Klisk/aws infra cornerstone by kylelisk · Pull Request #1 · kylelisk/IaCExercise

kylelisk · 2025-10-09T02:21:06Z

No description provided.

…stuff because I like it :)

… pipelines.

…sks as well as HTTPS

Traffic now gets routed to the firewall subnets first and if it passes the checks it is then forwarded into the ALB subnets.

…the security scanning

- Added the network firewall logic and wired it all up with the routing - Network firewall logs to cloudwatch logs - Which then leads to the final piece of allowing cloudwatch logging for the network firewall; reused the ecs kms key for that

… specific CIDR ranges. Also cleaned up the README

1. Circular dependencies of security group rules between ALB and ECS 2. Network security group rules have a peculiar issue with AWS and needed a 'settings' variable

…ght quick.

+resource "aws_lb" "main" {
+  #checkov:skip=CKV_AWS_91:Access logs not required for this exercise
+  #checkov:skip=CKV2_AWS_28:WAF not required for this exercise
+  #checkov:skip=CKV_AWS_150:ALB deletion protection disabled for easier cleanup in exercise environment
+  #checkov:skip=CKV_AWS_131:ALB drop invalid HTTP headers not critical for this exercise
+  name               = "${var.project_name}-alb"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = aws_subnet.public[*].id
+
+  enable_deletion_protection = false
+  enable_http2               = true
+
+  tags = {
+    Name = "${var.project_name}-alb"
+  }
+}


+resource "aws_lb" "main" {
+  #checkov:skip=CKV_AWS_91:Access logs not required for this exercise
+  #checkov:skip=CKV2_AWS_28:WAF not required for this exercise
+  #checkov:skip=CKV_AWS_150:ALB deletion protection disabled for easier cleanup in exercise environment
+  #checkov:skip=CKV_AWS_131:ALB drop invalid HTTP headers not critical for this exercise
+  name               = "${var.project_name}-alb"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = aws_subnet.public[*].id
+
+  enable_deletion_protection = false
+  enable_http2               = true
+
+  tags = {
+    Name = "${var.project_name}-alb"
+  }
+}


+resource "aws_lb" "main" {
+  #checkov:skip=CKV_AWS_91:Access logs not required for this exercise
+  #checkov:skip=CKV2_AWS_28:WAF not required for this exercise
+  #checkov:skip=CKV_AWS_150:ALB deletion protection disabled for easier cleanup in exercise environment
+  #checkov:skip=CKV_AWS_131:ALB drop invalid HTTP headers not critical for this exercise
+  name               = "${var.project_name}-alb"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = aws_subnet.public[*].id
+
+  enable_deletion_protection = false
+  enable_http2               = true
+
+  tags = {
+    Name = "${var.project_name}-alb"
+  }
+}


+resource "aws_lb" "main" {
+  #checkov:skip=CKV_AWS_91:Access logs not required for this exercise
+  #checkov:skip=CKV2_AWS_28:WAF not required for this exercise
+  #checkov:skip=CKV_AWS_150:ALB deletion protection disabled for easier cleanup in exercise environment
+  #checkov:skip=CKV_AWS_131:ALB drop invalid HTTP headers not critical for this exercise
+  name               = "${var.project_name}-alb"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = aws_subnet.public[*].id
+
+  enable_deletion_protection = false
+  enable_http2               = true
+
+  tags = {
+    Name = "${var.project_name}-alb"
+  }
+}


+resource "aws_ecr_repository" "app" {
+  #checkov:skip=CKV_AWS_51:Using AES256 encryption instead of KMS for this exercise
+  #checkov:skip=CKV_AWS_136:AES256 encryption is acceptable for this use case
+  name                 = "${var.project_name}-app"
+  image_tag_mutability = "IMMUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  encryption_configuration {
+    encryption_type = "AES256"
+  }
+
+  tags = {
+    Name = "${var.project_name}-ecr"
+  }
+}


+resource "aws_networkfirewall_firewall_policy" "main" {
+  #checkov:skip=CKV_AWS_346:Using default encryption for this exercise, CMK not required
+  name = "${var.project_name}-firewall-policy"
+
+  firewall_policy {
+    stateless_default_actions          = ["aws:forward_to_sfe"]
+    stateless_fragment_default_actions = ["aws:forward_to_sfe"]
+
+    stateful_rule_group_reference {
+      resource_arn = aws_networkfirewall_rule_group.allow_http_https.arn
+      priority     = 1
+    }
+
+    stateful_engine_options {
+      rule_order = "STRICT_ORDER"
+    }
+
+    # Block all traffic that doesn't match the rules
+    stateful_default_actions = ["aws:drop_strict"]
+  }
+
+  tags = {
+    Name = "${var.project_name}-firewall-policy"
+  }
+}


+resource "aws_networkfirewall_firewall" "main" {
+  #checkov:skip=CKV_AWS_345:Using default encryption for this exercise, CMK not required
+  #checkov:skip=CKV_AWS_344:Deletion protection disabled for easier cleanup in exercise environment
+  name                = "${var.project_name}-firewall"
+  firewall_policy_arn = aws_networkfirewall_firewall_policy.main.arn
+  vpc_id              = aws_vpc.main.id
+  delete_protection   = true
+
+  # Deploy firewall endpoints in dedicated firewall subnets
+  dynamic "subnet_mapping" {
+    for_each = aws_subnet.firewall[*].id
+    content {
+      subnet_id = subnet_mapping.value
+    }
+  }
+
+  tags = {
+    Name = "${var.project_name}-network-firewall"
+  }
+}


+resource "aws_networkfirewall_firewall" "main" {
+  #checkov:skip=CKV_AWS_345:Using default encryption for this exercise, CMK not required
+  #checkov:skip=CKV_AWS_344:Deletion protection disabled for easier cleanup in exercise environment
+  name                = "${var.project_name}-firewall"
+  firewall_policy_arn = aws_networkfirewall_firewall_policy.main.arn
+  vpc_id              = aws_vpc.main.id
+  delete_protection   = true
+
+  # Deploy firewall endpoints in dedicated firewall subnets
+  dynamic "subnet_mapping" {
+    for_each = aws_subnet.firewall[*].id
+    content {
+      subnet_id = subnet_mapping.value
+    }
+  }
+
+  tags = {
+    Name = "${var.project_name}-network-firewall"
+  }
+}


+resource "aws_cloudwatch_log_group" "network_firewall" {
+  #checkov:skip=CKV_AWS_338:7-day retention is sufficient for this exercise
+  name              = "/aws/networkfirewall/${var.project_name}"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.cloudwatch_logs.arn
+
+  tags = {
+    Name = "${var.project_name}-firewall-logs"
+  }
+
+  depends_on = [aws_kms_key_policy.cloudwatch_logs]
+}


+resource "aws_vpc" "main" {
+  #checkov:skip=CKV2_AWS_11:VPC flow logging not required for this exercise
+  cidr_block           = var.vpc_cidr
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = {
+    Name = "${var.project_name}-vpc"
+  }
+}


Kyle Lisk added 6 commits October 7, 2025 15:44

Initial VPC and networking commit. Also included some github actions …

dc1a464

…stuff because I like it :)

Initial VPC and networking commit. Also included some github actions …

5993135

…stuff because I like it :)

Added ECS and ECR related stuff as well as updated the github actions…

965efde

… pipelines.

Added an ALB so I can actually get to the webpage in the ECS cluster

f2ab691

Added certificate logic and also least-priviledge role for the ECS ta…

a9ff75a

…sks as well as HTTPS

Fix terraform formatting issues

4465234