From 024dc5ecea720861255137aa81c0a926656ab3f4 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci-lite[bot]" <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com> Date: Wed, 24 Jan 2024 20:48:37 +0000 Subject: [PATCH] [pre-commit.ci lite] apply automatic fixes --- README.md | 6 +++++- iam.tf | 2 +- main.tf | 12 ++++++------ outputs.tf | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 976786f..59e3cae 100644 --- a/README.md +++ b/README.md @@ -170,6 +170,7 @@ Note that this example may create resources which cost money. Run `terraform des | [create\_cosign\_iam\_role](#input\_create\_cosign\_iam\_role) | Flag to create Cosign IAM role | `bool` | `false` | no | | [custom\_node\_policy\_arns](#input\_custom\_node\_policy\_arns) | Custom node policy arns | `set(string)` | `[]` | no | | [custom\_node\_pools](#input\_custom\_node\_pools) | n/a | `any` | `{}` | no | +| [enable\_cms\_cloud\_ssm\_policy](#input\_enable\_cms\_cloud\_ssm\_policy) | Enables SSM cloud policy for patching OS on instances | `bool` | `false` | no | | [enable\_eks\_managed\_nodes](#input\_enable\_eks\_managed\_nodes) | Enables eks managed nodes | `bool` | `false` | no | | [enable\_hoplimit](#input\_enable\_hoplimit) | Enables a IMDSv2 hop limit of 1 on all nodes. Defaults to false | `bool` | `false` | no | | [enable\_self\_managed\_nodes](#input\_enable\_self\_managed\_nodes) | Enables self managed nodes | `bool` | `true` | no | @@ -192,9 +193,11 @@ Note that this example may create resources which cost money. Run `terraform des | [openid\_connect\_audiences](#input\_openid\_connect\_audiences) | OpenID Connect Audiences | `list(string)` | `[]` | no | | [private\_subnets](#input\_private\_subnets) | n/a | `list(any)` | n/a | yes | | [s3\_bucket\_access\_grants](#input\_s3\_bucket\_access\_grants) | A list of s3 bucket names to grant the cluster roles R/W access to | `list(string)` | `null` | no | +| [ssm\_DevTestImpl\_patch\_window](#input\_ssm\_DevTestImpl\_patch\_window) | SSM Patching window for instances. For more information: https://cloud.cms.gov/patching-prerequisites | `string` | `"ITOPS-Wave1-Non-Mktplc-DevTestImpl-MW"` | no | | [ssm\_iam\_patching\_policy](#input\_ssm\_iam\_patching\_policy) | SSM IAM policy for patching | `string` | `"cms-cloud-ssm-iam-policy-v3"` | no | +| [ssm\_override\_patch\_window](#input\_ssm\_override\_patch\_window) | Patching window override variable | `string` | `""` | no | +| [ssm\_prod\_patch\_window](#input\_ssm\_prod\_patch\_window) | SSM Patching window for instances. For more information: https://cloud.cms.gov/patching-prerequisites | `string` | `"ITOPS-Wave1-Non-Mktplc-Prod-MW"` | no | | [ssm\_tag\_patch\_group](#input\_ssm\_tag\_patch\_group) | SSM Patching group for instances. For more information: https://cloud.cms.gov/patching-prerequisites | `string` | `"AL2"` | no | -| [ssm\_tag\_patch\_window](#input\_ssm\_tag\_patch\_window) | SSM Patching window for instances. For more information: https://cloud.cms.gov/patching-prerequisites | `string` | `"ITOPS-Wave1-Non-Mktplc-DevTestImpl-MW"` | no | | [tags](#input\_tags) | Global resource tags to apply to all resources | `map(any)` | `null` | no | | [vpc\_cidr\_blocks](#input\_vpc\_cidr\_blocks) | List of VPC CIDR blocks | `list(string)` | n/a | yes | | [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes | @@ -227,6 +230,7 @@ Note that this example may create resources which cost money. Run `terraform des | [cosign\_iam\_role\_arn](#output\_cosign\_iam\_role\_arn) | n/a | | [eks\_managed\_node\_group](#output\_eks\_managed\_node\_group) | ARNs of all self managed node groups created | | [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created | +| [instance\_tags](#output\_instance\_tags) | n/a | | [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group | | [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group | | [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` | diff --git a/iam.tf b/iam.tf index e040135..2fd9096 100644 --- a/iam.tf +++ b/iam.tf @@ -186,7 +186,7 @@ resource "aws_iam_policy" "ssm_managed_instance" { } data "aws_iam_policy" "ssm_patching_policy" { - name = var.ssm_iam_patching_policy + name = var.ssm_iam_patching_policy } # ssm patching policy attachment diff --git a/main.tf b/main.tf index adfacdc..c3bf64c 100644 --- a/main.tf +++ b/main.tf @@ -130,12 +130,12 @@ locals { instance_refresh = lookup(v, "instance_refresh", {}) } } - # Applying necessary tags for SSM OS patching - patch_group_tags = (var.enable_ssm_patching || var.enable_cms_cloud_ssm_policy) ? { "Patch Group" = var.ssm_tag_patch_group} : {} - patch_window_tags = (var.ssm_override_patch_window == "" ? - (var.environment == "prod" ? {"Patch Window" = var.ssm_prod_patch_window} : {"Patch Window" = var.ssm_DevTestImpl_patch_window}) : - {"Patch Window" = var.ssm_override_patch_window}) - instance_tags = merge(local.patch_group_tags, local.patch_window_tags, var.instance_tags) + # Applying necessary tags for SSM OS patching + patch_group_tags = (var.enable_ssm_patching || var.enable_cms_cloud_ssm_policy) ? { "Patch Group" = var.ssm_tag_patch_group } : {} + patch_window_tags = (var.ssm_override_patch_window == "" ? + (var.environment == "prod" ? { "Patch Window" = var.ssm_prod_patch_window } : { "Patch Window" = var.ssm_DevTestImpl_patch_window }) : + { "Patch Window" = var.ssm_override_patch_window }) + instance_tags = merge(local.patch_group_tags, local.patch_window_tags, var.instance_tags) # Allow ingress to the control plane from the delete_ebs_volumes lambda (if it exists) delete_ebs_volumes_lambda_sg_id = one(data.aws_security_groups.delete_ebs_volumes_lambda_security_group.ids) diff --git a/outputs.tf b/outputs.tf index 86a40d7..0031b2d 100644 --- a/outputs.tf +++ b/outputs.tf @@ -186,5 +186,5 @@ output "batcave_alb_shared_dns" { } output "instance_tags" { - value = var.instance_tags + value = var.instance_tags }