nanlabs / terraform-aws-starter Goto Github PK

Describe the feature

the bastion host should have the permissions to read secrets from secrets manager, that way it would be possible to access database credentials or other sensitive information

Use Case

• to test a database connection from inside the bastion host
• to run migrations for a project from inside the bastion host

Proposed Solution

adding the following lines to the file https://github.com/nanlabs/terraform-aws-starter/blob/main/modules/bastion/iam.tf should do the trick
{ "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:*" }

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

Version used

.

Environment details (OS name and version, etc.)

any!

Describe the bug

When run for the first time with the default configuration. It fails creating a secrets manager linked to the VPC

Expected Behavior

Be able to attach secrets manager to the VPC endpoint

Current Behavior

throws an error with this message

 Error: creating EC2 VPC Endpoint (com.amazonaws.us-west-2.secretsmanager): InvalidParameter: Subnet IDs are only supported for Interface and GatewayLoadBalancer type VPC Endpoints.
│       status code: 400, request id: c3858cb1-8278-4dea-a6d2-177948dcf477
│
│   with module.vpc.aws_vpc_endpoint.secrets_manager,
│   on ..\..\modules\vpc\endpoints.tf line 3, in resource "aws_vpc_endpoint" "secrets_manager":
│    3: resource "aws_vpc_endpoint" "secrets_manager" {

Reproduction Steps

Run through the default example

Possible Solution

No response

Additional Information/Context

No response

Version used

latest

Environment details (OS name and version, etc.)

windows 10

Describe the feature

We should have a VPC endpoint to connect from the private subnets to Secrets Manager without having internet access, this way is more secure and would avoid the cost of having a NAT gateway for cases when internet access is not required

Use Case

This will be useful for applications stored in AWS lambda that need to connect to an RDS instance where the secrets to connect are stored in Secrets Manager

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

Version used

.

Environment details (OS name and version, etc.)

any!

Describe the feature

I propose switching our CI linting setup, which includes shellcheck, markdownlint, eslint, and others, to use super-linter exclusively for GitHub Actions. super-linter is a comprehensive and centralized linter that supports multiple languages, providing a unified linting experience.

Use Case

There are some benefits of super-linter:

• Unified Linting: super-linter supports a wide range of languages and linters, providing a unified linting solution for our GitHub Actions workflow.

• Easy Configuration: Simplifies configuration by having a single .github/linters configuration file.

• Consistent Output: Standardizes the output format for linting results across different languages and linters.

• Extensibility: Supports adding or customizing linters easily, making it adaptable to our specific requirements.

Proposed Solution

1. Configure super-linter:

   • Create or update the .github/workflows configuration file to specify the linters and configurations needed.

2. GitHub Actions Workflows:

   • Update the GitHub Actions workflow files to use super-linter for linting instead of the actual implementation

3. Testing:

   • Thoroughly test the linting process with super-linter in the GitHub Actions workflow to ensure it covers all relevant languages and provides accurate results. You can test this by submitting a PR

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

Version used

latest

Environment details (OS name and version, etc.)

any

Describe the issue

The current documentation segment "Connecting to the Database" of the directory live/core is outdated and might generate confusions, we should update the correct variable names an proper steps to achieve the connection between the bastion host and the RDS instance

Links

https://github.com/nanlabs/terraform-aws-starter/tree/main/live/core

Describe the feature

We need to dig into new ways of connecting to the private DB Instance to make it easier for the developers to run migrations and more

Use Case

Connect to the database from outside the AWS Console and/or bastion host instance to run migrations and/or simple queries.

Proposed Solution

Use the following new feature!

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

Version used

Environment details (OS name and version, etc.)

any!