Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfa01752

Browse files
authored
Merge pull request#75 from ScaleSec/feature/issue-74_HTTP-module
Feature/issue 74 http module
2 parents1daaa77 +8794a18 commitfa01752

File tree

25 files changed

+122
-151
lines changed

25 files changed

+122
-151
lines changed

‎.github/workflows/terraform.yml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name:Terraform Validation
22

3-
on:
3+
on:
44
pull_request
55

66

@@ -107,23 +107,23 @@ jobs:
107107
TF_VAR_target_id:${{ secrets.TARGET_ID }}"'
108108

109109
# FedRAMP Medium Validation
110-
-name:Terraform fmt FedRAMPMed
110+
-name:Terraform fmt FedRAMPMod
111111
run:terraform fmt
112-
working-directory:./compliance_scp/fedrampMed
112+
working-directory:./compliance_scp/fedrampMod
113113
continue-on-error:true
114114

115-
-name:Terraform Init FedRAMPMed
115+
-name:Terraform Init FedRAMPMod
116116
run:terraform init
117-
working-directory:./compliance_scp/fedrampMed
117+
working-directory:./compliance_scp/fedrampMod
118118

119-
-name:Terraform Validate FedRAMPMed
119+
-name:Terraform Validate FedRAMPMod
120120
run:terraform validate -no-color
121-
working-directory:./compliance_scp/fedrampMed
121+
working-directory:./compliance_scp/fedrampMod
122122

123-
-name:Terraform Plan FedRAMPMed
123+
-name:Terraform Plan FedRAMPMod
124124
run:terraform plan -no-color
125125
continue-on-error:false
126-
working-directory:./compliance_scp/fedrampMed
126+
working-directory:./compliance_scp/fedrampMod
127127
env:
128128
TF_VAR_target_id:${{ secrets.TARGET_ID }}"'
129129

@@ -254,4 +254,4 @@ jobs:
254254
TF_VAR_target_id:${{ secrets.TARGET_ID }}"'
255255
TF_VAR_ami_creator_account:${{ secrets.AMI_CREATOR_ACCOUNT }}"'
256256
TF_VAR_ami_tag_key:${{ secrets.AMI_TAG_KEY }}"'
257-
TF_VAR_ami_tag_value:${{ secrets.AMI_TAG_VALUE }}"'
257+
TF_VAR_ami_tag_value:${{ secrets.AMI_TAG_VALUE }}"'

‎README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ This repo is a collection of AWS Service Control Policies (SCPs) written in Hash
3434
- Select the`aws_iam_policy_document` you want and combine into one large data document.
3535
- Pick and choose 5 modules to deploy and remove the others.
3636
- Remove`aws_organizations_policy_attachment` from the modules'`main.tf` file and apply. You would then need to manually attach the SCPs.
37-
- The[hipaa_scp](compliance_scp/hipaa_scp/) folder is aservice control policy that whitelists HIPAA compliantAWS servicesbased off ofhttps://aws.amazon.com/compliance/hipaa-eligible-services-reference/.
38-
- The[pci_scp](compliance_scp/pci_scp/) folder is a service control policy that whitelists PCI compliant AWS services based off ofhttps://aws.amazon.com/compliance/services-in-scope/.
37+
- The[compliance_scp](compliance_scp/) folder is acollection of compliance-flavored SCPs. These SCPs only allowAWS servicesthat are compliant with the respective compliance framework. All SCP JSON files are sourced from Salesforce's[aws-allowlister](https://github.com/salesforce/aws-allowlister) repository which updates via a weekly cronjob.
38+
3939

4040
##Usage
4141

@@ -71,16 +71,16 @@ To Remove the SCPs:
7171
- An AWS Organization
7272
- An IAM user with Organization Admin Access
7373

74-
##Common Errors
74+
##Common Errors
7575

7676
####Enabled Policy Types
7777

7878
```
79-
error creating Organizations Policy Attachment: PolicyTypeNotEnabledException: This operation can be performed only for enabled policy types.
79+
error creating Organizations Policy Attachment: PolicyTypeNotEnabledException: This operation can be performed only for enabled policy types.
8080
status code: 400, request id: 2b8ecgeb-34h3-11e6-86fb-275c76986dec
8181
```
8282

83-
SCP functionality must be enabled on the root. Seehttps://github.com/terraform-providers/terraform-provider-aws/issues/4545 for more information
83+
SCP functionality must be enabled on the root. Seehttps://github.com/terraform-providers/terraform-provider-aws/issues/4545 for more information
8484

8585
####Minimum SCP Requirement
8686

@@ -101,5 +101,5 @@ Occasionally, if you try to assign many SCPs to one target at the same time, it
101101

102102
##Limitation of Liability
103103

104-
Please view the[License](LICENSE) for limitations of liability.
104+
Please view the[License](LICENSE) for limitations of liability.
105105

‎compliance_scp/README.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#Compliance Service Control Policies
2+
3+
When organizations need to meet specific compliance requirements they must be careful to only use AWS services that are also compliant with the target framework. For example, when you need to meet PCI-DSS, you must be sure to only use PCI-DSS compliant AWS services.
4+
5+
To only use compliant AWS services at scale, and in a safe manner, we recommend Service Control policies.
6+
7+
The following compliance frameworks are currently supported in terraform.
8+
9+
*[SOC](soc)
10+
*[PCI](pci)
11+
*[HIPAA](hipaa)
12+
*[ISO](iso)
13+
*[FedRAMP High](fedrampHigh)
14+
*[FedRAMP Moderate](fedrampMod)
15+
*[Include DoD CC SRG IL2 East/West](dodCcSrgIl2Ew)
16+
*[Include DoD CC SRG IL2 GovCloud](dodCcSrgIl2Gc)
17+
*[Include DoD CC SRG IL4 GovCloud](dodCcSrgIl4Gc)
18+
*[Include DoD CC SRG IL5 GovCloud](dodCcSrgIl5Gc)
19+
20+
21+
All SCP JSON files are sourced from Salesforce's[aws-allowlister](https://github.com/salesforce/aws-allowlister) repository which updates via a weekly cronjob.

‎compliance_scp/dodCcSrgIl2Ew/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
# The below approved services are based off the list located here: https://aws.amazon.com/compliance/services-in-scope/
22

3-
data"template_file""dodccsrgil2ew_policy" {
4-
template=file("../templates/dodccsrgIl2Ew.json")
3+
data"http""dodccsrgil2ew_policy" {
4+
url="https://raw.githubusercontent.com/salesforce/aws-allowlister/main/examples/latest/DOD_CC_SRG_IL2_EW-AllowList-SCP.json"
5+
6+
request_headers={
7+
Accept="application/json"
8+
}
59
}
610

711
resource"aws_organizations_policy""allow_dodccsrgil2ew_services_policy" {
812
name="Allow DoD CC SRG IL2 (East/West) Services"
9-
description="Only allow DoD CC SRG IL2 (East/West) services as of 03/2021"
13+
description="Only allow DoD CC SRG IL2 (East/West)."
1014

11-
content=data.template_file.dodccsrgil2ew_policy.rendered
15+
content=data.http.dodccsrgil2ew_policy.body
1216
}
1317

1418
resource"aws_organizations_policy_attachment""allow_dodccsrgil2ew_services_attachment" {

‎compliance_scp/dodCcSrgIl2Gc/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
# The below approved services are based off the list located here: https://aws.amazon.com/compliance/services-in-scope/
22

3-
data"template_file""dodccsrgil2gc_policy" {
4-
template=file("../templates/dodccsrgIl2Gc.json")
3+
data"http""dodccsrgil2gc_policy" {
4+
url="https://raw.githubusercontent.com/salesforce/aws-allowlister/main/examples/latest/DOD_CC_SRG_IL2_GC-AllowList-SCP.json"
5+
6+
request_headers={
7+
Accept="application/json"
8+
}
59
}
610

711
resource"aws_organizations_policy""allow_dodccsrgil2gc_services_policy" {
812
name="Allow DoD CC SRG IL2 (GovCloud) Services"
9-
description="Only allow DoD CC SRG IL2 (GovCloud) services as of 03/2021"
13+
description="Only allow DoD CC SRG IL2 (GovCloud) services."
1014

11-
content=data.template_file.dodccsrgil2gc_policy.rendered
15+
content=data.http.dodccsrgil2gc_policy.body
1216
}
1317

1418
resource"aws_organizations_policy_attachment""allow_dodccsrgil2gc_services_attachment" {

‎compliance_scp/dodCcSrgIl4Gc/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
# The below approved services are based off the list located here: https://aws.amazon.com/compliance/services-in-scope/
22

3-
data"template_file""dodccsrgil4gc_policy" {
4-
template=file("../templates/dodccsrgIl4Gc.json")
3+
data"http""dodccsrgil4gc_policy" {
4+
url="https://raw.githubusercontent.com/salesforce/aws-allowlister/main/examples/latest/DOD_CC_SRG_IL4_GC-AllowList-SCP.json"
5+
6+
request_headers={
7+
Accept="application/json"
8+
}
59
}
610

711
resource"aws_organizations_policy""allow_dodccsrgil4gc_services_policy" {
812
name="Allow DoD CC SRG IL4 (GovCloud) Services"
9-
description="Only allow DoD CC SRG IL4 (GovCloud) services as of 03/2021"
13+
description="Only allow DoD CC SRG IL4 (GovCloud) services."
1014

11-
content=data.template_file.dodccsrgil4gc_policy.rendered
15+
content=data.http.dodccsrgil4gc_policy.body
1216
}
1317

1418
resource"aws_organizations_policy_attachment""allow_dodccsrgil4gc_services_attachment" {

‎compliance_scp/dodCcSrgIl5Gc/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
# The below approved services are based off the list located here: https://aws.amazon.com/compliance/services-in-scope/
22

3-
data"template_file""dodccsrgil5gc_policy" {
4-
template=file("../templates/dodccsrgIl5Gc.json")
3+
data"http""dodccsrgil5gc_policy" {
4+
url="https://raw.githubusercontent.com/salesforce/aws-allowlister/main/examples/latest/DOD_CC_SRG_IL5_GC-AllowList-SCP.json"
5+
6+
request_headers={
7+
Accept="application/json"
8+
}
59
}
610

711
resource"aws_organizations_policy""allow_dodccsrgil5gc_services_policy" {
812
name="Allow DoD CC SRG IL5 (GovCloud) Services"
9-
description="Only allow DoD CC SRG IL5 (GovCloud) services as of 03/2021"
13+
description="Only allow DoD CC SRG IL5 (GovCloud) services."
1014

11-
content=data.template_file.dodccsrgil5gc_policy.rendered
15+
content=data.http.dodccsrgil5gc_policy.body
1216
}
1317

1418
resource"aws_organizations_policy_attachment""allow_dodccsrgil5gc_services_attachment" {

‎compliance_scp/fedrampHigh/main.tf

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
# The below approved services are based off the list located here: https://aws.amazon.com/compliance/services-in-scope/
22

3-
data"template_file""fedramph_policy" {
4-
template=file("../templates/fedramph.json")
3+
data"http""fedramph_policy" {
4+
url="https://raw.githubusercontent.com/salesforce/aws-allowlister/main/examples/latest/FedRAMP_High-AllowList-SCP.json"
5+
6+
request_headers={
7+
Accept="application/json"
8+
}
59
}
610

711
resource"aws_organizations_policy""allow_fedramph_services_policy" {
812
name="Allow FedRAMP High Services"
9-
description="Only allow FedRAMP High services as of 03/2021"
13+
description="Only allow FedRAMP High services"
1014

11-
content=data.template_file.fedramph_policy.rendered
15+
content=data.http.fedramph_policy.body
1216
}
1317

1418
resource"aws_organizations_policy_attachment""allow_fedramph_services_attachment" {
1519
policy_id=aws_organizations_policy.allow_fedramph_services_policy.id
1620
target_id=var.target_id
17-
}
21+
}
Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
# The below approved services are based off the list located here: https://aws.amazon.com/compliance/services-in-scope/
22

3-
data"template_file""fedrampm_policy" {
4-
template=file("../templates/fedrampm.json")
3+
data"http""fedrampm_policy" {
4+
url="https://raw.githubusercontent.com/salesforce/aws-allowlister/main/examples/latest/FedRAMP_Moderate-AllowList-SCP.json"
5+
6+
request_headers={
7+
Accept="application/json"
8+
}
59
}
610

711
resource"aws_organizations_policy""allow_fedrampm_services_policy" {
8-
name="Allow FedRAMPMed Services"
9-
description="Only allow FedRAMPMedium services as of 03/2021"
12+
name="Allow FedRAMPMod Services"
13+
description="Only allow FedRAMPModerate services"
1014

11-
content=data.template_file.fedrampm_policy.rendered
15+
content=data.http.fedrampm_policy.body
1216
}
1317

1418
resource"aws_organizations_policy_attachment""allow_fedrampm_services_attachment" {
1519
policy_id=aws_organizations_policy.allow_fedrampm_services_policy.id
1620
target_id=var.target_id
17-
}
21+
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp