diff --git a/README.md b/README.md index d9a0044e..45dc735f 100644 --- a/README.md +++ b/README.md @@ -322,6 +322,7 @@ allow_github_webhooks = true | [certificate\_arn](#input\_certificate\_arn) | ARN of certificate issued by AWS ACM. If empty, a new ACM certificate will be created and validated using Route53 DNS | `string` | `""` | no | | [cidr](#input\_cidr) | The CIDR block for the VPC which will be created if `vpc_id` is not specified | `string` | `""` | no | | [cloudwatch\_log\_retention\_in\_days](#input\_cloudwatch\_log\_retention\_in\_days) | Retention period of Atlantis CloudWatch logs | `number` | `7` | no | +| [cloudwatch\_logs\_kms\_key\_id](#input\_cloudwatch\_logs\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data. | `string` | `null` | no | | [command](#input\_command) | The command that is passed to the container | `list(string)` | `null` | no | | [container\_cpu](#input\_container\_cpu) | The number of cpu units used by the atlantis container. If not specified ecs\_task\_cpu will be used | `number` | `null` | no | | [container\_depends\_on](#input\_container\_depends\_on) | The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. The condition can be one of START, COMPLETE, SUCCESS or HEALTHY | 
list(object({
    containerName = string
    condition     = string
  }))
| `null` | no | @@ -331,6 +332,8 @@ allow_github_webhooks = true | [custom\_container\_definitions](#input\_custom\_container\_definitions) | A list of valid container definitions provided as a single valid JSON document. By default, the standard container definition is used. | `string` | `""` | no | | [custom\_environment\_secrets](#input\_custom\_environment\_secrets) | List of additional secrets the container will use (list should contain maps with `name` and `valueFrom`) | 
list(object(
    {
      name      = string
      valueFrom = string
    }
  ))
| `[]` | no | | [custom\_environment\_variables](#input\_custom\_environment\_variables) | List of additional environment variables the container will use (list should contain maps with `name` and `value`) | 
list(object(
    {
      name  = string
      value = string
    }
  ))
| `[]` | no | +| [default\_security\_group\_egress](#input\_default\_security\_group\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no | +| [default\_security\_group\_ingress](#input\_default\_security\_group\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no | | [docker\_labels](#input\_docker\_labels) | The configuration options to send to the `docker_labels` | `map(string)` | `null` | no | | [ecs\_container\_insights](#input\_ecs\_container\_insights) | Controls if ECS Cluster has container insights enabled | `bool` | `false` | no | | [ecs\_fargate\_spot](#input\_ecs\_fargate\_spot) | Whether to run ECS Fargate Spot or not | `bool` | `false` | no | @@ -354,6 +357,7 @@ allow_github_webhooks = true | [firelens\_configuration](#input\_firelens\_configuration) | The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_FirelensConfiguration.html | 
object({
    type    = string
    options = map(string)
  })
| `null` | no | | [github\_webhooks\_cidr\_blocks](#input\_github\_webhooks\_cidr\_blocks) | List of CIDR blocks used by GitHub webhooks | `list(string)` | 
[
  "140.82.112.0/20",
  "185.199.108.0/22",
  "192.30.252.0/22",
  "143.55.64.0/20"
]
| no | | [internal](#input\_internal) | Whether the load balancer is internal or external | `bool` | `false` | no | +| [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `false` | no | | [mount\_points](#input\_mount\_points) | Container mount points. This is a list of maps, where each map should contain a `containerPath` and `sourceVolume`. The `readOnly` key is optional. | `list(any)` | `[]` | no | | [name](#input\_name) | Name to use on all resources created (VPC, ALB, etc) | `string` | `"atlantis"` | no | | [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no | diff --git a/main.tf b/main.tf index 060deef4..2ecb752f 100644 --- a/main.tf +++ b/main.tf @@ -192,6 +192,10 @@ module "vpc" { enable_nat_gateway = true single_nat_gateway = true + manage_default_security_group = var.manage_default_security_group + default_security_group_ingress = var.default_security_group_ingress + default_security_group_egress = var.default_security_group_egress + tags = local.tags } @@ -690,6 +694,7 @@ resource "aws_ecs_service" "atlantis" { resource "aws_cloudwatch_log_group" "atlantis" { name = var.name retention_in_days = var.cloudwatch_log_retention_in_days + kms_key_id = var.cloudwatch_logs_kms_key_id tags = local.tags } diff --git a/variables.tf b/variables.tf index 29012aaf..d349a88f 100644 --- a/variables.tf +++ b/variables.tf @@ -71,6 +71,24 @@ variable "azs" { default = [] } +variable "manage_default_security_group" { + description = "Should be true to adopt and manage default security group" + type = bool + default = false +} + +variable "default_security_group_ingress" { + description = "List of maps of ingress rules to set on the default security group" + type = list(map(string)) + default = [] +} + +variable "default_security_group_egress" { + description = "List of maps of egress rules to set on the default security group" + type = list(map(string)) + default = [] +} + variable "public_subnets" { description = "A list of public subnets inside the VPC" type = list(string) @@ -219,6 +237,12 @@ variable "cloudwatch_log_retention_in_days" { default = 7 } +variable "cloudwatch_logs_kms_key_id" { + description = "The ARN of the KMS Key to use when encrypting log data." + type = string + default = null +} + # SSM parameters for secrets variable "webhook_ssm_parameter_name" { description = "Name of SSM parameter to keep webhook secret"