second first commit
This commit is contained in:
Zakaria
@@ -0,0 +1,705 @@
|
||||
# NOTE: Keep resource definitions in sync with ../compat-terraform/main.tf.
|
||||
# Enforced by .github/ci/compat-opentofu-drift-check.py -- a resource added
|
||||
# here and not there (or vice versa) fails CI unless listed in
|
||||
# .github/ci/compat-opentofu-allowlist-tf-only.txt (or -otf-only.txt for the
|
||||
# reverse direction) as a deliberate gap. Currently allowlisted: Application
|
||||
# Auto Scaling, RDS, the CloudWatch alarm, the IAM managed-policy-attach
|
||||
# path, IAM tag coverage, and the GuardDuty org feature -- see the allowlist
|
||||
# files and https://github.com/floci-io/floci/issues/2263 for status.
|
||||
|
||||
# ── S3 Bucket ──────────────────────────────────────────────────────────────
|
||||
resource "aws_s3_bucket" "app" {
|
||||
bucket = "floci-compat-app"
|
||||
force_destroy = true
|
||||
}
|
||||
|
||||
resource "aws_s3_bucket_versioning" "app" {
|
||||
bucket = aws_s3_bucket.app.id
|
||||
versioning_configuration {
|
||||
status = "Enabled"
|
||||
}
|
||||
}
|
||||
|
||||
# A 12 MiB file with a declared checksum algorithm: the provider uploads it through the SDK transfer
|
||||
# manager as a multipart upload (5 MiB parts), so S3 stores a COMPOSITE checksum and a multipart ETag.
|
||||
# The file is generated by the test setup (see test/*.bats) and is not committed.
|
||||
resource "aws_s3_object" "large" {
|
||||
bucket = aws_s3_bucket.app.id
|
||||
key = "large/multipart.bin"
|
||||
source = "${path.module}/large-object.bin"
|
||||
checksum_algorithm = "SHA256"
|
||||
|
||||
depends_on = [aws_s3_bucket_versioning.app]
|
||||
}
|
||||
|
||||
# ── SQS Queue ──────────────────────────────────────────────────────────────
|
||||
resource "aws_sqs_queue" "jobs" {
|
||||
name = "floci-compat-jobs"
|
||||
visibility_timeout_seconds = 30
|
||||
message_retention_seconds = 86400
|
||||
}
|
||||
|
||||
resource "aws_sqs_queue" "jobs_dlq" {
|
||||
name = "floci-compat-jobs-dlq"
|
||||
}
|
||||
|
||||
resource "aws_sqs_queue_redrive_policy" "jobs" {
|
||||
queue_url = aws_sqs_queue.jobs.id
|
||||
redrive_policy = jsonencode({
|
||||
deadLetterTargetArn = aws_sqs_queue.jobs_dlq.arn
|
||||
maxReceiveCount = 3
|
||||
})
|
||||
}
|
||||
|
||||
# ── SNS Topic ──────────────────────────────────────────────────────────────
|
||||
resource "aws_sns_topic" "events" {
|
||||
name = "floci-compat-events"
|
||||
}
|
||||
|
||||
resource "aws_sns_topic_subscription" "events_to_sqs" {
|
||||
topic_arn = aws_sns_topic.events.arn
|
||||
protocol = "sqs"
|
||||
endpoint = aws_sqs_queue.jobs.arn
|
||||
}
|
||||
|
||||
# ── DynamoDB Table ─────────────────────────────────────────────────────────
|
||||
resource "aws_dynamodb_table" "items" {
|
||||
name = "floci-compat-items"
|
||||
billing_mode = "PAY_PER_REQUEST"
|
||||
hash_key = "pk"
|
||||
range_key = "sk"
|
||||
|
||||
attribute {
|
||||
name = "pk"
|
||||
type = "S"
|
||||
}
|
||||
|
||||
attribute {
|
||||
name = "sk"
|
||||
type = "S"
|
||||
}
|
||||
|
||||
ttl {
|
||||
attribute_name = "expires_at"
|
||||
enabled = true
|
||||
}
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
# ── IAM Role (for Lambda) ──────────────────────────────────────────────────
|
||||
resource "aws_iam_role" "lambda_exec" {
|
||||
name = "floci-compat-lambda-exec"
|
||||
|
||||
assume_role_policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [{
|
||||
Action = "sts:AssumeRole"
|
||||
Effect = "Allow"
|
||||
Principal = { Service = "lambda.amazonaws.com" }
|
||||
}]
|
||||
})
|
||||
}
|
||||
|
||||
# ── ECR Repository ─────────────────────────────────────────────────────────
|
||||
resource "aws_ecr_repository" "app" {
|
||||
name = "floci-compat-app"
|
||||
image_tag_mutability = "MUTABLE"
|
||||
|
||||
image_scanning_configuration {
|
||||
scan_on_push = false
|
||||
}
|
||||
}
|
||||
|
||||
# ── ECS Cluster ─────────────────────────────────────────────────────────────
|
||||
resource "aws_ecs_cluster" "app" {
|
||||
name = "floci-compat-cluster"
|
||||
}
|
||||
|
||||
# ── KMS Key ─────────────────────────────────────────────────────────────────
|
||||
resource "aws_kms_key" "compat" {
|
||||
description = "Floci OpenTofu compatibility key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = false
|
||||
}
|
||||
|
||||
# ── Kinesis Stream ──────────────────────────────────────────────────────────
|
||||
resource "aws_kinesis_stream" "events" {
|
||||
name = "floci-compat-events"
|
||||
shard_count = 1
|
||||
retention_period = 24
|
||||
}
|
||||
|
||||
# ── CloudWatch Log Group ────────────────────────────────────────────────────
|
||||
resource "aws_cloudwatch_log_group" "app" {
|
||||
name = "/floci/compat/app"
|
||||
retention_in_days = 1
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
# ── EventBridge Event Bus ───────────────────────────────────────────────────
|
||||
resource "aws_cloudwatch_event_bus" "compat" {
|
||||
name = "floci-compat-bus"
|
||||
}
|
||||
|
||||
# ── Step Functions State Machine ────────────────────────────────────────────
|
||||
resource "aws_sfn_state_machine" "compat" {
|
||||
name = "floci-compat-state-machine"
|
||||
role_arn = aws_iam_role.lambda_exec.arn
|
||||
definition = jsonencode({
|
||||
Comment = "Floci OpenTofu compatibility state machine"
|
||||
StartAt = "Pass"
|
||||
States = {
|
||||
Pass = {
|
||||
Type = "Pass"
|
||||
End = true
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
# ── CloudFormation Stack ────────────────────────────────────────────────────
|
||||
resource "aws_cloudformation_stack" "compat" {
|
||||
name = "floci-compat-stack"
|
||||
template_body = jsonencode({
|
||||
Resources = {
|
||||
CompatBucket = {
|
||||
Type = "AWS::S3::Bucket"
|
||||
Properties = {
|
||||
BucketName = "floci-compat-cfn-bucket"
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
# ── EKS Cluster ─────────────────────────────────────────────────────────────
|
||||
resource "aws_eks_cluster" "compat" {
|
||||
name = "floci-compat-eks"
|
||||
role_arn = aws_iam_role.lambda_exec.arn
|
||||
|
||||
vpc_config {
|
||||
subnet_ids = [aws_subnet.compat.id]
|
||||
}
|
||||
}
|
||||
|
||||
# ── API Gateway v2 ──────────────────────────────────────────────────────────
|
||||
resource "aws_apigatewayv2_api" "compat" {
|
||||
name = "floci-compat-http-api"
|
||||
protocol_type = "HTTP"
|
||||
}
|
||||
|
||||
# ── AppConfig Application ───────────────────────────────────────────────────
|
||||
resource "aws_appconfig_application" "compat" {
|
||||
name = "floci-compat-appconfig"
|
||||
description = "Floci OpenTofu compatibility application"
|
||||
}
|
||||
|
||||
# ── AWS Backup Vault ─────────────────────────────────────────────────────────
|
||||
resource "aws_backup_vault" "compat" {
|
||||
name = "floci-compat-vault"
|
||||
}
|
||||
|
||||
# ── Cloud Map Namespace ─────────────────────────────────────────────────────
|
||||
resource "aws_service_discovery_private_dns_namespace" "compat" {
|
||||
name = "floci-compat.internal"
|
||||
description = "Floci OpenTofu compatibility namespace"
|
||||
vpc = aws_vpc.compat.id
|
||||
}
|
||||
|
||||
# ── CodeDeploy Application ──────────────────────────────────────────────────
|
||||
resource "aws_codedeploy_app" "compat" {
|
||||
name = "floci-compat-codedeploy"
|
||||
compute_platform = "Server"
|
||||
}
|
||||
|
||||
# ── ACM Certificate ─────────────────────────────────────────────────────────
|
||||
resource "aws_acm_certificate" "compat" {
|
||||
domain_name = "floci-compat.internal"
|
||||
validation_method = "DNS"
|
||||
}
|
||||
|
||||
# ── SES Email Identity ──────────────────────────────────────────────────────
|
||||
resource "aws_ses_email_identity" "compat" {
|
||||
email = "terraform@floci-compat.internal"
|
||||
}
|
||||
|
||||
# ── EventBridge Scheduler ───────────────────────────────────────────────────
|
||||
resource "aws_scheduler_schedule" "compat" {
|
||||
name = "floci-compat-schedule"
|
||||
schedule_expression = "rate(1 hour)"
|
||||
schedule_expression_timezone = "UTC"
|
||||
|
||||
flexible_time_window {
|
||||
mode = "OFF"
|
||||
}
|
||||
|
||||
target {
|
||||
arn = aws_sqs_queue.jobs.arn
|
||||
role_arn = aws_iam_role.lambda_exec.arn
|
||||
}
|
||||
}
|
||||
|
||||
# ── WAFv2 Web ACL ───────────────────────────────────────────────────────────
|
||||
resource "aws_wafv2_web_acl" "compat" {
|
||||
name = "floci-compat-waf"
|
||||
scope = "REGIONAL"
|
||||
|
||||
default_action {
|
||||
allow {}
|
||||
}
|
||||
|
||||
visibility_config {
|
||||
cloudwatch_metrics_enabled = false
|
||||
metric_name = "flociCompatWaf"
|
||||
sampled_requests_enabled = false
|
||||
}
|
||||
}
|
||||
|
||||
# ── Cost and Usage Report ───────────────────────────────────────────────────
|
||||
resource "aws_cur_report_definition" "compat" {
|
||||
report_name = "floci-compat-report"
|
||||
time_unit = "HOURLY"
|
||||
format = "Parquet"
|
||||
compression = "Parquet"
|
||||
additional_schema_elements = ["RESOURCES"]
|
||||
s3_bucket = aws_s3_bucket.app.bucket
|
||||
s3_prefix = "cur"
|
||||
s3_region = "us-east-1"
|
||||
}
|
||||
|
||||
# ── AppSync GraphQL API ─────────────────────────────────────────────────────
|
||||
resource "aws_appsync_graphql_api" "compat" {
|
||||
name = "floci-compat-graphql"
|
||||
authentication_type = "API_KEY"
|
||||
schema = "type Query { health: String }"
|
||||
}
|
||||
|
||||
# ── ElastiCache Replication Group ───────────────────────────────────────────
|
||||
resource "aws_elasticache_replication_group" "compat" {
|
||||
replication_group_id = "floci-compat-cache"
|
||||
description = "Floci OpenTofu compatibility cache"
|
||||
engine = "redis"
|
||||
node_type = "cache.t3.micro"
|
||||
num_cache_clusters = 1
|
||||
# Deliberately not 6379: that is the bottom of floci's ElastiCache proxy range and the
|
||||
# port it would hand out anyway, so pinning it asserts nothing. A non-default port is
|
||||
# what actually exercises CreateReplicationGroup's Port input, and a mismatch shows up
|
||||
# as permanent drift because Terraform treats the port as replacement-forcing.
|
||||
#
|
||||
# It must also stay above the block the cluster-mode fixture allocates: the bats files
|
||||
# run concurrently and that fixture takes one port per node from the base of the range.
|
||||
port = 6395
|
||||
}
|
||||
|
||||
# ── Firehose Delivery Stream ────────────────────────────────────────────────
|
||||
resource "aws_kinesis_firehose_delivery_stream" "compat" {
|
||||
name = "floci-compat-firehose-basic"
|
||||
destination = "extended_s3"
|
||||
|
||||
extended_s3_configuration {
|
||||
role_arn = aws_iam_role.lambda_exec.arn
|
||||
bucket_arn = aws_s3_bucket.app.arn
|
||||
buffering_size = 5
|
||||
buffering_interval = 60
|
||||
compression_format = "UNCOMPRESSED"
|
||||
}
|
||||
}
|
||||
|
||||
# ── EventBridge Pipe ────────────────────────────────────────────────────────
|
||||
resource "aws_pipes_pipe" "compat" {
|
||||
name = "floci-compat-pipe"
|
||||
role_arn = aws_iam_role.lambda_exec.arn
|
||||
source = aws_sqs_queue.jobs.arn
|
||||
target = aws_sns_topic.events.arn
|
||||
|
||||
source_parameters {
|
||||
sqs_queue_parameters {
|
||||
batch_size = 1
|
||||
maximum_batching_window_in_seconds = 0
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# ── SSM Parameters ─────────────────────────────────────────────────────────
|
||||
resource "aws_ssm_parameter" "db_url" {
|
||||
name = "/floci-compat/db-url"
|
||||
type = "String"
|
||||
value = "jdbc:postgresql://localhost:5432/app"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "api_key" {
|
||||
name = "/floci-compat/api-key"
|
||||
type = "SecureString"
|
||||
value = "super-secret-key"
|
||||
}
|
||||
|
||||
# ── Secrets Manager ────────────────────────────────────────────────────────
|
||||
resource "aws_secretsmanager_secret" "db_creds" {
|
||||
name = "floci-compat/db-creds"
|
||||
}
|
||||
|
||||
resource "aws_secretsmanager_secret_version" "db_creds" {
|
||||
secret_id = aws_secretsmanager_secret.db_creds.id
|
||||
secret_string = jsonencode({
|
||||
username = "admin"
|
||||
password = "s3cret"
|
||||
})
|
||||
}
|
||||
|
||||
# ── Outputs ────────────────────────────────────────────────────────────────
|
||||
output "bucket_id" {
|
||||
value = aws_s3_bucket.app.id
|
||||
}
|
||||
|
||||
output "queue_url" {
|
||||
value = aws_sqs_queue.jobs.url
|
||||
}
|
||||
|
||||
output "topic_arn" {
|
||||
value = aws_sns_topic.events.arn
|
||||
}
|
||||
|
||||
output "table_name" {
|
||||
value = aws_dynamodb_table.items.name
|
||||
}
|
||||
|
||||
output "secret_arn" {
|
||||
value = aws_secretsmanager_secret.db_creds.arn
|
||||
}
|
||||
|
||||
# ── VPC networking (issues #468, #401: VpcAttribute, RouteTableAssociation, DescribeTags) ──
|
||||
resource "aws_vpc" "compat" {
|
||||
cidr_block = "10.0.0.0/16"
|
||||
enable_dns_support = false
|
||||
enable_dns_hostnames = false
|
||||
|
||||
tags = {
|
||||
Name = "floci-compat-vpc"
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_internet_gateway" "compat" {
|
||||
vpc_id = aws_vpc.compat.id
|
||||
|
||||
tags = {
|
||||
Name = "floci-compat-igw"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_subnet" "compat" {
|
||||
vpc_id = aws_vpc.compat.id
|
||||
cidr_block = "10.0.1.0/24"
|
||||
availability_zone = "us-east-1a"
|
||||
|
||||
tags = {
|
||||
Name = "floci-compat-subnet"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_route_table" "compat" {
|
||||
vpc_id = aws_vpc.compat.id
|
||||
|
||||
route {
|
||||
cidr_block = "0.0.0.0/0"
|
||||
gateway_id = aws_internet_gateway.compat.id
|
||||
}
|
||||
|
||||
tags = {
|
||||
Name = "floci-compat-rt"
|
||||
}
|
||||
}
|
||||
|
||||
# Exercises AssociateRouteTable + DescribeRouteTables(association.route-table-association-id)
|
||||
resource "aws_route_table_association" "compat" {
|
||||
subnet_id = aws_subnet.compat.id
|
||||
route_table_id = aws_route_table.compat.id
|
||||
}
|
||||
|
||||
resource "aws_security_group" "compat" {
|
||||
name = "floci-compat-sg"
|
||||
description = "Compat test security group"
|
||||
vpc_id = aws_vpc.compat.id
|
||||
|
||||
ingress {
|
||||
from_port = 80
|
||||
to_port = 80
|
||||
protocol = "tcp"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
egress {
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
tags = {
|
||||
Name = "floci-compat-sg"
|
||||
}
|
||||
}
|
||||
|
||||
output "vpc_id" {
|
||||
value = aws_vpc.compat.id
|
||||
}
|
||||
|
||||
output "subnet_id" {
|
||||
value = aws_subnet.compat.id
|
||||
}
|
||||
|
||||
output "route_table_id" {
|
||||
value = aws_route_table.compat.id
|
||||
}
|
||||
|
||||
output "security_group_id" {
|
||||
value = aws_security_group.compat.id
|
||||
}
|
||||
|
||||
# ── Route53 ────────────────────────────────────────────────────────────────
|
||||
resource "aws_route53_zone" "compat" {
|
||||
name = "floci-compat.internal"
|
||||
force_destroy = true
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_route53_record" "app" {
|
||||
zone_id = aws_route53_zone.compat.zone_id
|
||||
name = "app.floci-compat.internal"
|
||||
type = "A"
|
||||
ttl = 300
|
||||
records = ["10.0.1.10"]
|
||||
}
|
||||
|
||||
resource "aws_route53_health_check" "app" {
|
||||
fqdn = "app.floci-compat.internal"
|
||||
port = 80
|
||||
type = "HTTP"
|
||||
resource_path = "/health"
|
||||
failure_threshold = 3
|
||||
request_interval = 30
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
output "zone_id" {
|
||||
value = aws_route53_zone.compat.zone_id
|
||||
}
|
||||
|
||||
output "health_check_id" {
|
||||
value = aws_route53_health_check.app.id
|
||||
}
|
||||
|
||||
# ── Cognito User Pool ─────────────────────────────────────────────────────
|
||||
resource "aws_cognito_user_pool" "pool" {
|
||||
name = "floci-compat-pool"
|
||||
|
||||
password_policy {
|
||||
minimum_length = 12
|
||||
require_lowercase = true
|
||||
require_numbers = true
|
||||
require_symbols = true
|
||||
require_uppercase = true
|
||||
}
|
||||
|
||||
auto_verified_attributes = ["email"]
|
||||
username_attributes = ["email"]
|
||||
|
||||
admin_create_user_config {
|
||||
allow_admin_create_user_only = false
|
||||
}
|
||||
|
||||
verification_message_template {
|
||||
default_email_option = "CONFIRM_WITH_CODE"
|
||||
email_message = "Your code is {####}"
|
||||
email_subject = "Verify your account"
|
||||
}
|
||||
|
||||
account_recovery_setting {
|
||||
recovery_mechanism {
|
||||
name = "verified_email"
|
||||
priority = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output "user_pool_id" {
|
||||
value = aws_cognito_user_pool.pool.id
|
||||
}
|
||||
|
||||
output "user_pool_arn" {
|
||||
value = aws_cognito_user_pool.pool.arn
|
||||
}
|
||||
|
||||
# ── Cognito User Pool Client ──────────────────────────────────────────────
|
||||
resource "aws_cognito_user_pool_client" "client" {
|
||||
name = "floci-compat-pool-client"
|
||||
user_pool_id = aws_cognito_user_pool.pool.id
|
||||
}
|
||||
|
||||
# ── Kinesis Firehose Delivery Stream (extended_s3, issue #1043) ───────────
|
||||
resource "aws_kinesis_firehose_delivery_stream" "events" {
|
||||
name = "floci-compat-firehose"
|
||||
destination = "extended_s3"
|
||||
|
||||
extended_s3_configuration {
|
||||
role_arn = aws_iam_role.lambda_exec.arn
|
||||
bucket_arn = aws_s3_bucket.app.arn
|
||||
prefix = "events/data/"
|
||||
error_output_prefix = "events/errors/"
|
||||
compression_format = "GZIP"
|
||||
buffering_size = 64
|
||||
buffering_interval = 120
|
||||
}
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
output "firehose_stream_arn" {
|
||||
value = aws_kinesis_firehose_delivery_stream.events.arn
|
||||
}
|
||||
|
||||
# ── SES Receipt Rule Set ───────────────────────────────────────────────────
|
||||
# floci stores it inertly (no inbound-mail routing); the management API just round-trips.
|
||||
resource "aws_ses_receipt_rule_set" "compat" {
|
||||
rule_set_name = "floci-compat-rule-set"
|
||||
}
|
||||
|
||||
resource "aws_ses_active_receipt_rule_set" "compat" {
|
||||
rule_set_name = aws_ses_receipt_rule_set.compat.rule_set_name
|
||||
}
|
||||
|
||||
resource "aws_ses_receipt_filter" "compat" {
|
||||
name = "floci-compat-filter"
|
||||
cidr = "10.10.10.0/24"
|
||||
policy = "Block"
|
||||
}
|
||||
|
||||
resource "aws_ses_receipt_rule" "compat" {
|
||||
rule_set_name = aws_ses_receipt_rule_set.compat.rule_set_name
|
||||
name = "floci-compat-rule"
|
||||
enabled = true
|
||||
scan_enabled = true
|
||||
tls_policy = "Optional"
|
||||
recipients = ["compat@example.com"]
|
||||
|
||||
add_header_action {
|
||||
header_name = "X-Floci-Compat"
|
||||
header_value = "true"
|
||||
position = 1
|
||||
}
|
||||
|
||||
sns_action {
|
||||
topic_arn = aws_sns_topic.events.arn
|
||||
position = 2
|
||||
}
|
||||
|
||||
stop_action {
|
||||
scope = "RuleSet"
|
||||
position = 3
|
||||
}
|
||||
}
|
||||
|
||||
output "ses_rule_set_name" {
|
||||
value = aws_ses_receipt_rule_set.compat.rule_set_name
|
||||
}
|
||||
|
||||
output "ses_receipt_rule_name" {
|
||||
value = aws_ses_receipt_rule.compat.name
|
||||
}
|
||||
|
||||
# -- GuardDuty -----------------------------------------------------------------
|
||||
# Detector, per-feature configuration, and organization configuration mirror the
|
||||
# resource set an org security-baseline stack manages. additional_configuration
|
||||
# is an ordered list block: Floci must echo it back in submitted order or every
|
||||
# re-plan proposes a replacement.
|
||||
resource "aws_guardduty_detector" "compat" {
|
||||
enable = true
|
||||
finding_publishing_frequency = "SIX_HOURS"
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_guardduty_detector_feature" "runtime_monitoring" {
|
||||
detector_id = aws_guardduty_detector.compat.id
|
||||
name = "RUNTIME_MONITORING"
|
||||
status = "ENABLED"
|
||||
|
||||
additional_configuration {
|
||||
name = "ECS_FARGATE_AGENT_MANAGEMENT"
|
||||
status = "ENABLED"
|
||||
}
|
||||
|
||||
additional_configuration {
|
||||
name = "EC2_AGENT_MANAGEMENT"
|
||||
status = "ENABLED"
|
||||
}
|
||||
|
||||
additional_configuration {
|
||||
name = "EKS_ADDON_MANAGEMENT"
|
||||
status = "DISABLED"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_guardduty_organization_configuration" "compat" {
|
||||
detector_id = aws_guardduty_detector.compat.id
|
||||
auto_enable_organization_members = "ALL"
|
||||
}
|
||||
|
||||
output "guardduty_detector_id" {
|
||||
value = aws_guardduty_detector.compat.id
|
||||
}
|
||||
|
||||
output "large_object_checksum_sha256" {
|
||||
value = aws_s3_object.large.checksum_sha256
|
||||
}
|
||||
|
||||
# -- Transfer Family Server (issue #2802) --------------------------------------
|
||||
# Never stopped, so destroy exercises DeleteServer against an ONLINE server.
|
||||
resource "aws_transfer_server" "compat" {
|
||||
protocols = ["SFTP"]
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
output "transfer_server_id" {
|
||||
value = aws_transfer_server.compat.id
|
||||
}
|
||||
|
||||
# -- CloudTrail Trail (issue #2800) --------------------------------------------
|
||||
# The provider sends tags inside CreateTrail and reads them back with ListTags on
|
||||
# every refresh, so this covers the post-create tag refresh path end to end.
|
||||
resource "aws_s3_bucket" "trail_logs" {
|
||||
bucket = "floci-compat-trail-logs"
|
||||
force_destroy = true
|
||||
}
|
||||
|
||||
resource "aws_cloudtrail" "compat" {
|
||||
name = "floci-compat-trail"
|
||||
s3_bucket_name = aws_s3_bucket.trail_logs.id
|
||||
|
||||
tags = {
|
||||
Environment = "compat-test"
|
||||
}
|
||||
}
|
||||
|
||||
output "cloudtrail_arn" {
|
||||
value = aws_cloudtrail.compat.arn
|
||||
}
|
||||
Reference in New Issue
Block a user