Infrastructure/ Improvements

infrastructure/blocks/auth/main.tf

@@ -5,9 +5,9 @@ terraform {
 }
 
 module "auth" {
-  source = "../../modules/auth"
-  tags                       = var.tags
-  domain_name                = var.domain_name
-  resource-name-prefix       = var.resource-name-prefix
-  layers                     = var.layers
+  source               = "../../modules/auth"
+  tags                 = var.tags
+  domain_name          = var.domain_name
+  resource-name-prefix = var.resource-name-prefix
+  layers               = var.layers
 }

infrastructure/blocks/s3/main.tf

@@ -19,7 +19,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_data_storag
 
   rule {
     apply_server_side_encryption_by_default {
-      sse_algorithm     = "aws:kms"
+      sse_algorithm = "aws:kms"
     }
   }
 }
@@ -84,7 +84,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
 
   rule {
     apply_server_side_encryption_by_default {
-      sse_algorithm     = "aws:kms"
+      sse_algorithm = "aws:kms"
     }
   }
 }

infrastructure/modules/app-cluster/cloudtrail.tf

@@ -19,10 +19,13 @@ data "aws_iam_policy_document" "access_logs_key_policy" {
       "kms:Encrypt",
       "kms:Decrypt",
       "kms:ReEncrypt*",
+      "kms:ScheduleKeyDeletion",
+      "kms:EnableKeyRotation",
+      "kms:TagResource"
     ]
 
     resources = [
-      "arn:aws:kms:${data.aws_region.region.name}:${data.aws_caller_identity.current.account_id}:key/*",
+      "arn:aws:kms:${data.aws_region.region.region}:${data.aws_caller_identity.current.account_id}:key/*",
     ]
   }
 
@@ -33,7 +36,7 @@ data "aws_iam_policy_document" "access_logs_key_policy" {
 
     principals {
       type        = "Service"
-      identifiers = ["logs.${data.aws_region.region.name}.amazonaws.com"]
+      identifiers = ["logs.${data.aws_region.region.region}.amazonaws.com"]
     }
 
     actions = [
@@ -45,14 +48,14 @@ data "aws_iam_policy_document" "access_logs_key_policy" {
     ]
 
     resources = [
-      "arn:aws:kms:${data.aws_region.region.name}:${data.aws_caller_identity.current.account_id}:key/*",
+      "arn:aws:kms:${data.aws_region.region.region}:${data.aws_caller_identity.current.account_id}:key/*",
     ]
 
     condition {
       test     = "ArnEquals"
       variable = "kms:EncryptionContext:aws:logs:arn"
       values = [
-        "arn:aws:logs:${data.aws_region.region.name}:${data.aws_caller_identity.current.account_id}:log-group:${var.resource-name-prefix}_access_logs"
+        "arn:aws:logs:${data.aws_region.region.region}:${data.aws_caller_identity.current.account_id}:log-group:${var.resource-name-prefix}_access_logs"
       ]
     }
   }
@@ -76,7 +79,7 @@ data "aws_iam_policy_document" "access_logs_key_policy" {
     ]
 
     resources = [
-      "arn:aws:kms:${data.aws_region.region.name}:${data.aws_caller_identity.current.account_id}:key/*",
+      "arn:aws:kms:${data.aws_region.region.region}:${data.aws_caller_identity.current.account_id}:key/*",
     ]
   }
 }
@@ -278,6 +281,11 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs_s3_en
   bucket     = aws_s3_bucket.access_logs[0].bucket
 
   rule {
+    blocked_encryption_types = [
+      "SSE-C",
+    ]
+    bucket_key_enabled = false
+
     apply_server_side_encryption_by_default {
       kms_master_key_id = aws_kms_key.access_logs_key[0].arn
       sse_algorithm     = "aws:kms"

infrastructure/modules/app-cluster/db.tf

@@ -3,9 +3,9 @@ data "aws_caller_identity" "current" {}
 
 resource "aws_dynamodb_table" "service_table" {
   # checkov:skip=CKV_AWS_119:No need for customer managed keys
-  name         = "${var.resource-name-prefix}_service_table"
-  hash_key     = "PK"
-  range_key    = "SK"
+  name                        = "${var.resource-name-prefix}_service_table"
+  hash_key                    = "PK"
+  range_key                   = "SK"
   billing_mode                = "PAY_PER_REQUEST"
   deletion_protection_enabled = true
 

infrastructure/modules/app-cluster/load_balancer.tf

@@ -130,7 +130,6 @@ resource "aws_security_group_rule" "load_balancer_security_group_rule_egress_htt
 }
 
 resource "aws_lb_target_group" "target_group" {
-  name        = "${var.resource-name-prefix}-tg"
   port        = 80
   protocol    = "HTTP"
   target_type = "ip"

infrastructure/modules/app-cluster/main.tf

@@ -409,4 +409,8 @@ resource "aws_security_group" "service_security_group" {
   }
 
   tags = var.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }

infrastructure/modules/app-cluster/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.7.0"
+    }
+  }
+}

infrastructure/modules/app-cluster/routing.tf

@@ -6,6 +6,16 @@ resource "aws_route53_zone" "primary-hosted-zone" {
   tags  = var.tags
 }
 
+resource "aws_route53_record" "copy-ns-records" {
+  count = var.parent_hosted_zone_id == "" ? 0 : 1
+
+  zone_id = var.parent_hosted_zone_id
+  name    = aws_route53_zone.primary-hosted-zone[0].name
+  type    = "NS"
+  ttl     = "30"
+  records = aws_route53_zone.primary-hosted-zone[0].name_servers
+}
+
 # Create the certificate
 resource "aws_acm_certificate" "rapid-certificate" {
   count             = var.certificate_validation_arn == "" ? 1 : 0

infrastructure/modules/app-cluster/variables.tf

@@ -102,6 +102,12 @@ variable "hosted_zone_id" {
   description = "Hosted Zone ID with the domain Name Servers, pass quotes to create a new one from scratch"
 }
 
+variable "parent_hosted_zone_id" {
+  type        = string
+  description = "Parent hosted Zone ID, if domain you use is aws subdomain. This will copy NS records to parent hosted zone"
+  default     = ""
+}
+
 variable "certificate_validation_arn" {
   type        = string
   description = "Arn of the certificate used by the domain"

infrastructure/modules/auth/db.tf

@@ -3,9 +3,9 @@ data "aws_caller_identity" "current" {}
 
 resource "aws_dynamodb_table" "permissions_table" {
   # checkov:skip=CKV_AWS_119:No need for customer managed keys
-  name         = "${var.resource-name-prefix}_${var.permissions_table_name}"
-  hash_key     = "PK"
-  range_key    = "SK"
+  name                        = "${var.resource-name-prefix}_${var.permissions_table_name}"
+  hash_key                    = "PK"
+  range_key                   = "SK"
   billing_mode                = "PAY_PER_REQUEST"
   deletion_protection_enabled = true
 

infrastructure/modules/auth/main.tf

@@ -6,6 +6,12 @@ resource "aws_cognito_user_pool" "rapid_user_pool" {
 
   admin_create_user_config {
     allow_admin_create_user_only = true
+
+    invite_message_template {
+      email_message = var.invite_message_email_message
+      email_subject = var.invite_message_email_subject
+      sms_message   = "Your username is {username} and temporary password is {####}."
+    }
   }
 
   mfa_configuration = "OPTIONAL"
@@ -29,14 +35,17 @@ resource "aws_cognito_user_pool" "rapid_user_pool" {
     advanced_security_mode = "ENFORCED"
   }
 
-  dynamic "email_configuration" {
-    for_each = var.ses_domain_identity_arn != null ? [1] : []
-    content {
-      email_sending_account = "DEVELOPER"
-      from_email_address    = "no-reply@${coalesce(var.ses_email_domain, var.domain_name)}"
-      source_arn            = var.ses_domain_identity_arn
-    }
+  email_configuration {
+    email_sending_account = var.ses_domain_identity_arn != null ? "DEVELOPER" : "COGNITO_DEFAULT"
+    from_email_address = (
+      var.ses_domain_identity_arn != null ?
+      "\"${var.sender_display_name}\" <no-reply@${coalesce(var.ses_email_domain, var.domain_name)}>" :
+      null
+    )
+    source_arn             = var.ses_domain_identity_arn
+    reply_to_email_address = var.reply_to_email_address
   }
+
 }
 
 resource "aws_cognito_resource_server" "rapid_resource_server" {

infrastructure/modules/auth/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.7.0"
+    }
+  }
+}

infrastructure/modules/auth/users.tf

@@ -158,6 +158,10 @@ resource "aws_secretsmanager_secret_version" "e2e_test_client_write_all_secrets_
 # UI_TEST_USER
 resource "random_password" "password" {
   length           = 16
+  min_lower        = 1
+  min_numeric      = 1
+  min_special      = 1
+  min_upper        = 1
   special          = true
   override_special = "!#$%&*()-_=+[]{}<>:?"
 }

infrastructure/modules/auth/variables.tf

@@ -119,3 +119,31 @@ variable "ses_email_domain" {
   description = "The domain to use for the SES email 'from' address (e.g., no-reply@<domain>). Defaults to domain_name if not specified."
   default     = null
 }
+
+variable "invite_message_email_message" {
+  description = "Invite message email message"
+  type        = string
+  validation {
+    condition     = strcontains(var.invite_message_email_message, "{username}") && strcontains(var.invite_message_email_message, "{####}")
+    error_message = "Email message template. Must contain {username} and {####} placeholders, for username and temporary password, respectively."
+  }
+  default = "Your username is {username} and temporary password is {####}."
+}
+
+variable "invite_message_email_subject" {
+  description = "Invite message email subject"
+  type        = string
+  default     = "Your temporary password"
+}
+
+variable "sender_display_name" {
+  description = "Email sender display name. Applicable only if ses_domain_identity_arn is configured."
+  type        = string
+  default     = ""
+}
+
+variable "reply_to_email_address" {
+  description = "Email REPLY-TO email address"
+  type        = string
+  default     = ""
+}

infrastructure/modules/data-workflow/athena.tf

@@ -13,6 +13,11 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_athena_quer
   bucket = aws_s3_bucket.rapid_athena_query_results_bucket.id
 
   rule {
+    blocked_encryption_types = [
+      "SSE-C",
+    ]
+    bucket_key_enabled = false
+
     apply_server_side_encryption_by_default {
       sse_algorithm = "aws:kms"
     }

infrastructure/modules/data-workflow/dynamodb.tf

@@ -1,8 +1,8 @@
 resource "aws_dynamodb_table" "schema_table" {
   # checkov:skip=CKV_AWS_119:No need for customer managed keys
-  name         = "${var.resource-name-prefix}_schema_table"
-  hash_key     = "PK"
-  range_key    = "SK"
+  name                        = "${var.resource-name-prefix}_schema_table"
+  hash_key                    = "PK"
+  range_key                   = "SK"
   billing_mode                = "PAY_PER_REQUEST"
   deletion_protection_enabled = true
 

infrastructure/modules/data-workflow/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.7.0"
+    }
+  }
+}