Components Changelog

What​

• Added AWS Config and related config-bucket components

Why​

• Added AWS Config and related config-bucket components

References​

What​

• Fix all datadog components

Why​

• Variable region is not supported by the datadog-configuration/modules/datadog_keys submodule

What​

• corrected tag reference for pull lb data resource

Why​

• the tags that are used to pull the ALB that's created should be filtering using the same group_name that is given when the LB is created

References​

• n/a

What​

• Correctly pull Audit account from account-map for cloudtrail
• Remove SessionName from EKS RBAC user name wrongly added in

Why​

• account-map remote state was missing from the cloudtrail component
• Account names should be pulled from account-map, not using a variable
• Session Name automatically logged in user.extra.sessionName.0 starting at Kubernetes 1.20, plus addition had a typo and was only on Teams, not Team Roles

References​

• Resolves change requests https://github.com/cloudposse/terraform-aws-components/pull/638#discussion_r1193297727 and https://github.com/cloudposse/terraform-aws-components/pull/638#discussion_r1193298107
• Closes
• Internal Slack thread

What​

• Bump cloudposse/config/yaml module dependency from version 1.0.1 to 1.0.2

Why​

• 1.0.1 still uses hashicorp/template provider, which has no M1 binary equivalent, 1.0.2 already uses the cloudposse version which has the binary

References​

• (https://github.com/cloudposse/terraform-yaml-config/releases/tag/1.0.2)

What​

• Fixed route53-resolver-dns-firewall for the case when logging is disabled

Why​

• Component still required bucket when logging disabled

References​

What​

• Add aws-shield component

Why​

• The component is responsible for enabling AWS Shield Advanced Protection for the following resources:

  • Application Load Balancers (ALBs)
  • CloudFront Distributions
  • Elastic IPs
  • Route53 Hosted Zones

This component also requires that the account where the component is being provisioned to has been subscribed to AWS Shield Advanced.

What​

• use bool rather than string type for a variable that's designed to hold true/false value

Why​

• using string makes the if .Values.pvc_enabled condition always true and creates persistent volumes even if they're not intended to use

What​

• Remove (broken) root access to EKS clusters
• Include session name in audit trail of users accessing EKS

Why​

• Test code granting access to all root users and roles was accidentally left in and breaks when Tenants are part of account names
• There is no reason to allow root users to access EKS clusters, so even when this code worked it was wrong
• Audit trail can keep track of who is performing actions

References​

• https://aws.github.io/aws-eks-best-practices/security/docs/iam/#use-iam-roles-when-multiple-users-need-identical-access-to-the-cluster

What​

• Updating default example from mssql to postgres

What​

• Modernized vpc-flow-logs with latest conventions

Why​

• Old version of the component was significantly out of date

References​

• DEV-880

What​

Add an option to attach the iam-policy resource to ecs-service

Why​

This policy is already created, but is missing its attachment. We should attach this to the resource when enabled

References​

https://cloudposse.slack.com/archives/CA4TC65HS/p1683729972134479

What​

• ACM allows disabling *.my.domain
• Datadog-Integration supports allow-list'ing regions

What​

• Add route53-resolver-dns-firewall component
• Add network-firewall component

Why​

• The route53-resolver-dns-firewall component is responsible for provisioning Route 53 Resolver DNS Firewall resources, including Route 53 Resolver DNS Firewall, domain lists, firewall rule groups, firewall rules, and logging configuration

• The network-firewall component is responsible for provisioning AWS Network Firewall resources, including Network Firewall, firewall policy, rule groups, and logging configuration

What​

• [ecs-service] Added IAM policies for Ecspresso deployments

What​

• Modernize Elasticsearch component

Why​

• elasticsearch was not deployable as is. Added up-to-date config

References​

• n/a

What​

• Remove the component.yaml in the lambda component

Why​

• Vendoring would potentially cause conflicts

What​

• Update the iam policy for eks/efs-controller

Why​

• Older permissions will not work with new versions of the controller

References​

• official iam policy sample

What​

• Moved eks/efs to efs

Why​

• efs shouldn't be a submodule of eks. You can deploy EFS without EKS

References​

• n/a