Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[High] Fixes for Logging Design Gaps #46

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

[High] Fixes for Logging Design Gaps #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
3f2cd2d
oak9: Recommendation for Moderate severity gap on requirement Logging
Jun 5, 2023
18c4de8
oak9: Recommendation for Moderate severity gap on requirement Logging
Jun 5, 2023
018cd83
oak9: Recommendation for Moderate severity gap on requirement Logging
Jun 5, 2023
9078adb
oak9: Recommendation for High severity gap on requirement Logging
Jun 5, 2023
1dc1bcb
oak9: Recommendation for High severity gap on requirement Logging
Jun 5, 2023
545df19
oak9: Recommendation for High severity gap on requirement Logging
Jun 5, 2023
2318708
oak9: Recommendation for High severity gap on requirement Logging
Jun 5, 2023
7e858dc
oak9: Recommendation for Moderate severity gap on requirement Logging
Jun 5, 2023
643df28
oak9: Recommendation for Moderate severity gap on requirement Logging
Jun 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions terraform.aws/apigateway/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
# ApiGateway
# ---------------------------------------------------------------------
resource "aws_api_gateway_account" "sac_api_gateway_account" {
# oak9: Configure API logs to be sent to AWS Cloudwatch

depends_on = [
aws_iam_role_policy_attachment.sac_api_gateway_policy_attachment,
Expand Down Expand Up @@ -73,6 +74,7 @@ resource "aws_api_gateway_rest_api" "sac_api_gateway_rest_api" {
}

resource "aws_api_gateway_stage" "sac_api_gateway_stage" {
# oak9: Enable Access logs for API stages
deployment_id = aws_api_gateway_deployment.sac_api_gateway_deployment.id
rest_api_id = aws_api_gateway_rest_api.sac_api_gateway_rest_api.id
stage_name = "sac-testing-apigw-stage"
Expand Down
2 changes: 2 additions & 0 deletions terraform.aws/apigtewayv2/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ resource "aws_apigatewayv2_integration" "sac_apigwv2_integration" {
}

resource "aws_apigatewayv2_stage" "sac_apigwv2_stage" {
# oak9: Access logs are not collected for stage sac-testing-apigwv2-stage
api_id = aws_apigatewayv2_api.sac_apigwv2_api.id
name = "sac-testing-apigwv2-stage"
}
Expand All @@ -50,6 +51,7 @@ resource "aws_apigatewayv2_route" "sac_apigwv2_route" {
# Route53
# ---------------------------------------------------------------------
resource "aws_route53_zone" "sac_route_zone" {
# oak9: Log queries in CloudWatch
name = "acorncorp.com"
}

Expand Down
1 change: 1 addition & 0 deletions terraform.aws/cloudfront/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
# CloudFront
# ---------------------------------------------------------------------
resource "aws_cloudfront_distribution" "sac_cloudfront_distribution" {
# oak9: Send Cloud Front logs to an S3 bucket
enabled = true
aliases = ["www.acorncorp.com", "acorncorp.com"]
web_acl_id = aws_wafv2_web_acl.sac_cloudfront_web_acl_.id
Expand Down
1 change: 1 addition & 0 deletions terraform.aws/rds/rds-cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
# RDS
# ---------------------------------------------------------------------
resource "aws_rds_cluster" "sac_rds_cluster" {
# oak9: Logging to Cloudwatch is not enabled
cluster_identifier = "sac-testing-rds-cluster"
database_name = "sacrdsdatabase"
engine = "aurora-mysql"
Expand Down
2 changes: 2 additions & 0 deletions terraform.aws/rds/rds-instance/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
# RDS
# ---------------------------------------------------------------------
resource "aws_db_instance" "sac_db_instance" {
# oak9: Enable Enhanced Monitoring for RDS
# oak9: Logging to Cloudwatch is not enabled
db_name = "sacDatabaseName"
identifier = "sac-testing-db-instance"
allocated_storage = 10
Expand Down