-
-
Notifications
You must be signed in to change notification settings - Fork 211
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
11 changed files
with
538 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| # Component: `zscaler` | ||
|
|
||
| This component is responsible for provisioning ZScaler Private Access Connector instances on Amazon Linux 2 AMIs. | ||
|
|
||
| Prior to provisioning this component, it is required that a SecureString SSM Parameter containing the ZScaler App Connector Provisioning Key is populated in each account corresponding to the regional stack the component is deployed to, with the name of the SSM Parameter matching the value of `var.zscaler_key`. | ||
|
|
||
| This parameter should be populated using `chamber`, which is included in the geodesic image: | ||
|
|
||
| ``` | ||
| chamber write zscaler key <value> | ||
| ``` | ||
|
|
||
| Where <value> is the ZScaler App Connector Provisioning Key. For more information on how to generate this key, see: [ZScaler documentation on Configuring App Connectors](https://help.zscaler.com/zpa/configuring-connectors). | ||
|
|
||
| ## Usage | ||
|
|
||
| **Stack Level**: Regional | ||
|
|
||
| The typical stack configuration for this component is as follows: | ||
|
|
||
| ```yaml | ||
| components: | ||
| terraform: | ||
| zscaler: | ||
| vars: | ||
| zscaler_count: 2 | ||
| ``` | ||
| Preferably, regional stack configurations can be kept _DRY_ by importing `catalog/zscaler` via the `imports` list at the top of the configuration. | ||
|
|
||
| ``` | ||
| import: | ||
| ... | ||
| - catalog/zscaler | ||
| ``` | ||
| <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
| ## Requirements | ||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 | | ||
| | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.0 | | ||
| | <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 | | ||
| | <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.0 | | ||
| | <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.2 | | ||
| | <a name="requirement_utils"></a> [utils](#requirement\_utils) | >= 0.4.3 | | ||
| ## Providers | ||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0 | | ||
| | <a name="provider_template"></a> [template](#provider\_template) | >= 2.2 | | ||
| ## Modules | ||
| | Name | Source | Version | | ||
| |------|--------|---------| | ||
| | <a name="module_ec2_zscaler"></a> [ec2\_zscaler](#module\_ec2\_zscaler) | cloudposse/ec2-instance/aws | 0.32.2 | | ||
| | <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a | | ||
| | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.24.1 | | ||
| ## Resources | ||
| | Name | Type | | ||
| |------|------| | ||
| | [aws_iam_role_policy_attachment.ssm_core](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | ||
| | [aws_ami.amazon_linux_2](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source | | ||
| | [aws_ssm_parameter.zscaler_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source | | ||
| | [template_file.userdata](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source | | ||
| ## Inputs | ||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. | `map(string)` | `{}` | no | | ||
| | <a name="input_ami_owner"></a> [ami\_owner](#input\_ami\_owner) | The owner of the AMI used for the ZScaler EC2 instances. | `string` | `"amazon"` | no | | ||
| | <a name="input_ami_regex"></a> [ami\_regex](#input\_ami\_regex) | The regex used to match the latest AMI to be used for the ZScaler EC2 instances. | `string` | `"^amzn2-ami-hvm.*"` | no | | ||
| | <a name="input_attributes"></a> [attributes](#input\_attributes) | Additional attributes (e.g. `1`) | `list(string)` | `[]` | no | | ||
| | <a name="input_aws_ssm_enabled"></a> [aws\_ssm\_enabled](#input\_aws\_ssm\_enabled) | Set true to install the AWS SSM agent on each EC2 instances. | `bool` | `true` | no | | ||
| | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no | | ||
| | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | | ||
| | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | | ||
| | <a name="input_environment"></a> [environment](#input\_environment) | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | | ||
| | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no | | ||
| | <a name="input_import_role_arn"></a> [import\_role\_arn](#input\_import\_role\_arn) | IAM Role ARN to use when importing a resource | `string` | `null` | no | | ||
| | <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | The instance family to use for the ZScaler EC2 instances. | `string` | `"r5n.medium"` | no | | ||
| | <a name="input_label_key_case"></a> [label\_key\_case](#input\_label\_key\_case) | The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. | `string` | `null` | no | | ||
| | <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no | | ||
| | <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | The letter case of output label values (also used in `tags` and `id`).<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Default value: `lower`. | `string` | `null` | no | | ||
| | <a name="input_name"></a> [name](#input\_name) | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no | | ||
| | <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no | | ||
| | <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | | ||
| | <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes | | ||
| | <a name="input_secrets_store_type"></a> [secrets\_store\_type](#input\_secrets\_store\_type) | Secret store type for Zscaler provisioning keys. Valid values: `SSM`, `ASM` (but `ASM` not currently supported) | `string` | `"SSM"` | no | | ||
| | <a name="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules) | A list of maps of Security Group rules.<br>The values of map is fully complated with `aws_security_group_rule` resource.<br>To get more info see [security\_group\_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule). | `list(any)` | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "from_port": 0,<br> "protocol": "-1",<br> "to_port": 65535,<br> "type": "egress"<br> }<br>]</pre> | no | | ||
| | <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | ||
| | <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no | | ||
| | <a name="input_zscaler_count"></a> [zscaler\_count](#input\_zscaler\_count) | The number of Zscaler instances. | `number` | `1` | no | | ||
| | <a name="input_zscaler_key"></a> [zscaler\_key](#input\_zscaler\_key) | SSM key (without leading `/`) for the Zscaler provisioning key secret. | `string` | `"zscaler/key"` | no | | ||
| ## Outputs | ||
| | Name | Description | | ||
| |------|-------------| | ||
| | <a name="output_instance_id"></a> [instance\_id](#output\_instance\_id) | Instance ID | | ||
| | <a name="output_private_ip"></a> [private\_ip](#output\_private\_ip) | Private IP of the instance | | ||
| <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
| ## References | ||
| * [cloudposse/terraform-aws-components](https://github.com/cloudposse/terraform-aws-components/tree/master/modules/zscaler) - Cloud Posse's upstream component | ||
| [<img src="https://cloudposse.com/logo-300x69.svg" height="32" align="right"/>](https://cpco.io/component) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,202 @@ | ||
| # | ||
| # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label | ||
| # All other instances of this file should be a copy of that one | ||
| # | ||
| # | ||
| # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf | ||
| # and then place it in your Terraform module to automatically get | ||
| # Cloud Posse's standard configuration inputs suitable for passing | ||
| # to Cloud Posse modules. | ||
| # | ||
| # Modules should access the whole context as `module.this.context` | ||
| # to get the input variables with nulls for defaults, | ||
| # for example `context = module.this.context`, | ||
| # and access individual variables as `module.this.<var>`, | ||
| # with final values filled in. | ||
| # | ||
| # For example, when using defaults, `module.this.context.delimiter` | ||
| # will be null, and `module.this.delimiter` will be `-` (hyphen). | ||
| # | ||
|
|
||
| module "this" { | ||
| source = "cloudposse/label/null" | ||
| version = "0.24.1" # requires Terraform >= 0.13.0 | ||
|
|
||
| enabled = var.enabled | ||
| namespace = var.namespace | ||
| environment = var.environment | ||
| stage = var.stage | ||
| name = var.name | ||
| delimiter = var.delimiter | ||
| attributes = var.attributes | ||
| tags = var.tags | ||
| additional_tag_map = var.additional_tag_map | ||
| label_order = var.label_order | ||
| regex_replace_chars = var.regex_replace_chars | ||
| id_length_limit = var.id_length_limit | ||
| label_key_case = var.label_key_case | ||
| label_value_case = var.label_value_case | ||
|
|
||
| context = var.context | ||
| } | ||
|
|
||
| # Copy contents of cloudposse/terraform-null-label/variables.tf here | ||
|
|
||
| variable "context" { | ||
| type = any | ||
| default = { | ||
| enabled = true | ||
| namespace = null | ||
| environment = null | ||
| stage = null | ||
| name = null | ||
| delimiter = null | ||
| attributes = [] | ||
| tags = {} | ||
| additional_tag_map = {} | ||
| regex_replace_chars = null | ||
| label_order = [] | ||
| id_length_limit = null | ||
| label_key_case = null | ||
| label_value_case = null | ||
| } | ||
| description = <<-EOT | ||
| Single object for setting entire context at once. | ||
| See description of individual variables for details. | ||
| Leave string and numeric variables as `null` to use default value. | ||
| Individual variable settings (non-null) override settings in context object, | ||
| except for attributes, tags, and additional_tag_map, which are merged. | ||
| EOT | ||
|
|
||
| validation { | ||
| condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) | ||
| error_message = "Allowed values: `lower`, `title`, `upper`." | ||
| } | ||
|
|
||
| validation { | ||
| condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) | ||
| error_message = "Allowed values: `lower`, `title`, `upper`, `none`." | ||
| } | ||
| } | ||
|
|
||
| variable "enabled" { | ||
| type = bool | ||
| default = null | ||
| description = "Set to false to prevent the module from creating any resources" | ||
| } | ||
|
|
||
| variable "namespace" { | ||
| type = string | ||
| default = null | ||
| description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'" | ||
| } | ||
|
|
||
| variable "environment" { | ||
| type = string | ||
| default = null | ||
| description = "Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'" | ||
| } | ||
|
|
||
| variable "stage" { | ||
| type = string | ||
| default = null | ||
| description = "Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'" | ||
| } | ||
|
|
||
| variable "name" { | ||
| type = string | ||
| default = null | ||
| description = "Solution name, e.g. 'app' or 'jenkins'" | ||
| } | ||
|
|
||
| variable "delimiter" { | ||
| type = string | ||
| default = null | ||
| description = <<-EOT | ||
| Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`. | ||
| Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | ||
| EOT | ||
| } | ||
|
|
||
| variable "attributes" { | ||
| type = list(string) | ||
| default = [] | ||
| description = "Additional attributes (e.g. `1`)" | ||
| } | ||
|
|
||
| variable "tags" { | ||
| type = map(string) | ||
| default = {} | ||
| description = "Additional tags (e.g. `map('BusinessUnit','XYZ')`" | ||
| } | ||
|
|
||
| variable "additional_tag_map" { | ||
| type = map(string) | ||
| default = {} | ||
| description = "Additional tags for appending to tags_as_list_of_maps. Not added to `tags`." | ||
| } | ||
|
|
||
| variable "label_order" { | ||
| type = list(string) | ||
| default = null | ||
| description = <<-EOT | ||
| The naming order of the id output and Name tag. | ||
| Defaults to ["namespace", "environment", "stage", "name", "attributes"]. | ||
| You can omit any of the 5 elements, but at least one must be present. | ||
| EOT | ||
| } | ||
|
|
||
| variable "regex_replace_chars" { | ||
| type = string | ||
| default = null | ||
| description = <<-EOT | ||
| Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`. | ||
| If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | ||
| EOT | ||
| } | ||
|
|
||
| variable "id_length_limit" { | ||
| type = number | ||
| default = null | ||
| description = <<-EOT | ||
| Limit `id` to this many characters (minimum 6). | ||
| Set to `0` for unlimited length. | ||
| Set to `null` for default, which is `0`. | ||
| Does not affect `id_full`. | ||
| EOT | ||
| validation { | ||
| condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 | ||
| error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." | ||
| } | ||
| } | ||
|
|
||
| variable "label_key_case" { | ||
| type = string | ||
| default = null | ||
| description = <<-EOT | ||
| The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`. | ||
| Possible values: `lower`, `title`, `upper`. | ||
| Default value: `title`. | ||
| EOT | ||
|
|
||
| validation { | ||
| condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) | ||
| error_message = "Allowed values: `lower`, `title`, `upper`." | ||
| } | ||
| } | ||
|
|
||
| variable "label_value_case" { | ||
| type = string | ||
| default = null | ||
| description = <<-EOT | ||
| The letter case of output label values (also used in `tags` and `id`). | ||
| Possible values: `lower`, `title`, `upper` and `none` (no transformation). | ||
| Default value: `lower`. | ||
| EOT | ||
|
|
||
| validation { | ||
| condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) | ||
| error_message = "Allowed values: `lower`, `title`, `upper`, `none`." | ||
| } | ||
| } | ||
| #### End of copy of cloudposse/terraform-null-label/variables.tf |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| enabled = false | ||
|
|
||
| name = "zscaler" | ||
|
|
||
| # Cheapest instance that satisfies DenyInstancesWithoutEncryptionInTransit SCP (see: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit) | ||
| instance_type = "m5n.large" |
Oops, something went wrong.