00000000 --- a/nginx/nap-deployment-aws-cloud/lib/awslib.py +++ /dev/null @@ -1,288 +0,0 @@ -import boto3,os -import time -from botocore.exceptions import ClientError -import paramiko -from scp import SCPClient -import re - -def create_instance(sg_name, instance_name, image_name, key_pair, max_count, instance_type): - """Lib to create AWS EC2 instance as per provided params.""" - ec = boto3.resource('ec2') - try: - sgid = get_security_group_id(sg_name) - if not sgid: - raise ValueError('Cannot create security group.') - if "*" in image_name: - imageid = get_image_id(image_name[:-1]) - else: - imageid = get_image_id(image_name) - if not imageid: - raise ValueError('Unable to find image ID with this name: ' + image_name) - ret = create_kpair(key_pair) - print(ret) - user_data = '''#!/bin/bash - sudo apt -y update - sudo apt -y install docker.io - sudo apt -y install jq - sudo sysctl -w vm.max_map_count=262144 - sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose - sudo chmod +x /usr/local/bin/docker-compose''' - instances = ec.create_instances( - ImageId=imageid, - MinCount=1, - MaxCount=max_count, - InstanceType=instance_type, - KeyName=key_pair, - SecurityGroupIds=[sgid], - UserData=user_data, - BlockDeviceMappings=[ - { - 'DeviceName': '/dev/sda1', - 'Ebs': { - 'DeleteOnTermination': True, - 'VolumeSize': 20, - 'VolumeType': 'gp2' - } - } - ] - ) - ins_id = instances[0].instance_id - if not ins_id: - raise Exception('Unable to create instance.') - ec.create_tags(Resources=[ins_id], Tags=[ - { - 'Key': 'Name', - 'Value': instance_name, - }, - ]) - instances[0].wait_until_running() - return ins_id - except Exception as e: - raise Exception(e) - - -def get_security_group_id(sg_name): - """Create/Return security group ID by name.""" - ec2 = boto3.client('ec2') - sg_count = 0 - for sg in ec2.describe_security_groups()["SecurityGroups"]: - sg_count += 1 - sg = ec2.describe_security_groups() - for itr_name in range(0, sg_count): - name = sg.get('SecurityGroups', [{}])[itr_name].get('GroupName', '') - if sg_name == name: - sg_id = sg.get('SecurityGroups', [{}])[itr_name].get('GroupId', '') - return sg_id - vpcid = get_default_vpc() - print("Default VPC ID:" + vpcid) - try: - sg = ec2.create_security_group(GroupName=sg_name, Description='sg through automation', VpcId=vpcid) - sg_id = sg['GroupId'] - ec2.authorize_security_group_ingress( - GroupId=sg_id, - IpPermissions=[ - {'IpProtocol': 'tcp', - 'FromPort': 80, - 'ToPort': 80, - 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}, - {'IpProtocol': 'tcp', - 'FromPort': 443, - 'ToPort': 443, - 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}, - {'IpProtocol': 'tcp', - 'FromPort': 22, - 'ToPort': 22, - 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}, - {'IpProtocol': 'tcp', - 'FromPort': 5601, - 'ToPort': 5601, - 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}, - {'IpProtocol': 'tcp', - 'FromPort': 5144, - 'ToPort': 5144, - 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}, - {'IpProtocol': 'tcp', - 'FromPort': 9200, - 'ToPort': 9200, - 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]} - ]) - return sg_id - except ClientError: - raise Exception("Unable to get/update security group.") - - -def get_default_vpc(): - """Get default VPC ID.""" - ec2 = boto3.client('ec2') - vpc_count = 0 - for vpc in ec2.describe_vpcs()["Vpcs"]: - vpc_count += 1 - vpc = ec2.describe_vpcs() - for vpcs in range(0, vpc_count): - check = vpc.get('Vpcs', [{}])[vpcs].get('IsDefault', '') - if check: - vpc_id = vpc.get('Vpcs', [{}])[vpcs].get('VpcId', '') - return vpc_id - - -def get_image_id(image_name): - """Get AMI ID by AMI name.""" - ec2 = boto3.client('ec2') - mkt_place = ec2.describe_images(Owners=['aws-marketplace']) - cnt = 0 - for image in mkt_place['Images']: - if image_name in mkt_place['Images'][cnt]['Name']: - return mkt_place['Images'][cnt]['ImageId'] - cnt += 1 - raise Exception('=======image not found, kindly subscribe NAP image========') - - -def create_kpair(kname): - """Create/Return key pair.""" - ec2 = boto3.client('ec2') - list_keys = ec2.describe_key_pairs() - for i in range(0, len(list_keys['KeyPairs'])): - if list_keys['KeyPairs'][i]['KeyName'] == kname: - print("========== Deleting key and recreating key with name: {}.pem ==============".format(kname)) - del_kpair(kname) - pemfile = open(kname + '.pem', 'w') - key = ec2.create_key_pair(KeyName=kname) - pemfile.write(key['KeyMaterial']) - pemfile.close() - return 'key created with name: ' + kname - - -def terminate_ec2(instance_id): - """Terminate EC2 instance by ID.""" - ec2 = boto3.client('ec2') - ec2.terminate_instances(InstanceIds=list(instance_id)) - time.sleep(10) - return "successfully terminated ec2 instance!" - - -def del_kpair(key_name): - os.environ['AWS_DEFAULT_REGION'] = 'ap-south-1' - """Delete key value pair.""" - ec2 = boto3.client('ec2') - ec2.delete_key_pair(KeyName=key_name) - time.sleep(20) - return "successfully deleted key pair from aws!" - - -def del_sg(sg_name): - """Delete security group by name.""" - ec2 = boto3.client('ec2') - ec2.delete_security_group(GroupName=sg_name) - time.sleep(5) - return "successfully initiated deletion of security group from aws!" - - -def fetch_public_ip(instance_name, instance_id): - """Get public IP by name and ID.""" - ec2 = boto3.client('ec2') - for i in ec2.describe_instances()['Reservations']: - for j in i['Instances']: - if j['InstanceId'] == instance_id: - for k in j['Tags']: - if instance_name == k['Value']: - return j['PublicIpAddress'] - raise Exception('Public IP not found!') - - -def fetch_private_ip(instance_name, instance_id): - """Get private IP by name and ID.""" - ec2 = boto3.client('ec2') - for i in ec2.describe_instances()['Reservations']: - for j in i['Instances']: - if j['InstanceId'] == instance_id: - for k in j['Tags']: - if instance_name == k['Value']: - return j['PrivateIpAddress'] - raise Exception('Private IP not found!') - - -def start_nginx(key_value, instance_name, instance_id, filename="NginxDefaultPolicy.json", pem_file=True): - """Configure and start nginx using key pair and instance name.""" - if pem_file: - key = paramiko.RSAKey.from_private_key_file("./" + key_value + ".pem") - else: - key = paramiko.RSAKey.from_private_key_file("./" + key_value) - client = paramiko.SSHClient() - client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - pub_ip = fetch_public_ip(instance_name, str(instance_id)) - if pub_ip == 'not found!': - raise ValueError('Unable to find public IP for NGINX instance.') - pri_ip = fetch_private_ip(instance_name, str(instance_id)) - if pri_ip == 'not found!': - raise ValueError('Unable to find private IP for NGINX instance.') - try: - client.connect(hostname=pub_ip, username="ubuntu", pkey=key) - client.exec_command('sudo mv /etc/nginx/nginx.conf /etc/nginx/nginx_bkp.conf') - scp = SCPClient(client.get_transport()) - scp.put(r'nginx.conf', '/home/ubuntu') - print("====================== Copying files to instance. ========================") - #modify_file_path="/builds/api-security/apisecurity/scripts/" - #nginx_path="/builds/api-security/apisecurity/data/" - #scp.put(r'modify_nginx_conf.py', '/home/ubuntu') - # depending on file name change script execution - #scp.put(r'nginx.conf', '/home/ubuntu') - #print("================ Updating nginx conf file with script. ===================") - client.exec_command('sudo mv /home/ubuntu/nginx.conf /etc/nginx/nginx.conf') - client.exec_command('sudo systemctl restart nginx') - time.sleep(10) - stdin, stdout, stderr = client.exec_command('sudo systemctl status nginx') - out = stdout.readlines() - print("nginx status:",out) - ''' - if filename == "NginxDefaultPolicy.json": - print("Private IP of instance is : {0} ".format(pri_ip)) - client.exec_command('python3 /home/ubuntu/modify_nginx_conf.py ' + str(pri_ip)) - else: - scp.put(r'nginx-waffler.conf', '/home/ubuntu') - client.exec_command('python3 /home/ubuntu/modify_nginx_conf.py ' + str(filename)) - client.exec_command('sudo cp /home/ubuntu/nginx.conf /etc/nginx') - print("================== Copied updated nginx conf file. =========================") - time.sleep(5) - stdin, stdout, stderr = client.exec_command('sudo nginx -v') - stdin.flush() - err = stderr.readlines() - print("=====================================================================") - print('nginx -v ===>' + str(err[0])) - print("=====================================================================") - - #client.exec_command('sudo su') - print("=================== Stopping NGINX service. ===================================") - client.exec_command('sudo systemctl stop nginx') - time.sleep(10) - print("===================== Starting NGINX service. =================================") - client.exec_command('sudo systemctl start nginx') - time.sleep(20) - stdin, stdout, stderr = client.exec_command('sudo systemctl status nginx') - #time.sleep(10) - #stdin.flush() - #stdout.channel.recv_exit_status() - out = stdout.readlines() - print("nginx status:",out) - itr = 0 - for i in out: - output = re.search("running", str(out[itr])) - if output is not None: - print("================= NGINX is up and running. ===========================") - return 'nginx configured successfully!' - itr += 1 - raise Exception('Unable to start nginx.') - ''' - client.close() - except Exception as e: - raise Exception(e) - - -def find_dns(lb_name): - """Get dns name for lb.""" - elblist = boto3.client('elbv2') - elb = elblist.describe_load_balancers() - for alb in elb['LoadBalancers']: - if alb['LoadBalancerName'] == lb_name: - return alb['DNSName'] - raise Exception("LB not found!") - diff --git a/nginx/nap-deployment-aws-cloud/lib/dockerlib.py b/nginx/nap-deployment-aws-cloud/lib/dockerlib.py deleted file mode 100644 index 91abdfeb..00000000 --- a/nginx/nap-deployment-aws-cloud/lib/dockerlib.py +++ /dev/null @@ -1,191 +0,0 @@ -import paramiko -from scp import SCPClient -import time -import re -import json -import requests -import textwrap -import awslib - -client = paramiko.SSHClient() -client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - - -def deploy_app(pub_ip, key_pair, username="ubuntu", pem_file=True): - """Deploy application for EC2 instance with IP: pub_ip.""" - default_conf_path="/builds/api-security/apisecurity/data/default.conf" - nginx_conf_path="" - if pem_file: - key = paramiko.RSAKey.from_private_key_file("./" + key_pair + ".pem") - else: - key = paramiko.RSAKey.from_private_key_file("./" + key_pair) - client = paramiko.SSHClient() - client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - try: - print("========================= Connecting to instance. =============================") - client.connect(username=username, hostname=pub_ip, pkey=key) - client.exec_command('pwd') - client.exec_command('ls') - scp = SCPClient(client.get_transport()) - ''' - scp.put(r'default.conf', '/home/ubuntu') - - print("=============== Waiting for 5 mins to download all images. ====================") - time.sleep(300) - print("========================= Copying data to instance. ===========================") - #scp.put(r'/root/actions-runner/sdc-runner/apisecurity/apisecurity/tests/nap-deployment-aws-cloud/default.conf', '/home/ubuntu') - scp.put(r'default.conf', '/home/ubuntu') - - print("=============== Running docker commands to install app. =======================") - client.exec_command('sudo docker network create internal') - time.sleep(5) - client.exec_command('sudo docker run -dit -h mainapp --name=mainapp --net=internal ' - 'registry.gitlab.com/arcadia-application/main-app/mainapp:latest') - time.sleep(30) - client.exec_command('sudo docker run -dit -h backend --name=backend --net=internal ' - 'registry.gitlab.com/arcadia-application/back-end/backend:latest') - time.sleep(30) - client.exec_command('sudo docker run -dit -h app2 --name=app2 --net=internal ' - 'registry.gitlab.com/arcadia-application/app2/app2:latest') - time.sleep(30) - client.exec_command('sudo docker run -dit -h app3 --name=app3 --net=internal ' - 'registry.gitlab.com/arcadia-application/app3/app3:latest') - time.sleep(30) - client.exec_command('sudo docker run -dit -h nginx --name=nginx --net=internal -p 8080:80 -v ' - '/home/ubuntu/default.conf:/etc/nginx/conf.d/default.conf ' - 'registry.gitlab.com/arcadia-application/nginx/nginxoss:latest') - time.sleep(50) - stdin, stdout, stderr = client.exec_command('sudo docker ps -a') - stdout.channel.recv_exit_status() - ret = stdout.readlines() - print("====================== Printing docker ps output ===================") - print(ret) - print("======================================================================") - itr = 0 - for i in ret: - if re.search("Exited", str(ret[itr])): - print("========================= Some containers are not up. ===========================") - raise Exception('all containers are not running') - itr += 1 - client.close() - ''' - return 'app deployed successfully' - except Exception as e: - raise Exception(e) - - -def install_docker(key_pair, pub_ip, username="ubuntu"): - "Lib to install and validate docker." - key = paramiko.RSAKey.from_private_key_file("./" + key_pair + ".pem") - client = paramiko.SSHClient() - client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - try: - client.connect(username=username, hostname=pub_ip, pkey=key) - client.exec_command('sudo su') - time.sleep(30) - print("=======executing nginx -v command===========") - stdin, stdout, stderr = client.exec_command('sudo nginx -v') - stdin.flush() - err = stderr.readlines() - print('nginx -v ===>' + str(err[0])) - stdin, stdout, stderr = client.exec_command(r"sudo apt -y install docker.io") - time.sleep(90) - print("=============executed command to install docker ============") - stdin, stdout, stderr = client.exec_command('sudo docker -v') - stdin.flush() - output = stdout.readlines() - print(output) - if not output: - raise Exception('unable to install docker') - return 'docker installed successfully!' - except Exception as e: - raise Exception(e) - - -def install_elk(key_pair, pub_ip, username="ubuntu"): - """Lib to install elk in an instance.""" - key = paramiko.RSAKey.from_private_key_file("./" + key_pair + ".pem") - client = paramiko.SSHClient() - client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - try: - client.connect(username=username, hostname=pub_ip, pkey=key) - client.exec_command('sudo git clone https://github.com/f5devcentral/f5-waf-elk-dashboards.git') - time.sleep(20) - client.exec_command('sudo cd ~') - stdin, stdout, stderr = \ - client.exec_command(r'''sudo docker-compose -f f5-waf-elk-dashboards/docker-compose.yaml up -d''') - print("========================= docker compose stdout print======================") - print(stdout.readlines()) - print("========================= docker compose stderr print======================") - print(stderr.readlines()) - time.sleep(300) - client.connect(username=username, hostname=pub_ip, pkey=key) - stdin, stdout, stderr = client.exec_command('sudo docker ps') - stdin.flush() - output = stdout.readlines() - dashboard_cmd = textwrap.dedent(""" -KIBANA_URL=http://localhost:5601 -jq -s . /home/ubuntu/f5-waf-elk-dashboards/kibana/overview-dashboard.ndjson | jq '{"objects": . }' | \ -curl -k --location --request POST "$KIBANA_URL/api/kibana/dashboards/import" \ - --header 'kbn-xsrf: true' \ - --header 'Content-Type: text/plain' -d @- \ - | jq -""") - stdin, stdout, stderr = client.exec_command(dashboard_cmd) - for cnt in output: - if 'sebp/elk' in cnt: - if "Up" in cnt: - return 'ELK installed successfully!' - else: - raise Exception('Unable to install ELK with docker compose.') - except Exception as e: - raise Exception(e) - - -def validate_elk_logs(pubip, index, log_type, filter, ssl_type="http", port=9200): - """ - Get ELK logs either all or by filters. - pubip: pubip for instance - index: index name - log_type: type of log ex: _doc, _json, etc - filter: we can pass simple value to search in all fields or specific key and value - Ex: filter can be string like "security", "12344", etc - or we can also give like "name:jani" which will filter only for this key and value - ssl_type: can be http or https - port: elastic search port number. Default is 9200 - """ - url = "{0}://{1}:{2}/{3}/{4}/_search?q={5}".format(ssl_type, pubip, port, index, log_type, filter) - output = requests.get(url) - assert output.status_code == 200 - output_logs = json.loads(output.text) - for output_log in output_logs['hits']['hits']: - if ":" in filter: - filter_elements = filter.split(":") - assert output_log["_source"][filter_elements[0]] == filter_elements[1] - else: - assert filter in output_log["_source"].values() - - -def validate_nap_with_json(pub_ip, key_pair, filename, instancename, instanceid, username="ubuntu", pem_file=True): - """This lib will copy json file and try to restart nginx.""" - if pem_file: - key = paramiko.RSAKey.from_private_key_file("./" + key_pair + ".pem") - else: - key = paramiko.RSAKey.from_private_key_file("./" + key_pair) - client = paramiko.SSHClient() - client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - try: - print("========================= Connecting to instance. =============================") - client.connect(username=username, hostname=pub_ip, pkey=key) - print("Disabling SELINX temporarily..") - client.exec_command('sudo setenforce 0') - scp = SCPClient(client.get_transport()) - print("========================= Copying json data to instance. ===========================") - scp.put(r'/builds/api-security/apisecurity/tests/waffler/chrome/'+filename, '/home/ubuntu') - print("================= moving json data to app protect conf location. ===================") - client.exec_command('sudo mv /home/ubuntu/waf-* /etc/app_protect/conf/') - print("=============== Starting nginx with latest waf json file. ==========================") - awslib.start_nginx(key_pair, instancename, instanceid, filename) - print("===================== NGINX service is up with file: {0} ===========================".format(filename)) - except Exception as e: - raise Exception(e) diff --git a/nginx/nap-deployment-aws-cloud/lib/utils.py b/nginx/nap-deployment-aws-cloud/lib/utils.py deleted file mode 100644 index 9cc4cb9e..00000000 --- a/nginx/nap-deployment-aws-cloud/lib/utils.py +++ /dev/null @@ -1,30 +0,0 @@ -import json - - -def replace_conf_file(filepath, data_old, data_replaced): - """Replace content of a file.""" - f = open(filepath, 'r') - filedata = f.read() - f.close() - - newdata = filedata.replace(data_old, data_replaced) - f = open(filepath, 'w') - f.write(newdata) - f.close() - - -def update_json_file(filepath, file_key, new_value): - """Update contents of a json file by key.""" - f = open(filepath, 'r') - - # returns JSON object as a dictionary - data = json.load(f) - - # updating value - data[file_key] = new_value - - # Closing files - f.close() - - with open(filepath, "w") as outfile: - json.dump(data, outfile) diff --git a/nginx/nap-deployment-aws-cloud/terraform/.gitkeep b/nginx/nap-deployment-aws-cloud/terraform/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/nginx/nap-deployment-aws-cloud/terraform/automation-key b/nginx/nap-deployment-aws-cloud/terraform/automation-key deleted file mode 100644 index 8fad3f53..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/automation-key +++ /dev/null @@ -1 +0,0 @@ -Add the automation key here \ No newline at end of file diff --git a/nginx/nap-deployment-aws-cloud/terraform/automation-key.pub b/nginx/nap-deployment-aws-cloud/terraform/automation-key.pub deleted file mode 100644 index 8ed3ee52..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/automation-key.pub +++ /dev/null @@ -1 +0,0 @@ -Add the public key here \ No newline at end of file diff --git a/nginx/nap-deployment-aws-cloud/terraform/default.conf b/nginx/nap-deployment-aws-cloud/terraform/default.conf deleted file mode 100644 index f6622c1e..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/default.conf +++ /dev/null @@ -1,81 +0,0 @@ -upstream mainapp { - - server mainapp; - -} - -upstream backend { - - server backend; - -} - -upstream app2 { - - server app2; - -} - -upstream app3 { - - server app3; - -} - -server { - - listen 80 default_server; - - #charset koi8-r; - - #access_log /var/log/nginx/host.access.log main; - - location / { - - proxy_pass http://mainapp/; - - } - - location /files { - - proxy_pass http://backend/files/; - - } - - location /api { - - proxy_pass http://app2/api/; - - } - - location /app3 { - - proxy_pass http://app3/app3/; - - } - - #error_page 404 /404.html; - - # redirect server error pages to the static page /50x.html - - # - - error_page 500 502 503 504 /50x.html; - - location = /50x.html { - - root /usr/share/nginx/html; - - } - - # proxy the PHP scripts to Apache listening on 127.0.0.1:80 - - # - - #location ~ \.php$ { - - # proxy_pass http://127.0.0.1; - - #} - - } diff --git a/nginx/nap-deployment-aws-cloud/terraform/install_app.py b/nginx/nap-deployment-aws-cloud/terraform/install_app.py deleted file mode 100644 index 7c7d31ce..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/install_app.py +++ /dev/null @@ -1,27 +0,0 @@ -import os -import dockerlib -import awslib - -key_name = os.getenv("TF_VAR_EC2_KEY_NAME") -key_name= "automation-key" -print(key_name) -cwd = os.getcwd() -nap_file_paths = [cwd + "/nap1", cwd + "/nap2"] -ins_ids = [cwd + "/ins1", cwd + "/ins2"] - -# deploy app across both instances -for nap_file_path in nap_file_paths: - file_hand = open(nap_file_path, 'r') - nodeip = file_hand.read() - print("=================================== NAP IP is: {0} ===============================".format(nodeip)) - install_status = dockerlib.deploy_app(nodeip, key_name, pem_file=False) - assert "successfully" in install_status - - -# restart nginx service with updated nginx conf file -for ins in ins_ids: - file_hand = open(ins, 'r') - ins_id = file_hand.read() - print("=================================== Instance ID is: {0} ===============================".format(ins_id)) - ngx_status = awslib.start_nginx(key_name, "apisecurity-automation-nap", ins_id, pem_file=False) - print(ngx_status) diff --git a/nginx/nap-deployment-aws-cloud/terraform/main.tf b/nginx/nap-deployment-aws-cloud/terraform/main.tf deleted file mode 100644 index e2b0e42e..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/main.tf +++ /dev/null @@ -1,329 +0,0 @@ -resource "aws_key_pair" "ubuntu" { - key_name = var.EC2_KEY_NAME - public_key = file("${var.EC2_KEY_NAME}.pub") -} - -resource "aws_vpc" "Main" { # Creating VPC here - cidr_block = var.main_vpc_cidr # Defining the CIDR block to use - instance_tenancy = "default" - enable_dns_hostnames = true - tags = { - Name = "apisecurity-automation-VPC" - } - } - -resource "aws_default_security_group" "automn_default" { - vpc_id = aws_vpc.Main.id - tags = { - Name = "apisecurity-automation-securitygroup" - } - ingress { - description = "SSH" - from_port = 22 - to_port = 22 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - ingress { - description = "HTTPS" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - ingress { - description = "app" - from_port = 8080 - to_port = 8080 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - ingress { - description = "HTTP" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } -} - -#Create Internet Gateway and attach it to VPC -resource "aws_internet_gateway" "IGW" { # Creating Internet Gateway - vpc_id = aws_vpc.Main.id # vpc_id will be generated after we create VPC - tags = { - Name = "apisecurity-automation-IGW" - } -} - -#Create a Public Subnet1 -resource "aws_subnet" "publicsubnet1" { # Creating Public Subnets - vpc_id = aws_vpc.Main.id - cidr_block = var.mgmt_subnet1 # CIDR block of public subnets - map_public_ip_on_launch = true - availability_zone = "ap-south-1a" - tags = { - Name = "apisecurity-automation-SN1" - } -} - -#Create a Public Subnet2 -resource "aws_subnet" "publicsubnet2" { - vpc_id = aws_vpc.Main.id - cidr_block = var.public_subnet2 # CIDR block of subnet2 - map_public_ip_on_launch = true - availability_zone = "ap-south-1a" - tags = { - Name = "apisecurity-automation-SN2" - } -} - -#Create a Public Subnet3 -resource "aws_subnet" "publicsubnet3" { - vpc_id = aws_vpc.Main.id - cidr_block = var.private_subnet3 # CIDR block of subnet3 - map_public_ip_on_launch = true - availability_zone = "ap-south-1b" - tags = { - Name = "apisecurity-automation-SN3" - } -} - -# Route table for Public Subnets -resource "aws_route_table" "PublicRT" { # Creating RT for Public Subnet - vpc_id = aws_vpc.Main.id - route { - cidr_block = "0.0.0.0/0" # Traffic from Public Subnet reaches Internet via Internet Gateway - gateway_id = aws_internet_gateway.IGW.id - } - tags = { - Name = "apisecurity-automation-RT" - } -} - -# Route table Association with Public Subnet's -resource "aws_route_table_association" "PublicRTassociation" { - subnet_id = aws_subnet.publicsubnet1.id - route_table_id = aws_route_table.PublicRT.id -} - -# Route table Association with Subnet 2 -resource "aws_route_table_association" "PublicRTassociation2" { - subnet_id = aws_subnet.publicsubnet2.id - route_table_id = aws_route_table.PublicRT.id -} - -# Route table Association with Subnet 3 -resource "aws_route_table_association" "PublicRTassociation3" { - subnet_id = aws_subnet.publicsubnet3.id - route_table_id = aws_route_table.PublicRT.id -} - -terraform { - required_version = "~> 1.3.3" - required_providers { - template = { - source = "hashicorp/template" - version = ">2.1.2" - } - null = { - source = "hashicorp/null" - version = ">2.1.2" - } - } -} - -data "aws_ami" "nap_ami" { - most_recent = true - owners = ["679593333241"] - - filter { - name = "name" - values = [var.NAP_image_name] - } - - filter { - name = "virtualization-type" - values = ["hvm"] - } -} - -resource "aws_security_group" "sg1" { - vpc_id = aws_vpc.Main.id - tags = { - Name = "apisecurity-automation-securitygroup1" - } - ingress { - description = "app" - from_port = 8080 - to_port = 8080 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - ingress { - description = "SSH" - from_port = 22 - to_port = 22 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "HTTPS" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "HTTP" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } -} - -resource "aws_security_group" "sg2" { - vpc_id = aws_vpc.Main.id - tags = { - Name = "apisecurity-automation-securitygroup2" - } - ingress { - description = "app" - from_port = 8080 - to_port = 8080 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - ingress { - description = "SSH" - from_port = 22 - to_port = 22 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "HTTPS" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - description = "HTTP" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } -} - -resource "aws_instance" "nap" { - key_name = aws_key_pair.ubuntu.key_name - count = 2 - instance_type = "t3.large" - ami = data.aws_ami.nap_ami.id - tags = { - Name = "apisecurity-automation-nap" - role = "application" - } - subnet_id = aws_subnet.publicsubnet1.id - vpc_security_group_ids = [aws_default_security_group.automn_default.id] - user_data = "${file("user_data.sh")}" -} - -# below code is for ALB -resource "aws_lb" "alb" { - name = "automation-alb" - internal = false - load_balancer_type = "application" - security_groups = [aws_default_security_group.automn_default.id] - subnets = [aws_subnet.publicsubnet1.id, aws_subnet.publicsubnet3.id] - enable_cross_zone_load_balancing = "true" - tags = { - Environment = "testing" - Name = "automation-alb" - } -} - -resource "aws_lb_target_group" "tg" { - name = "automation-alb" - target_type = "instance" - port = 80 - protocol = "HTTP" - vpc_id = aws_vpc.Main.id - health_check { - healthy_threshold = var.health_check["healthy_threshold"] - interval = var.health_check["interval"] - unhealthy_threshold = var.health_check["unhealthy_threshold"] - timeout = var.health_check["timeout"] - path = var.health_check["path"] - port = var.health_check["port"] -} -} - -resource "aws_lb_target_group_attachment" "tg_attachment_test" { - target_group_arn = aws_lb_target_group.tg.arn - target_id = aws_instance.nap[0].id - port = 80 -} -resource "aws_lb_target_group_attachment" "tg_attachment_test2" { - target_group_arn = aws_lb_target_group.tg.arn - target_id = aws_instance.nap[1].id - port = 80 -} - -resource "aws_lb_listener" "lb_listener_http" { - load_balancer_arn = aws_lb.alb.arn - port = "80" - protocol = "HTTP" - default_action { - target_group_arn = aws_lb_target_group.tg.arn - type = "forward" - } -} - -# save IP and DNS details in below files -resource "local_file" "nap1" { - content = "${aws_instance.nap[0].public_ip}" - filename = "./nap1" -} -resource "local_file" "nap2" { - content = "${aws_instance.nap[1].public_ip}" - filename = "./nap2" -} -resource "local_file" "alb" { - content = "${aws_lb.alb.dns_name}" - filename = "./alb_dns" -} -resource "local_file" "napid1" { - content = "${aws_instance.nap[0].id}" - filename = "./ins1" -} -resource "local_file" "napid2" { - content = "${aws_instance.nap[1].id}" - filename = "./ins2" -} diff --git a/nginx/nap-deployment-aws-cloud/terraform/modify_nginx_conf.py b/nginx/nap-deployment-aws-cloud/terraform/modify_nginx_conf.py deleted file mode 100644 index 622bed1c..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/modify_nginx_conf.py +++ /dev/null @@ -1,17 +0,0 @@ -import sys - -f = open('nginx.conf', 'r') -filedata = f.read() -f.close() - -if 'waf-' in sys.argv[1]: - f1 = open('nginx-waffler.conf', 'r') - filedata1 = f1.read() - f1.close() - newdata = filedata1.replace("NginxDefaultPolicy.json", sys.argv[1]) -else: - newdata = filedata.replace("proxy_pass http://172.29.38.211:80$request_uri;", - "proxy_pass http://"+sys.argv[1]+":8080$request_uri;") -f = open('nginx.conf', 'w') -f.write(newdata) -f.close() diff --git a/nginx/nap-deployment-aws-cloud/terraform/nginx.conf b/nginx/nap-deployment-aws-cloud/terraform/nginx.conf deleted file mode 100644 index f66c9cca..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/nginx.conf +++ /dev/null @@ -1,52 +0,0 @@ -user nginx; -worker_processes auto; - -load_module modules/ngx_http_app_protect_module.so; - -error_log /var/log/nginx/error.log notice; -pid /var/run/nginx.pid; - - -events { - worker_connections 1024; -} - - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - access_log /var/log/nginx/access.log main; - - sendfile on; - #tcp_nopush on; - - keepalive_timeout 65; - - #gzip on; - upstream backend { - server 3.7.73.42:8080; - } - - - app_protect_enable on; # This is how you enable NGINX App Protect in the relevant context/block - app_protect_policy_file "/etc/app_protect/conf/NginxDefaultPolicy.json"; # This is a reference to the policy file to use. If not defined, the default policy is used - #app_protect_security_log_enable on; # This section enables the logging capability - #app_protect_security_log "/etc/app_protect/conf/log_all.json" /var/log/app_protect/security.log; # This is where the remote logger is defined in terms of: logging options (defined in the referenced file), log server IP, log server port - - server { - listen 80; - server_name localhost; - proxy_http_version 1.1; - - location / { - client_max_body_size 0; - default_type text/html; - proxy_pass http://backend; - } - } -} diff --git a/nginx/nap-deployment-aws-cloud/terraform/outputs.tf b/nginx/nap-deployment-aws-cloud/terraform/outputs.tf deleted file mode 100644 index cfd4a04f..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/outputs.tf +++ /dev/null @@ -1,11 +0,0 @@ -output nap_ip1 { - value = aws_instance.nap[0].public_ip -} - -output nap_ip2 { - value = aws_instance.nap[1].public_ip -} - -output alb_dns { - value = aws_lb.alb.dns_name -} diff --git a/nginx/nap-deployment-aws-cloud/terraform/provider.tf b/nginx/nap-deployment-aws-cloud/terraform/provider.tf deleted file mode 100644 index 37bee01c..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/provider.tf +++ /dev/null @@ -1,4 +0,0 @@ -provider "aws" { - version = "3.57.0" - region = "ap-south-1" - } diff --git a/nginx/nap-deployment-aws-cloud/terraform/s3.tf b/nginx/nap-deployment-aws-cloud/terraform/s3.tf deleted file mode 100644 index f4250b91..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/s3.tf +++ /dev/null @@ -1,7 +0,0 @@ -terraform { - backend "s3" { - region = "ap-south-1" - bucket = "apisecurity-bucket" - key = "automation-nap-deployment-aws.tfstate" - } -} diff --git a/nginx/nap-deployment-aws-cloud/terraform/user_data.sh b/nginx/nap-deployment-aws-cloud/terraform/user_data.sh deleted file mode 100644 index 3ae8ce37..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/user_data.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -sudo rm -rf /var/lib/cloud/* -sudo apt upgrade -y -sudo apt update -y -sudo apt install docker.io -y -sudo docker pull registry.gitlab.com/arcadia-application/main-app/mainapp:latest -sudo docker pull registry.gitlab.com/arcadia-application/back-end/backend:latest -sudo docker pull registry.gitlab.com/arcadia-application/app2/app2:latest -sudo docker pull registry.gitlab.com/arcadia-application/app3/app3:latest -sudo docker pull registry.gitlab.com/arcadia-application/nginx/nginxoss:latest diff --git a/nginx/nap-deployment-aws-cloud/terraform/variables.tf b/nginx/nap-deployment-aws-cloud/terraform/variables.tf deleted file mode 100644 index 4e7131f9..00000000 --- a/nginx/nap-deployment-aws-cloud/terraform/variables.tf +++ /dev/null @@ -1,50 +0,0 @@ -variable "pub_key" { - default = "automation-key.pub" -} -variable "main_vpc_cidr" {} -variable "mgmt_subnet1" {} -variable "public_subnet2" {} -variable "private_subnet3" {} - -variable f5_instance_count { - description = "Number of BIG-IPs to deploy" - type = number - default = 1 -} - -variable ec2_instance_type { - description = "AWS EC2 instance type" - type = string - default = "c4.4xlarge" -} - -variable EC2_KEY_NAME { - description = "AWS EC2 Key name for SSH access" - type = string - default = "automation-key" -} - -variable custom_user_data { - description = "Provide a custom bash script or cloud-init script the BIG-IP will run on creation" - type = string - default = null -} - -variable NAP_image_name { - description = "AMI name for NAP." - type = string - default = "" -} - -# below are for ALB -variable "health_check" { - type = map(string) - default = { - "timeout" = "10" - "interval" = "20" - "path" = "/" - "port" = "80" - "unhealthy_threshold" = "2" - "healthy_threshold" = "3" - } -} diff --git a/nginx/nap-deployment-aws-cloud/test_nap_deployment_aws.py b/nginx/nap-deployment-aws-cloud/test_nap_deployment_aws.py deleted file mode 100644 index 78b64937..00000000 --- a/nginx/nap-deployment-aws-cloud/test_nap_deployment_aws.py +++ /dev/null @@ -1,159 +0,0 @@ -"""Test all types of attacks provided in -https://devcentral.f5.com/s/articles/NGINX-App-Protect-Deployment-in-AWS-Cloud.""" - -import os -import pytest -import attackslib -import arcadialib - - -@pytest.fixture(scope="module") -def get_pubip(): - """Get public IP for ALB component.""" - cwd = os.getcwd() - print("cwd:",cwd) - alb_file_path = cwd + "/terraform/alb_dns" - file_hand = open(alb_file_path, 'r') - pub_dns = file_hand.read() - yield pub_dns - - -def test_application(get_pubip): - """Validate if application is running successfully.""" - pub_ip = get_pubip - print("================================ ALB DNS is: {0} ===========================================".format(pub_ip)) - accessible = False - # try few times and validate if arcadia is running - for x in range(5): - out = arcadialib.check_arcadia(pub_ip, secure=False) - if "successfully" in out: - accessible = True - break - assert accessible - print("================================= Arcadia application is running. ====================================") - - -def test_cross_script_attack(get_pubip): - """Test cross script attack.""" - pub_ip = get_pubip - output = attackslib.cross_script_attack(pub_ip, secure=False) - assert "support ID" in output - print("============================= cross script attack blocked successfully. ============================") - - -def test_cross_script_attack_url(get_pubip): - """Test cross script attack with url.""" - pub_ip = get_pubip - output = attackslib.cross_script_attack_url(pub_ip, secure=False) - assert "support ID" in output - print("============================= cross script attack blocked successfully. ============================") - - -def test_cross_script_attack_mouse_over_url(get_pubip): - """Test cross script attack with url.""" - pub_ip = get_pubip - output = attackslib.cross_script_attack_mouse_over_url(pub_ip, secure=False) - assert "support ID" in output - print("============================= cross script attack blocked successfully. ============================") - - -def test_command_injection_attack(get_pubip): - """Test command injection attack.""" - pub_ip = get_pubip - output = attackslib.command_injection_attack(pub_ip) - assert "support ID" in output - print("================ command injection attack blocked. =================") - - -def test_command_injection_attack_powershell_url(get_pubip): - """Test command injection attack.""" - pub_ip = get_pubip - output = attackslib.command_injection_attack_powershell_url(pub_ip) - assert "support ID" in output - print("========================== command injection attack blocked successfully. ========================") - - -def test_command_injection_attack_powershell_param(get_pubip): - """Test command injection attack.""" - pub_ip = get_pubip - output = attackslib.command_injection_attack_powershell_param(pub_ip) - assert "support ID" in output - print("========================== command injection attack blocked successfully. ========================") - - -def test_directory_traversal_attack(get_pubip): - """Test directory traversal attack.""" - pub_ip = get_pubip - output = attackslib.directory_traversal_attack(pub_ip, secure=False) - assert "support ID" in output - print("========================== directory traversal attack blocked successfully. ========================") - - -def test_file_inclusion_attack(get_pubip): - """Test file inclusion attack.""" - pub_ip = get_pubip - output = attackslib.file_inclusion_attack(pub_ip, secure=False) - assert "support ID" in output - print("====================== file inclusion attack blocked successfully. =============") - - -def test_code_injection_attack(get_pubip): - """Test code injection attack.""" - pub_ip = get_pubip - output = attackslib.code_injection_attack(pub_ip, secure=False) - assert "support ID" in output - print("====================== code injection attack blocked successfully. =============") - - -def test_csrf_attack(get_pubip): - """Test csrf attack.""" - pub_ip = get_pubip - output = attackslib.code_injection_attack(pub_ip, secure=False) - assert "support ID" in output - print("====================== CSRF attack blocked successfully. =============") - - -def test_cross_script_attack_mouse_over_param(get_pubip): - """Test cross script attack with param.""" - pub_ip = get_pubip - output = attackslib.cross_script_attack_mouse_over_param(pub_ip) - assert "support ID" in output - print("=================== Cross script attack blocked successfully. ===========") - - -# send valid traffic -def test_buy_stocks(get_pubip): - """Test buy stocks valid request.""" - pub_ip = get_pubip - success = False - for x in range(5): - req = arcadialib.buy_stocks(pub_ip, "buy_stocks.json", secure=False) - if '"status":"success"' in req: - success = True - break - assert success - print("====================== Buy stocks API validated successfully. =============") - - -def test_transfer_money(get_pubip): - """Test transfer money request.""" - pub_ip = get_pubip - req = arcadialib.transfer_money(pub_ip, "transfer_money.json", secure=False) - assert req.status_code == 200 - print("====================== Transfer money API validated successfully. =============") - - -def test_sell_stocks(get_pubip): - """Test sell stocks valid request.""" - pub_ip = get_pubip - req = arcadialib.sell_stocks(pub_ip, "sell_stocks.json", secure=False) - assert '"status":"success"' in req - print("====================== Sell stocks API validated successfully. =============") - - -def test_last_transactions(get_pubip): - """Test last transactions valid request.""" - pub_ip = get_pubip - req = arcadialib.last_transactions(pub_ip, secure=False) - assert 'Last Transactions' in req - print("====================== Last transactions API validated successfully. =============") diff --git a/nginx/nap-deployment-aws-cloud/var.py b/nginx/nap-deployment-aws-cloud/var.py deleted file mode 100644 index dd1a9d83..00000000 --- a/nginx/nap-deployment-aws-cloud/var.py +++ /dev/null @@ -1,2 +0,0 @@ -TF_VAR_EC2_KEY_NAME = "automation-key" -TF_VAR_F5_PASSWORD = "f5root021" diff --git a/nic/charts/grafana/values.yaml b/nic/charts/grafana/values.yaml deleted file mode 100644 index 1c4d2b31..00000000 --- a/nic/charts/grafana/values.yaml +++ /dev/null @@ -1,50 +0,0 @@ ---- -grafana: - rbac: - pspEnabled: false - testFramework: - enabled: false - persistence: - enabled: true - type: pvc - accessModes: - - ReadWriteOnce - size: 4Gi - finalizers: - - kubernetes.io/pvc-protection - datasources: - datasources.yaml: - apiVersion: 1 - datasources: - - name: Prometheus - type: prometheus - url: http://prometheus-server - dashboardProviders: - dashboardproviders.yaml: - apiVersion: 1 - providers: - - name: "default" - orgId: 1 - folder: "" - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/default - dashboards: - default: - nginx: - url: https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/main/grafana/NGINXPlusICDashboard.json - datasource: Prometheus - service: - type: ClusterIP - port: 8080 - targetPort: 3000 - portName: service - ingress: - enabled: true - annotations: - kubernetes.io/ingress.class: nginx - hosts: - - chart-example.local - path: /grafana diff --git a/nic/charts/nginx-plus-ingress/values.yaml b/nic/charts/nginx-plus-ingress/values.yaml deleted file mode 100644 index 042f7bee..00000000 --- a/nic/charts/nginx-plus-ingress/values.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -controller: - enableSnippets: true - image: - repository: private-registry.nginx.com/nginx-ic-nap-v5/nginx-plus-ingress - tag: 3.6.1 - pullPolicy: Always - nginxplus: true - nginxStatus: - allowCidrs: 0.0.0.0/0 - port: 9000 - readyStatus: - initialDelaySeconds: 30 - serviceAccount: - imagePullSecretName: regcred -prometheus: - create: true diff --git a/nic/charts/prometheus/values.yaml b/nic/charts/prometheus/values.yaml deleted file mode 100644 index 1142f92a..00000000 --- a/nic/charts/prometheus/values.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -prometheus: - pushgateway: - enabled: false \ No newline at end of file diff --git a/nic/data.tf b/nic/data.tf deleted file mode 100644 index 10b2736a..00000000 --- a/nic/data.tf +++ /dev/null @@ -1,18 +0,0 @@ -data "tfe_outputs" "infra" { - organization = var.tf_cloud_organization - workspace = "infra" -} -data "tfe_outputs" "eks" { - organization = var.tf_cloud_organization - workspace = "eks" -} -data "aws_eks_cluster_auth" "auth" { - name = data.tfe_outputs.eks.values.cluster_name -} -data "kubernetes_service_v1" "nginx-service" { - metadata { - name = try(format("%s-%s-controller", helm_release.nginx-plus-ingress.0.name, helm_release.nginx-plus-ingress.0.chart), format("%s-%s", helm_release.nginx-plus-ingresslink.0.name, helm_release.nginx-plus-ingresslink.0.chart)) - namespace = try(helm_release.nginx-plus-ingress[0].namespace, helm_release.nginx-plus-ingresslink[0].namespace) - } -} - diff --git a/nic/grafana.tf b/nic/grafana.tf deleted file mode 100644 index 0d37cb2f..00000000 --- a/nic/grafana.tf +++ /dev/null @@ -1,8 +0,0 @@ -resource "helm_release" "grafana" { - name = format("%s-gfa-%s", local.project_prefix, local.build_suffix) - repository = "https://grafana.github.io/helm-charts" - chart = "grafana" - version = "6.50.7" - namespace = kubernetes_namespace.monitoring.metadata[0].name - values = [templatefile("./charts/grafana/values.yaml", { external_name = "${data.kubernetes_service_v1.nginx-service.status.0.load_balancer.0.ingress.0.hostname}"})] -} \ No newline at end of file diff --git a/nic/namespace.tf b/nic/namespace.tf deleted file mode 100644 index 8bd8637a..00000000 --- a/nic/namespace.tf +++ /dev/null @@ -1,10 +0,0 @@ -resource "kubernetes_namespace" "nginx-ingress" { - metadata { - name = "nginx-ingress" - } -} -resource "kubernetes_namespace" "monitoring" { - metadata { - name = "monitoring" - } -} \ No newline at end of file diff --git a/nic/nic.tf b/nic/nic.tf deleted file mode 100644 index 8e9895c1..00000000 --- a/nic/nic.tf +++ /dev/null @@ -1,12 +0,0 @@ -resource "helm_release" "nginx-plus-ingress" { - count = local.bigip_cis ? 0 : 1 - name = format("%s-nic-%s", local.project_prefix, local.build_suffix) - repository = "https://helm.nginx.com/stable" - chart = "nginx-ingress" - namespace = kubernetes_namespace.nginx-ingress.metadata[0].name - values = [file("./charts/nginx-plus-ingress/values.yaml")] - - depends_on = [ - kubernetes_secret.docker-registry - ] -} diff --git a/nic/outputs.tf b/nic/outputs.tf deleted file mode 100644 index 3391b28c..00000000 --- a/nic/outputs.tf +++ /dev/null @@ -1,13 +0,0 @@ -output "external_name" { - value = try(data.kubernetes_service_v1.nginx-service.status.0.load_balancer.0.ingress.0.hostname, null) -} -output "external_port" { - value = try(data.kubernetes_service_v1.nginx-service.spec.0.port.0.port, null) -} -output "origin_source" { - value = "nic" -} -output "nic_deployment_name" { - value = try (helm_release.nginx-plus-ingress[0].name) - sensitive = true -} diff --git a/nic/prometheus.tf b/nic/prometheus.tf deleted file mode 100644 index 663a84dd..00000000 --- a/nic/prometheus.tf +++ /dev/null @@ -1,8 +0,0 @@ -resource "helm_release" "prometheus" { - name = format("%s-pro-%s", local.project_prefix, local.build_suffix) - repository = "https://prometheus-community.github.io/helm-charts" - chart = "prometheus" - #version = "15.10.2" - namespace = kubernetes_namespace.monitoring.metadata[0].name - values = [file("./charts/prometheus/values.yaml")] -} \ No newline at end of file diff --git a/nic/secrets.tf b/nic/secrets.tf deleted file mode 100644 index dd3eb272..00000000 --- a/nic/secrets.tf +++ /dev/null @@ -1,20 +0,0 @@ -resource "kubernetes_secret" "docker-registry" { - metadata { - name = "regcred" - namespace = kubernetes_namespace.nginx-ingress.metadata[0].name - } - - type = "kubernetes.io/dockerconfigjson" - - data = { - ".dockerconfigjson" = jsonencode({ - auths = { - "${var.nginx_registry}" = { - "username" = var.nginx_jwt - "password" = var.nginx_pwd - "auth" = base64encode("${var.nginx_jwt}:${var.nginx_pwd}") - } - } - }) - } -} \ No newline at end of file diff --git a/nic/terraform.tfvars.examples b/nic/terraform.tfvars.examples deleted file mode 100644 index 706aff17..00000000 --- a/nic/terraform.tfvars.examples +++ /dev/null @@ -1,2 +0,0 @@ -nginx_registry = "private-registry.nginx.com" -nginx_jwt = "nginx_repo.jwt" diff --git a/nic/variables.tf b/nic/variables.tf deleted file mode 100644 index 052b822d..00000000 --- a/nic/variables.tf +++ /dev/null @@ -1,23 +0,0 @@ -#TF Cloud -variable "tf_cloud_organization" { - type = string - description = "TF cloud org (Value set in TF cloud)" -} -#NIGNX -variable nginx_registry { - type = string - description = "NGINX docker regstery" - default = "private-registry.nginx.com" -} -variable nginx_jwt { - type = string - description = "JWT for pulling NGINX image" - default = "nginx_repo.jwt" -} -variable "nginx_pwd" { - default = "none" -} -variable "ssh_key" { - type = string - description = "Unneeded for NAP, only present for warning handling with TF cloud variable set" -} \ No newline at end of file diff --git a/requirements.txt b/requirements.txt deleted file mode 100644 index 2d7b80aa..00000000 --- a/requirements.txt +++ /dev/null @@ -1,27 +0,0 @@ -scp -paramiko -botocore==1.17.28 -boto3 -pylint -pytest -pytest-html -pytest-forked -pytest-repeat -pytest-timeout -pytest-xdist -GitPython -Jinja2 -future>=0.16.0 -prettytable -cryptography -requests -netaddr -flake8 -pyflakes -rpyc -PyYAML -autopep8 -beautifulsoup4 -awscli==1.18.105 -kubectl(v1.23.0) -ansible