Merge pull request #10 from Guslington/develop

iam, userdata, tag config options and tests

.travis.yml

@@ -1,6 +1,10 @@
 language: ruby
 rvm:
-  - 2.3
+  - 2.5
+install:
+  - gem install cfhighlander cfn-nag
+before_script:
+  - cfndsl -u 3.2.0
 script:
-  - gem install cfhighlander --prerelease
-  - if [ "${TRAVIS_PULL_REQUEST}" != "false" ]; then cfhighlander cfcompile ; else cfhighlander cfcompile --validate; fi
+  - if [ "${TRAVIS_PULL_REQUEST}" != "false" ]; then cfhighlander cftest --no-validate; else cfhighlander cftest; fi
+  - cfn_nag_scan -i out/tests

bastion.cfndsl.rb

@@ -6,6 +6,13 @@
     GroupDescription FnJoin(' ', [ Ref('EnvironmentName'), component_name ])
     VpcId Ref('VPCId')
     SecurityGroupIngress sg_create_rules(securityGroups, ip_blocks) if defined? securityGroups
+    Metadata({
+      cfn_nag: {
+        rules_to_suppress: [
+          { id: 'F1000', reason: 'ignore for now' }
+        ]
+      }
+    })
   end
 
   EIP('BastionIPAddress') do
@@ -21,22 +28,38 @@
     ResourceRecords [ Ref("BastionIPAddress") ]
   end
 
+  policies = []
+  iam_policies.each do |name,policy|
+    policies << iam_policy_allow(name,policy['action'],policy['resource'] || '*')
+  end if defined? iam_policies
+
   Role('Role') do
-    AssumeRolePolicyDocument service_role_assume_policy('ec2')
+    AssumeRolePolicyDocument service_role_assume_policy(iam_services)
     Path '/'
-    Policies(IAMPolicies.new.create_policies([
-      'associate-address',
-      'ec2-describe',
-      'cloudwatch-logs',
-      'ssm'
-    ]))
+    Policies(policies)
+    Metadata({
+      cfn_nag: {
+        rules_to_suppress: [
+          { id: 'F3', reason: 'ignore describe* for now' }
+        ]
+      }
+    })
   end
 
   InstanceProfile('InstanceProfile') do
     Path '/'
     Roles [Ref('Role')]
   end
 
+  bastion_userdata = [
+    "#!/bin/bash\n",
+    "aws --region ", Ref("AWS::Region"), " ec2 associate-address --allocation-id ", FnGetAtt('BastionIPAddress','AllocationId') ," --instance-id $(curl http://169.254.169.254/2014-11-05/meta-data/instance-id -s)\n",
+    "hostname ", Ref('EnvironmentName') ,"-" ,"bastion-`/opt/aws/bin/ec2-metadata --instance-id|/usr/bin/awk '{print $2}'`\n",
+    "sed '/HOSTNAME/d' /etc/sysconfig/network > /tmp/network && mv -f /tmp/network /etc/sysconfig/network && echo \"HOSTNAME=", Ref('EnvironmentName') ,"-" ,"bastion-`/opt/aws/bin/ec2-metadata --instance-id|/usr/bin/awk '{print $2}'`\" >>/etc/sysconfig/network && /etc/init.d/network restart\n",
+  ]
+
+  bastion_userdata.push(*userdata.split("\n")) if defined? userdata
+
   LaunchConfiguration('LaunchConfig') do
     ImageId Ref('Ami')
     InstanceType Ref('InstanceType')
@@ -45,14 +68,17 @@
     KeyName Ref('KeyName')
     SpotPrice FnIf('SpotPriceSet', Ref('SpotPrice'), Ref('AWS::NoValue'))
     SecurityGroups [ Ref('SecurityGroupBastion') ]
-    UserData FnBase64(FnJoin("",[
-      "#!/bin/bash\n",
-      "aws --region ", Ref("AWS::Region"), " ec2 associate-address --allocation-id ", FnGetAtt('BastionIPAddress','AllocationId') ," --instance-id $(curl http://169.254.169.254/2014-11-05/meta-data/instance-id -s)\n",
-      "hostname ", Ref('EnvironmentName') ,"-" ,"bastion-`/opt/aws/bin/ec2-metadata --instance-id|/usr/bin/awk '{print $2}'`\n",
-      "sed '/HOSTNAME/d' /etc/sysconfig/network > /tmp/network && mv -f /tmp/network /etc/sysconfig/network && echo \"HOSTNAME=", Ref('EnvironmentName') ,"-" ,"bastion-`/opt/aws/bin/ec2-metadata --instance-id|/usr/bin/awk '{print $2}'`\" >>/etc/sysconfig/network && /etc/init.d/network restart\n",
-    ]))
+    UserData FnBase64(FnJoin("",bastion_userdata))
   end
 
+  instance_tags = {}
+  instance_tags["Name"] = FnJoin("",[Ref('EnvironmentName'), "-#{instance_name}-xx"])
+  instance_tags["Environment"] = Ref('EnvironmentName')
+  instance_tags["EnvironmentName"] = Ref('EnvironmentName')
+  instance_tags["EnvironmentType"] = Ref('EnvironmentType')
+  instance_tags["Role"] = "bastion"
+  tags.each { |k,v| instance_tags[k] = v } if defined? tags and tags.any?
+
   AutoScalingGroup('AutoScaleGroup') do
     UpdatePolicy('AutoScalingRollingUpdate', {
       "MinInstancesInService" => "0",
@@ -64,10 +90,7 @@
     MinSize Ref('AsgMin')
     MaxSize Ref('AsgMax')
     VPCZoneIdentifier Ref('SubnetIds')
-    addTag("Name", FnJoin("",[Ref('EnvironmentName'), "-#{instance_name}-xx"]), true)
-    addTag("Environment",Ref('EnvironmentName'), true)
-    addTag("EnvironmentType", Ref('EnvironmentType'), true)
-    addTag("Role", "bastion", true)
+    instance_tags.each { |k,v| addTag(k,v,true) }
   end
 
   Output('SecurityGroupBastion', Ref('SecurityGroupBastion'))

bastion.config.yaml

@@ -3,17 +3,21 @@ instance_name: bastion
 
 dns_format: ${EnvironmentName}.${DnsDomain}
 
-# Set `ip_blocks` here or export from vpc component
-# ip_blocks:
-#   local:
-#     - 127.0.0.1/32
-#
-# securityGroups:
-#   -
-#     rules:
-#       -
-#         IpProtocol: tcp
-#         FromPort: 22
-#         ToPort: 22
-#     ips:
-#       - local
+iam_services: ec2
+
+iam_policies:
+  associate-address:
+    action:
+      - ec2:AssociateAddress
+  ec2-describe:
+    action:
+      - ec2:Describe*
+  cloudwatch-logs:
+    action:
+      - logs:CreateLogGroup
+      - logs:CreateLogStream
+      - logs:PutLogEvents
+      - logs:DescribeLogStreams
+      - logs:DescribeLogGroups
+    resource:
+      - arn:aws:logs:*:*:*

tests/default.test.yaml

@@ -0,0 +1,6 @@
+test_metadata:
+  type: config
+  name: default
+  description: with default configuration
+
+# Insert your tests here

tests/iam.test.yaml

@@ -0,0 +1,15 @@
+test_metadata:
+  type: config
+  name: iam
+  description: override iam policies
+
+iam_services:
+  - ec2
+  - ssm
+
+iam_policies:
+  get-bastion-secrets:
+    action:
+      - ssm:GetParameters
+    resource:
+      - Fn::Sub: arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${EnvironmentName}/bastion/*

tests/instance_name.test.yaml

@@ -0,0 +1,6 @@
+test_metadata:
+  type: config
+  name: instance_name
+  description: set the bastion name and dns record
+
+instance_name: someotherbastion

tests/security_groups.test.yaml

@@ -0,0 +1,18 @@
+test_metadata:
+  type: config
+  name: security_groups
+  description: test security group rules
+
+ip_blocks:
+  local:
+    - 127.0.0.1/32
+
+securityGroups:
+  -
+    rules:
+      -
+        IpProtocol: tcp
+        FromPort: 22
+        ToPort: 22
+    ips:
+      - local

tests/tags.test.yaml

@@ -0,0 +1,8 @@
+test_metadata:
+  type: config
+  name: tags
+  description: overide an existing tag and create a new one
+
+tags:
+  Name: overide
+  Project: MyApp

tests/userdata.test.yaml

@@ -0,0 +1,8 @@
+test_metadata:
+  type: config
+  name: userdata
+  description: add extra userdata
+
+userdata: |
+  /usr/bin/bootstrap
+  echo "userdata complete"