Skip to content
This repository was archived by the owner on Sep 27, 2024. It is now read-only.

Commit 47acb22

Browse files
bushong1pre-commit-ci-lite[bot]
bushong1
and
pre-commit-ci-lite[bot]
authored
configure precommit ci (#6)
* Adding pre-commit config * Adding markdown files * [pre-commit.ci lite] apply automatic fixes * Fix lint * Remove unused code --------- Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
1 parent 748cf5d commit 47acb22

12 files changed

+206
-175
lines changed

‎.github/workflows/pre-commit.yaml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
on:
2+
pull_request:
3+
push:
4+
branches: [main]
5+
6+
jobs:
7+
pre_commit:
8+
name: Run pre-commit and commit any autocorrections
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v3
12+
- name: Setup Terraform
13+
uses: hashicorp/setup-terraform@v3
14+
with:
15+
terraform_version: 1.6.6
16+
- name: Setup Terragrunt
17+
uses: autero1/[email protected]
18+
with:
19+
terragrunt_version: 0.54.8
20+
# To avoid rate-limiting
21+
token: ${{ secrets.GITHUB_TOKEN }}
22+
- uses: terraform-linters/setup-tflint@v3
23+
name: TFLint - Setup
24+
with:
25+
tflint_version: latest
26+
27+
- name: TFLint - Init
28+
run: tflint --init
29+
env:
30+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
31+
GITHUB_TOKEN: ${{ github.token }}
32+
- name: TFLint - Show version
33+
run: tflint --version
34+
- uses: actions/setup-python@v4
35+
with:
36+
python-version: 3.x
37+
- name: Terraform Docs - Install
38+
run: |
39+
curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v0.17.0/terraform-docs-v0.17.0-$(uname)-amd64.tar.gz
40+
tar -xzf terraform-docs.tar.gz -- terraform-docs
41+
chmod +x terraform-docs
42+
echo $PATH
43+
mv terraform-docs /usr/local/bin/terraform-docs
44+
terraform-docs --version
45+
- uses: pre-commit/[email protected]
46+
- uses: pre-commit-ci/[email protected]
47+
if: always()

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
terraform.tfstate*
2+
.terraform

‎.pre-commit-config.yaml

+15-3
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,30 @@
22
# See https://pre-commit.com/hooks.html for more hooks
33
repos:
44
- repo: https://github.com/pre-commit/pre-commit-hooks
5-
rev: v4.4.0
5+
rev: v4.5.0
66
hooks:
77
- id: trailing-whitespace
88
- id: end-of-file-fixer
99
- id: check-yaml
1010
args: ["--allow-multiple-documents"]
1111
- id: check-added-large-files
1212
- repo: https://github.com/antonbabenko/pre-commit-terraform
13-
rev: v1.77.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
13+
rev: v1.85.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
1414
hooks:
1515
- id: terraform_fmt # args: ["--enable require-variable-braces,deprecate-which"]
1616
- id: terraform_tflint
17-
exclude: .*
17+
args:
18+
- "--args=--fix"
1819
- id: terragrunt_fmt
1920
- id: terraform_docs
21+
ci:
22+
autofix_commit_msg: |
23+
[pre-commit.ci] auto fixes from pre-commit.com hooks
24+
25+
for more information, see https://pre-commit.ci
26+
autofix_prs: true
27+
autoupdate_branch: ''
28+
autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
29+
autoupdate_schedule: weekly
30+
skip: [terraform_fmt, terraform_tflint, terragrunt_fmt, terraform_docs]
31+
submodules: false

‎LICENSE.md

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# License
2+
3+
As a work of the [United States government](https://www.usa.gov/), this project
4+
is in the public domain within the United States of America.
5+
6+
Additionally, we waive copyright and related rights in the work worldwide
7+
through the CC0 1.0 Universal public domain dedication.
8+
9+
## CC0 1.0 Universal Summary
10+
11+
This is a human-readable summary of the [Legal Code (read the full
12+
text)](https://creativecommons.org/publicdomain/zero/1.0/legalcode).
13+
14+
### No Copyright
15+
16+
The person who associated a work with this deed has dedicated the work to the
17+
public domain by waiving all of their rights to the work worldwide under
18+
copyright law, including all related and neighboring rights, to the extent
19+
allowed by law.
20+
21+
You can copy, modify, distribute, and perform the work, even for commercial
22+
purposes, all without asking permission.
23+
24+
### Other Information
25+
26+
In no way are the patent or trademark rights of any person affected by CC0, nor
27+
are the rights that other persons may have in the work or in how the work is
28+
used, such as publicity or privacy rights.
29+
30+
Unless expressly stated otherwise, the person who associated a work with this
31+
deed makes no warranties about the work, and disclaims liability for all uses
32+
of the work, to the fullest extent permitted by applicable law. When using or
33+
citing the work, you should not imply endorsement by the author or the
34+
affirmer.

‎README.md

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# batcave-tf-serverless
2+
3+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4+
## Requirements
5+
6+
| Name | Version |
7+
|------|---------|
8+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.2 |
9+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.61.0 |
10+
11+
## Providers
12+
13+
| Name | Version |
14+
|------|---------|
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.61.0 |
16+
17+
## Modules
18+
19+
| Name | Source | Version |
20+
|------|--------|---------|
21+
| <a name="module_alb"></a> [alb](#module\_alb) | terraform-aws-modules/alb/aws | ~> 6.0 |
22+
| <a name="module_lambda"></a> [lambda](#module\_lambda) | terraform-aws-modules/lambda/aws | ~> 3.1 |
23+
24+
## Resources
25+
26+
| Name | Type |
27+
|------|------|
28+
| [aws_lambda_permission.alb_to_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
29+
| [aws_lb_target_group_attachment.alb_to_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
30+
| [aws_route53_record.dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
31+
| [aws_security_group.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
32+
| [aws_security_group_rule.egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
33+
| [aws_security_group_rule.https-ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
34+
| [aws_security_group_rule.ingress_cidrs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
35+
| [aws_security_group_rule.ingress_prefix_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
36+
| [aws_acm_certificate.acm_certificate](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/acm_certificate) | data source |
37+
| [aws_route53_zone.dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
38+
39+
## Inputs
40+
41+
| Name | Description | Type | Default | Required |
42+
|------|-------------|------|---------|:--------:|
43+
| <a name="input_alb_access_logs"></a> [alb\_access\_logs](#input\_alb\_access\_logs) | Map of aws\_lb access\_log config | `map(any)` | `{}` | no |
44+
| <a name="input_base_domain"></a> [base\_domain](#input\_base\_domain) | The base domain of the services the lambda should be requesting to. eg: 'batcave.internal.cms.gov' | `string` | n/a | yes |
45+
| <a name="input_create_custom_domain"></a> [create\_custom\_domain](#input\_create\_custom\_domain) | Optionally create a custom domain for this serverless service | `bool` | `false` | no |
46+
| <a name="input_custom_subdomain"></a> [custom\_subdomain](#input\_custom\_subdomain) | Subdomain for the optionally created dns records | `string` | `"status"` | no |
47+
| <a name="input_frontend_subnets"></a> [frontend\_subnets](#input\_frontend\_subnets) | List of subnet ids to house the front-end of this lambda (such as Shared subnet or Transport subnet) | `list(any)` | n/a | yes |
48+
| <a name="input_iam_role_path"></a> [iam\_role\_path](#input\_iam\_role\_path) | n/a | `string` | `"/delegatedadmin/developer/"` | no |
49+
| <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | n/a | `string` | `""` | no |
50+
| <a name="input_ingress_cidrs"></a> [ingress\_cidrs](#input\_ingress\_cidrs) | List of CIDR Blocks to attach to ALB Security Group | `list(any)` | <pre>[<br> "10.0.0.0/8"<br>]</pre> | no |
51+
| <a name="input_ingress_prefix_lists"></a> [ingress\_prefix\_lists](#input\_ingress\_prefix\_lists) | List of prefix lists to attach to ALB Security Group | `list(any)` | `[]` | no |
52+
| <a name="input_ingress_sgs"></a> [ingress\_sgs](#input\_ingress\_sgs) | A list of security groups in which https ingress rules will be created | `list(string)` | `[]` | no |
53+
| <a name="input_lambda_environment"></a> [lambda\_environment](#input\_lambda\_environment) | Environment variables used by the lambda function. | `map(string)` | `null` | no |
54+
| <a name="input_lambda_handler"></a> [lambda\_handler](#input\_lambda\_handler) | The entry point of the lambda (i.e. the fully qualified name of the function to be invoked: file-or-module-name.function-name) | `string` | n/a | yes |
55+
| <a name="input_lambda_path"></a> [lambda\_path](#input\_lambda\_path) | Path to the lambda code | `string` | `"lambda"` | no |
56+
| <a name="input_lambda_runtime"></a> [lambda\_runtime](#input\_lambda\_runtime) | The runtime environment to use for this lambda (e.g. 'python3.9' or 'nodejs16.x') | `string` | `"nodejs16.x"` | no |
57+
| <a name="input_lambda_timeout"></a> [lambda\_timeout](#input\_lambda\_timeout) | The number of seconds the lambda will be allowed to execute before timing out | `number` | `3` | no |
58+
| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | List of subnet ids where the lambda will execute | `list(any)` | n/a | yes |
59+
| <a name="input_route53_zone_type"></a> [route53\_zone\_type](#input\_route53\_zone\_type) | Optionally create DNS records, and lookup either 'private' or 'public' r53 zone | `string` | `"private"` | no |
60+
| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | Name of the serverless service | `string` | `"batcave-status"` | no |
61+
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC ID where the lambda will execute | `string` | n/a | yes |
62+
63+
## Outputs
64+
65+
No outputs.
66+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎SECURITY.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Security and Responsible Disclosure Policy
2+
3+
*Submit a vulnerability:* Unfortunately, we cannot accept secure submissions via
4+
email or via GitHub Issues. Please use our website to submit vulnerabilities at
5+
[https://hhs.responsibledisclosure.com](https://hhs.responsibledisclosure.com).
6+
HHS maintains an acknowledgements page to recognize your efforts on behalf of
7+
the American public, but you are also welcome to submit anonymously.
8+
9+
Review the HHS Disclosure Policy and websites in scope:
10+
[https://www.hhs.gov/vulnerability-disclosure-policy/index.html](https://www.hhs.gov/vulnerability-disclosure-policy/index.html).
11+
12+
This policy describes *what systems and types of research* are covered under this
13+
policy, *how to send* us vulnerability reports, and *how long* we ask security
14+
researchers to wait before publicly disclosing vulnerabilities.
15+
16+
If you have other cybersecurity related questions, please contact us at
17+
[[email protected].](mailto:[email protected]).

‎acm.tf

-1
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,3 @@ data "aws_acm_certificate" "acm_certificate" {
44
types = ["AMAZON_ISSUED"]
55
most_recent = true
66
}
7-

‎locals.tf

+1-10
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,6 @@
11
# Local variables used around the module
22
locals {
3-
# Naming
4-
service_name = var.service_name
5-
stage = var.environment
6-
resource_prefix = "${local.stage}-${local.service_name}"
7-
iam_role_path = var.iam_role_path
8-
iam_role_permissions_boundary = var.iam_role_permissions_boundary
93

104
# VPC
11-
vpc_id = var.vpc_id
12-
subnets = var.private_subnets
5+
vpc_id = var.vpc_id
136
}
14-
15-
data "aws_caller_identity" "current" {}

‎main.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = ">= 4.61.0"
6+
}
7+
}
8+
required_version = ">= 1.2"
9+
}

‎security_group.tf

+7-7
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,12 @@ resource "aws_security_group_rule" "ingress_prefix_list" {
4545
}
4646

4747
resource "aws_security_group_rule" "https-ingress" {
48-
for_each = toset(var.ingress_sgs)
49-
description = "allow ingress from lambda"
50-
type = "ingress"
51-
to_port = 443
52-
from_port = 443
53-
protocol = "TCP"
54-
security_group_id = each.key
48+
for_each = toset(var.ingress_sgs)
49+
description = "allow ingress from lambda"
50+
type = "ingress"
51+
to_port = 443
52+
from_port = 443
53+
protocol = "TCP"
54+
security_group_id = each.key
5555
source_security_group_id = aws_security_group.lambda.id
5656
}

‎unused/publicly-accessible-lb.tf

-139
This file was deleted.

0 commit comments

Comments
 (0)