Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable readonlyRootFilesystem in our ECS Task config #934

Merged
merged 21 commits into from
Apr 18, 2024
Merged

Enable readonlyRootFilesystem in our ECS Task config #934

merged 21 commits into from
Apr 18, 2024

Conversation

AshCorr
Copy link
Member

@AshCorr AshCorr commented Apr 17, 2024 •
edited by NovemberTang
Loading

What does this change?

  • Enable readonlyRootFilesystem on our ECS Tasks. This resolves 52 FSBP ECS.5 violations by locking down the container filesystem to prevent unexpected writes.
  • Adds ephemeral mounts for Internal Cloudquery data and User config to be written to. Functionally, each of these mounts replaces a directory in the file system that would otherwise be read-only.
  • Creates a custom Dockerfile that already contains the required AWS certificates, and a workflow to release the image, similar to prisma-migrate-image.yml

How has it been verified?

Tested in CODE against AWS and GitHub jobs. Both run without issue

@AshCorr AshCorr requested review from a team as code owners April 17, 2024 11:49
@github-actions GitHub Actions
Copy link

github-actions bot commented Apr 17, 2024 •
edited
Loading

Deploy build 4384 of deploy::service-catalogue to CODE

All deployment options

From guardian/actions-riff-raff.

@AshCorr AshCorr changed the title Nt/ecs read only Enable readonlyRootFilesystem in our ECS Task config Apr 17, 2024
NovemberTang and others added 21 commits April 18, 2024 10:57
@NovemberTang
container cannot write to the root filesystem
e2df381
@NovemberTang
write yaml to non-root folder
02efd52
@NovemberTang
Revert "write yaml to non-root folder"
af3ce31 
This reverts commit 2970c64.
@NovemberTang @AshCorr
Create mount point for writeable directory
ca30825 
Co-authored-by: Ashleigh Carr <[email protected]>
@AshCorr @NovemberTang
Don't install RDS CA
fd18e96 
Co-authored-by: Natasha <[email protected]>
@AshCorr @NovemberTang
Add a volume to container Cloudquery internal data
6b8b8bc 
Co-authored-by: Natasha <[email protected]>
@AshCorr @NovemberTang
Add volume for /tmp folder
914d6f8 
Co-authored-by: Natasha <[email protected]>
@AshCorr @NovemberTang
Publish a new Cloudquery image with Amazon RDS CA
c905ef7 
Co-authored-by: Natasha <[email protected]>
@NovemberTang
trigger first workflow run
8ab5c37
@NovemberTang
only run on changes under particular paths
fd2ca34
@NovemberTang
use new container image
d44939c
@NovemberTang
load cloudquery version from .env
0cb1fef
@NovemberTang
refer to new image
c95a320
@NovemberTang
remove log lines
8de7567
@NovemberTang
move github cresentials to ephemeral storage
5a27510
@AshCorr @NovemberTang
Add a comment to additionalCommands instructing users to write to the…
4013d44 
… `/data` folder

Co-authored-by: Natasha <[email protected]>
@AshCorr @NovemberTang
Don't use external action for setting CQ_CLI env variable
abbb02a
@AshCorr @NovemberTang
Use Standard linux folder for storing config
0218f84
@NovemberTang
update old /data paths
9aea56e
@NovemberTang
remove debug comment
b572c37
@NovemberTang
use commit hashes instead of versions
fed3406
tjsilver
tjsilver approved these changes Apr 18, 2024
View reviewed changes
Copy link
Contributor

@tjsilver tjsilver left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work!

@NovemberTang NovemberTang merged commit 146b73a into main Apr 18, 2024
3 checks passed
@NovemberTang NovemberTang deleted the nt/ecs-read-only branch April 18, 2024 10:13
@NovemberTang NovemberTang mentioned this pull request Apr 29, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tjsilver tjsilver tjsilver approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@AshCorr @tjsilver @NovemberTang