New features (#14)

* add login banner and protocol details * add support for choosing sftp server storage type * switch to latest security policy * add precommit, update readme and workflows * update readme * add checkov skip statement * add support for json logging * remove commented variable * update aws provider version
terrablocks · Aug 19, 2023 · bfc2650 · bfc2650
1 parent 4d19f39
commit bfc2650
Show file tree

Hide file tree

Showing 14 changed files with 296 additions and 85 deletions.
diff --git a/.github/workflows/checkov.yml b/.github/workflows/checkov.yml
@@ -15,7 +15,12 @@ jobs:
           python-version: 3.9
       - name: Scan with Checkov
         id: checkov
-        uses: bridgecrewio/checkov-action@master
+        uses: bridgecrewio/checkov-action@v12
         with:
           directory: .
           framework: terraform
+          quiet: true
+          download_external_modules: false
+          output_format: cli,sarif
+          output_file_path: console,results.sarif
+          skip_path: examples
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -26,16 +26,21 @@ jobs:
           python-version: 3.9
       - name: Scan with Checkov
         id: checkov
-        uses: bridgecrewio/checkov-action@master
+        uses: bridgecrewio/checkov-action@v12
         with:
           directory: .
           framework: terraform
+          quiet: true
+          download_external_modules: false
+          output_format: cli,sarif
+          output_file_path: console,results.sarif
+          skip_path: examples
   release:
     runs-on: ubuntu-latest
     needs: [test, checkov]
     steps:
       - uses: actions/checkout@v3
-      - uses: "marvinpinto/action-automatic-releases@v1.1.2"
+      - uses: "marvinpinto/action-automatic-releases@919008cf3f741b179569b7a6fb4d8860689ab7f0" # v1.2.1
         with:
           repo_token: "${{ secrets.GITHUB_TOKEN }}"
           prerelease: false
diff --git a/.gitignore b/.gitignore
@@ -1,18 +1,20 @@
 # Local .terraform directories
-.terraform*
+**/.terraform/*
 
 # .tfstate files
 *.tfstate
 *.tfstate.*
 
 # Crash log files
 crash.log
+crash.*.log
 
-# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
-# .tfvars files are managed as part of configuration and so should be included in
-# version control.
-#
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
 *.tfvars
+*.tfvars.json
 
 # Ignore override files as they are usually used to override resources locally and so
 # are not checked in
@@ -22,12 +24,14 @@ override.tf.json
 *_override.tf.json
 
 # Include override files you do wish to add to version control using negated pattern
-#
 # !example_override.tf
 
 # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
 # example: *tfplan*
 
-provider.tf
-header.tf
-*.sh
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Lock file
+*.lock.hcl
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,35 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: trailing-whitespace
+  - id: end-of-file-fixer
+  - id: check-yaml
+  - id: check-json
+  - id: check-symlinks
+  - id: detect-private-key
+  - id: no-commit-to-branch
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.1
+  hooks:
+    - id: gitleaks
+- repo: https://github.com/antonbabenko/pre-commit-terraform
+  rev: v1.81.0
+  hooks:
+    - id: terraform_fmt
+    - id: terraform_validate
+      exclude: examples/
+    - id: terraform_tflint
+      exclude: examples/
+      args:
+        - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl --fix
+- repo: https://github.com/bridgecrewio/checkov.git
+  rev: "2.3.314"
+  hooks:
+    - id: checkov
+      args: ["--quiet", "--compact", "--framework", "terraform", "--download-external-modules", "false", "--skip-path", "examples"]
+- repo: https://github.com/terraform-docs/terraform-docs
+  rev: v0.16.0
+  hooks:
+    - id: terraform-docs-go
+      args: ["."]
diff --git a/.terraform-docs.yml b/.terraform-docs.yml
@@ -0,0 +1,63 @@
+formatter: "markdown table" # this is required
+
+header-from: .tf-header.md
+footer-from: .tf-footer.md
+
+recursive:
+  enabled: false
+  path: modules
+
+sections:
+  hide:
+  - resources
+  - data-sources
+  - modules
+  - providers
+
+content: |-
+  {{ .Header }}
+
+  # Usage Instructions
+  ## Example
+  ```hcl
+  {{ include "examples/default.tf" }}
+  ```
+
+  {{ .Requirements }}
+
+  {{ .Inputs }}
+
+  {{ .Outputs }}
+
+  {{ .Footer }}
+
+output:
+  file: README.md
+  mode: inject
+  template: |-
+    <!-- BEGIN_TF_DOCS -->
+    {{ .Content }}
+    <!-- END_TF_DOCS -->
+
+output-values:
+  enabled: false
+  from: ""
+
+sort:
+  enabled: true
+  by: name
+
+settings:
+  anchor: false
+  color: true
+  default: true
+  description: false
+  escape: false
+  hide-empty: false
+  html: false
+  indent: 2
+  lockfile: false # because .terraform.lock.hcl is not checked in the repository
+  read-comments: true
+  required: true
+  sensitive: false
+  type: true
diff --git a/.tf-footer.md b/.tf-footer.md
diff --git a/.tf-header.md b/.tf-header.md
@@ -0,0 +1,14 @@
+# Create a managed public or internal facing SFTP server using AWS Transfer service
+
+![License](https://img.shields.io/github/license/terrablocks/aws-sftp-server?style=for-the-badge) ![Tests](https://img.shields.io/github/actions/workflow/status/terrablocks/aws-sftp-server/tests.yml?branch=main&label=Test&style=for-the-badge) ![Checkov](https://img.shields.io/github/actions/workflow/status/terrablocks/aws-sftp-server/checkov.yml?branch=main&label=Checkov&style=for-the-badge) ![Commit](https://img.shields.io/github/last-commit/terrablocks/aws-sftp-server?style=for-the-badge) ![Release](https://img.shields.io/github/v/release/terrablocks/aws-sftp-server?style=for-the-badge)
+
+This terraform module will deploy the following services:
+- IAM
+  - Role
+  - Role Policy
+- Route53
+  - DNS Record
+- Transfer
+  - Server
+  - User
+  - SSH Key
diff --git a/.tflint.hcl b/.tflint.hcl
@@ -0,0 +1,10 @@
+plugin "aws" {
+  enabled = true
+  version = "0.24.3"
+  source  = "github.com/terraform-linters/tflint-ruleset-aws"
+}
+
+plugin "terraform" {
+  enabled = true
+  preset  = "all"
+}
diff --git a/README.md b/README.md
@@ -1,3 +1,4 @@
+<!-- BEGIN_TF_DOCS -->
 # Create a managed public or internal facing SFTP server using AWS Transfer service
 
 ![License](https://img.shields.io/github/license/terrablocks/aws-sftp-server?style=for-the-badge) ![Tests](https://img.shields.io/github/actions/workflow/status/terrablocks/aws-sftp-server/tests.yml?branch=main&label=Test&style=for-the-badge) ![Checkov](https://img.shields.io/github/actions/workflow/status/terrablocks/aws-sftp-server/checkov.yml?branch=main&label=Checkov&style=for-the-badge) ![Commit](https://img.shields.io/github/last-commit/terrablocks/aws-sftp-server?style=for-the-badge) ![Release](https://img.shields.io/github/v/release/terrablocks/aws-sftp-server?style=for-the-badge)
@@ -15,9 +16,9 @@ This terraform module will deploy the following services:
 
 # Usage Instructions
 ## Example
-```terraform
+```hcl
 module "sftp" {
-  source = "github.com/terrablocks/aws-sftp-server.git"
+  source = "github.com/terrablocks/aws-sftp-server.git" # Always use `ref` to point module to a specific version or hash
 }
 ```
 
@@ -26,40 +27,51 @@ module "sftp" {
 | Name | Version |
 |------|---------|
 | terraform | >= 1.3.0 |
-| aws | >= 4.0.0 |
+| aws | >= 5.10.0 |
 | random | >= 3.1.0 |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| name | Name of SFTP server. Ignore it to generate a random name for server | `string` | `null` | no |
-| sftp_type | Type of SFTP server. **Valid values:** `PUBLIC`, `VPC` or `VPC_ENDPOINT` | `string` | `"PUBLIC"` | no |
-| protocols | List of file transfer protocol(s) over which your FTP client can connect to your server endpoint. **Possible Values:** FTP, FTPS and SFTP | `list(string)` | <pre>[<br>  "SFTP"<br>]</pre> | no |
-| certificate_arn | ARN of ACM certificate. Required only in case of FTPS protocol | `string` | `null` | no |
-| endpoint_details | A block required to setup SFTP server if type is set to `VPC` or `VPC_ENDPOINT`<pre>{<br>  vpc_id                 = (Optional) ID of VPC in which SFTP server endpoint will be hosted. Required if endpoint type is set to VPC<br>  vpc_endpoint_id        = (Optional) The ID of VPC endpoint to use for hosting internal SFTP server. Required if endpoint type is set to VPC_ENDPOINT<br>  subnet_ids             = (Optional) List of subnets ids within the VPC for hosting SFTP server endpoint. Required if endpoint type is set to VPC<br>  security_group_ids     = (Optional) List of security groups to attach to the SFTP endpoint. Supported only if endpoint is to type VPC. If left blank for VPC, a security group with port 22 open to the world will be created and attached<br>  address_allocation_ids = (Optional) List of address allocation IDs to attach an Elastic IP address to your SFTP server endpoint. Supported only if endpoint type is set to VPC. If left blank for VPC, an EIP will be automatically created per subnet and attached<br>}</pre> | <pre>object({<br>    vpc_id                 = optional(string)<br>    vpc_endpoint_id        = optional(string)<br>    subnet_ids             = optional(list(string))<br>    security_group_ids     = optional(list(string))<br>    address_allocation_ids = optional(list(string))<br>  })</pre> | `{}` | no |
-| identity_provider_type | Mode of authentication to use for accessing the service. **Valid Values:** `SERVICE_MANAGED`, `API_GATEWAY`, `AWS_DIRECTORY_SERVICE` or `AWS_LAMBDA` | `string` | `"SERVICE_MANAGED"` | no |
 | api_gw_url | URL of the service endpoint to authenticate users when `identity_provider_type` is of type `API_GATEWAY` | `string` | `null` | no |
-| invocation_role | ARN of the IAM role to authenticate the user when `identity_provider_type` is set to `API_GATEWAY` | `string` | `null` | no |
+| as2_transports | Transport method to use for AS2 messages. **Valid values:** `HTTP` | `set(string)` | `null` | no |
+| certificate_arn | ARN of ACM certificate. Required only in case of FTPS protocol | `string` | `null` | no |
+| cloudwatch_log_group_arns | Set of ARN of the CloudWatch log group to which SFTP server will write JSON logs. Required if `enable_json_logging` is set to `true` | `set(string)` | `[]` | no |
 | directory_id | ID of the directory service to authenticate users when `identity_provider_type` is of type `AWS_DIRECTORY_SERVICE` | `string` | `null` | no |
-| function_arn | ARN of the lambda function to authenticate users when `identity_provider_type` is of type `AWS_LAMBDA` | `string` | `null` | no |
-| logging_role | ARN of an IAM role to allow to write SFTP users activity to Amazon CloudWatch logs | `string` | `null` | no |
+| endpoint_details | A block required to setup SFTP server if type is set to `VPC` or `VPC_ENDPOINT` ```{ vpc_id = (Optional) ID of VPC in which SFTP server endpoint will be hosted. Required if endpoint type is set to VPC vpc_endpoint_id = (Optional) The ID of VPC endpoint to use for hosting internal SFTP server. Required if endpoint type is set to VPC_ENDPOINT subnet_ids = (Optional) List of subnets ids within the VPC for hosting SFTP server endpoint. Required if endpoint type is set to VPC security_group_ids = (Optional) List of security groups to attach to the SFTP endpoint. Supported only if endpoint is to type VPC. If left blank for VPC, a security group with port 22 open to the world will be created and attached address_allocation_ids = (Optional) List of address allocation IDs to attach an Elastic IP address to your SFTP server endpoint. Supported only if endpoint type is set to VPC. If left blank for VPC, an EIP will be automatically created per subnet and attached }``` | ```object({ vpc_id = optional(string) vpc_endpoint_id = optional(string) subnet_ids = optional(list(string)) security_group_ids = optional(list(string)) address_allocation_ids = optional(list(string)) })``` | `{}` | no |
 | force_destroy | Whether to delete all the users associated with server so that server can be deleted successfully. **Note:** Supported only if `identity_provider_type` is set to `SERVICE_MANAGED` | `bool` | `true` | no |
-| security_policy_name | Specifies the name of the [security policy](https://docs.aws.amazon.com/transfer/latest/userguide/security-policies.html) to associate with the server | `string` | `"TransferSecurityPolicy-2020-06"` | no |
+| function_arn | ARN of the lambda function to authenticate users when `identity_provider_type` is of type `AWS_LAMBDA` | `string` | `null` | no |
 | host_key | RSA private key that will be used to identify your server when clients connect to it over SFTP | `string` | `null` | no |
 | hosted_zone | Hosted zone name to create DNS entry for SFTP server | `string` | `null` | no |
+| identity_provider_type | Mode of authentication to use for accessing the service. **Valid Values:** `SERVICE_MANAGED`, `API_GATEWAY`, `AWS_DIRECTORY_SERVICE` or `AWS_LAMBDA` | `string` | `"SERVICE_MANAGED"` | no |
+| invocation_role | ARN of the IAM role to authenticate the user when `identity_provider_type` is set to `API_GATEWAY` | `string` | `null` | no |
+| logging_role | ARN of an IAM role to allow to write SFTP users activity to Amazon CloudWatch logs | `string` | `null` | no |
+| name | Name of SFTP server. Ignore it to generate a random name for server | `string` | `null` | no |
+| passive_ip | Use passive IP (PASV) capability to attach the IP address of the firewall or the load balancer to your FTPS/FTP server | `string` | `null` | no |
+| post_authentication_login_banner | Message to display to user when trying to connect to the server **after** authentication | `string` | `null` | no |
+| pre_authentication_login_banner | Message to display to user when trying to connect to the server **before** authentication | `string` | `null` | no |
+| protocols | List of file transfer protocol(s) over which your FTP client can connect to your server endpoint. **Possible Values:** FTP, FTPS and SFTP | `list(string)` | ```[ "SFTP" ]``` | no |
+| security_policy_name | Specifies the name of the [security policy](https://docs.aws.amazon.com/transfer/latest/userguide/security-policies.html) to associate with the server | `string` | `"TransferSecurityPolicy-2023-05"` | no |
+| set_stat_option | Whether the server should ignore SETSTAT command. **Valid values:** `DEFAULT`, `ENABLE_NO_OP` | `string` | `null` | no |
 | sftp_sub_domain | DNS name for SFTP server. **NOTE: Only sub-domain name required. DO NOT provide entire URL** | `string` | `"sftp"` | no |
-| sftp_users | Map of users with key as username and value as their home directory. Home directory is the S3 bucket path which user should have access to<pre>{<br>  user = home_dir_path<br>}</pre> | `map(string)` | `{}` | no |
-| sftp_users_ssh_key | Map of users with key as username and value as their public SSH key<pre>{<br>  user = ssh_public_key_content<br>}</pre> | `map(string)` | `{}` | no |
+| sftp_type | Type of SFTP server. **Valid values:** `PUBLIC`, `VPC` or `VPC_ENDPOINT` | `string` | `"PUBLIC"` | no |
+| sftp_users | Map of users with key as username and value as their home directory. Home directory is the S3 bucket path which user should have access to ```{ user = home_dir_path }``` | `map(string)` | `{}` | no |
+| sftp_users_ssh_key | Map of users with key as username and value as their public SSH key ```{ user = ssh_public_key_content }``` | `map(string)` | `{}` | no |
+| storage_type | Where to store the files. **Valid values:** `S3` or `EFS` | `string` | `"S3"` | no |
 | tags | A map of key value pair to assign to resources | `map(string)` | `{}` | no |
+| tls_session_resumption_mode | TLS session resumption mode provides a mechanism to resume recently negotiated encrypted TLS sessions between the client and the FTPS server. Using one of the TLS session resumption modes, you can customize how you want to your FTPS server to process TLS session resumption requests | `string` | `null` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
 | arn | ARN of transfer server |
-| id | ID of transfer server |
-| endpoint | Endpoint of transfer server |
 | domain_name | Custom DNS name mapped in Route53 for transfer server |
-| sftp_sg_id | ID of security group created for SFTP server. Available only if SFTP type is VPC and security group is not provided by you |
+| endpoint | Endpoint of transfer server |
+| id | ID of transfer server |
 | sftp_eip | Elastic IP attached to the SFTP server. Available only if SFTP type is VPC and allocation id is not provided by you |
+| sftp_sg_id | ID of security group created for SFTP server. Available only if SFTP type is VPC and security group is not provided by you |
+
+
+<!-- END_TF_DOCS -->
diff --git a/examples/default.tf b/examples/default.tf
@@ -0,0 +1,3 @@
+module "sftp" {
+  source = "github.com/terrablocks/aws-sftp-server.git" # Always use `ref` to point module to a specific version or hash
+}