Add Key Vault network ACLs and NSG management to Azure modules#4
Merged
Merged
Conversation
The marketplace-id-consistency gate was grepping every publisher = "..." in a module file and taking the alphabetical first — which caught the Canonical bastion VM image in ha-hot-hot/azure and the Microsoft.Azure.Extensions VMSS extensions in unlimited-scale/azure as "drift" even though neither is a HailBytes marketplace image. Scope the check to publishers inside the marketplace_plans local block via an awk brace-depth walker so legitimate non-marketplace publishers in the same file no longer trip it. While the CI was open, tighten everything else surfaced by the same run: - tfsec ignores moved inline (above the offending attribute, not the resource) with rationale for: customer-facing ALB (intentionally public, gated by allowed_cidrs SG), SNS topic CMK (opt-in via var.enable_customer_managed_key), ALB access-log bucket SSE (AWS only supports SSE-S3 on ALB log buckets), flow-logs IAM DescribeLogGroups wildcard (AWS rejects ARN scoping on that action). - Key Vault network_acls block added in ha-hot-hot/azure and unlimited-scale/azure with new vars key_vault_network_default_action (default Allow, preserves current behavior) and key_vault_ip_rules, letting customers opt into a Deny default without a breaking change. Wrappers forward both vars. - ha-hot-hot/azure: NSG now actually attaches to lb_subnet_id via azurerm_subnet_network_security_group_association — previously the NSG was created with allow-https rules but never associated, so the rules enforced nothing. - unlimited-scale/azure: var.allowed_cidrs was declared but unused (silent security gap in the example). Now wired through a new NSG built from allowed_cidrs, optionally associated with vm_subnet_id via associate_vm_subnet_nsg (default true; set false when the customer's landing zone already manages the subnet NSG). - Drop unused declarations flagged by tflint: local.db_arn in ha-hot-hot/azure, local.db_id in ha-hot-hot/aws, data.azurerm_subscription.current in ha-hot-hot/azure. - Replace the deprecated aquasecurity/tfsec-sarif-action@v0.1.4 (bundles a Node 16 runtime) with a direct tfsec binary install in the workflow. Same SARIF upload path, no Node 16 deprecation banner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR enhances security posture across Azure modules by adding configurable Key Vault network ACLs and improving network security group (NSG) management. It also modernizes the CI/CD pipeline by replacing a deprecated GitHub Action with direct binary installation.
Key Changes
Security Enhancements
key_vault_network_default_actionandkey_vault_ip_rulesvariables to all Azure modules (unlimited-scale,ha-hot-hot,asm-azure-autoscale,sat-azure-autoscale,asm-azure-ha,sat-azure-ha), allowing customers to restrict Key Vault access from public endpoints while maintaining RBAC and AzureServices bypassassociate_vm_subnet_nsgvariable to autoscale modules to allow customers to manage NSGs via their own landing-zone toolingunlimited-scale/azuremodule with HTTPS ingress rules built fromallowed_cidrsha-hot-hot/azureto ensure security rules take effectunlimited-scale/awsto scope resource access to specific log groups, with onlyDescribeLogGroupsusing wildcard (as required by AWS API)CI/CD Improvements
aquasecurity/tfsec-sarif-action@v0.1.4(which bundles Node 16 runtime) with direct binary installation from GitHub releasesTFSEC_VERSION: v1.28.13environment variable for version managementCode Quality
marketplace_plansblock only, preventing false positives from legitimate publisher references elsewhere in Terraform filesRemoved Unused Code
db_arnanddb_idlocal variables fromha-hot-hotmodulesImplementation Details
associate_vm_subnet_nsgvariable (defaults to true) to support customers with existing NSG managementhttps://claude.ai/code/session_01AB4PrWCHV1uNAUpDJfhzcs