Skip to content

Commit a9c0f06

Browse files
RyxiasRyxias
authored
Upgrades terraform modules to Terraform 0.12.9 (#156)
1 parent 3877787 commit a9c0f06

File tree

17 files changed

+388
-245
lines changed

17 files changed

+388
-245
lines changed

‎requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ protobuf==3.6.1
3838
pycparser==2.19
3939
pyfakefs==3.5.7
4040
Pygments==2.3.1
41-
pyhcl==0.3.10
41+
pyhcl==0.4.0
4242
pylint==2.2.2
4343
pyOpenSSL==19.0.0
4444
pyparsing==2.3.1

‎terraform/cloudwatch_dashboard.tf‎

Lines changed: 48 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ locals {
2727
}
2828
EOF
2929

30+
3031
yara_rules = <<EOF
3132
{
3233
"type": "metric",
@@ -45,6 +46,7 @@ EOF
4546
}
4647
EOF
4748

49+
4850
analyzed_binaries = <<EOF
4951
{
5052
"type": "metric",
@@ -61,6 +63,7 @@ EOF
6163
}
6264
EOF
6365

66+
6467
sqs_analyzer = <<EOF
6568
{
6669
"type": "metric",
@@ -78,6 +81,7 @@ EOF
7881
}
7982
EOF
8083

84+
8185
sqs_analyzer_age = <<EOF
8286
{
8387
"type": "metric",
@@ -108,11 +112,12 @@ EOF
108112
}
109113
EOF
110114

115+
111116
// Due to https://github.com/hashicorp/terraform/issues/11574, both ternary branches are always
112117
// computed, so we have to use this special idiom (same as modules/lambda/outputs.tf).
113-
downloader_function_name = "${module.binaryalert_downloader.function_name}"
118+
downloader_function_name = module.binaryalert_downloader.function_name
114119

115-
downloader_queue_name = "${element(concat(aws_sqs_queue.downloader_queue.*.name, list("")), 0)}"
120+
downloader_queue_name = element(concat(aws_sqs_queue.downloader_queue.*.name, [""]), 0)
116121

117122
sqs_downloader = <<EOF
118123
{
@@ -131,6 +136,7 @@ EOF
131136
}
132137
EOF
133138

139+
134140
sqs_downloader_age = <<EOF
135141
{
136142
"type": "metric",
@@ -149,23 +155,37 @@ EOF
149155
"horizontal": [
150156
{
151157
"label": "Max",
152-
"value": "${element(concat(aws_sqs_queue.downloader_queue.*.message_retention_seconds, list("")), 0)}"
158+
"value": "${element(
159+
concat(
160+
aws_sqs_queue.downloader_queue.*.message_retention_seconds,
161+
[""],
162+
),
163+
0,
164+
)}"
153165
},
154166
{
155167
"label": "Alarm",
156-
"value": "${element(concat(aws_cloudwatch_metric_alarm.downloader_sqs_age.*.threshold, list("")), 0)}"
168+
"value": "${element(
169+
concat(
170+
aws_cloudwatch_metric_alarm.downloader_sqs_age.*.threshold,
171+
[""],
172+
),
173+
0,
174+
)}"
157175
}
158176
]
159177
}
160178
}
161179
}
162180
EOF
163181

164-
downloader = <<EOF
182+
183+
downloader = <<EOF
165184
,[".", ".", ".", "${local.downloader_function_name}", {"label": "Downloader"}]
166185
EOF
167186

168-
lambda_invocations = <<EOF
187+
188+
lambda_invocations = <<EOF
169189
{
170190
"type": "metric",
171191
"width": 12,
@@ -185,7 +205,8 @@ EOF
185205
}
186206
EOF
187207

188-
max_lambda_duration = <<EOF
208+
209+
max_lambda_duration = <<EOF
189210
{
190211
"type": "metric",
191212
"width": 12,
@@ -213,7 +234,8 @@ EOF
213234
}
214235
EOF
215236

216-
lambda_errors = <<EOF
237+
238+
lambda_errors = <<EOF
217239
{
218240
"type": "metric",
219241
"width": 12,
@@ -233,7 +255,8 @@ EOF
233255
}
234256
EOF
235257

236-
lambda_throttles = <<EOF
258+
259+
lambda_throttles = <<EOF
237260
{
238261
"type": "metric",
239262
"width": 12,
@@ -253,7 +276,8 @@ EOF
253276
}
254277
EOF
255278

256-
s3_download_latency = <<EOF
279+
280+
s3_download_latency = <<EOF
257281
{
258282
"type": "metric",
259283
"width": 12,
@@ -269,7 +293,8 @@ EOF
269293
}
270294
EOF
271295

272-
sns_publications = <<EOF
296+
297+
sns_publications = <<EOF
273298
{
274299
"type": "metric",
275300
"width": 12,
@@ -289,11 +314,13 @@ EOF
289314
}
290315
EOF
291316

292-
downloader_logs = <<EOF
317+
318+
downloader_logs = <<EOF
293319
,[".", ".", ".", "/aws/lambda/${local.downloader_function_name}", {"label": "Downloader"}]
294320
EOF
295321

296-
log_bytes = <<EOF
322+
323+
log_bytes = <<EOF
297324
{
298325
"type": "metric",
299326
"width": 12,
@@ -314,7 +341,8 @@ EOF
314341
}
315342
EOF
316343

317-
dashboard_body_without_downloader = <<EOF
344+
345+
dashboard_body_without_downloader = <<EOF
318346
{
319347
"widgets": [
320348
${local.s3_bucket_stats}, ${local.yara_rules},
@@ -327,7 +355,8 @@ EOF
327355
}
328356
EOF
329357

330-
dashboard_body_with_downloader = <<EOF
358+
359+
dashboard_body_with_downloader = <<EOF
331360
{
332361
"widgets": [
333362
${local.s3_bucket_stats}, ${local.yara_rules},
@@ -341,13 +370,15 @@ EOF
341370
}
342371
EOF
343372

344-
dashboard_body = "${var.enable_carbon_black_downloader ? local.dashboard_body_with_downloader : local.dashboard_body_without_downloader}"
373+
374+
dashboard_body = var.enable_carbon_black_downloader ? local.dashboard_body_with_downloader : local.dashboard_body_without_downloader
345375
}
346376

347377
resource "aws_cloudwatch_dashboard" "binaryalert" {
348378
dashboard_name = "BinaryAlert"
349379

350380
// Terraform automatically converts numbers to strings when putting them in a list.
351381
// We have to strip quotes around numbers, so that {"value": "123"} turns into {"value": 123}
352-
dashboard_body = "${replace(local.dashboard_body, "/\"([0-9]+)\"/", "$1")}"
382+
dashboard_body = replace(local.dashboard_body, "/\"([0-9]+)\"/", "$1")
353383
}
384+

‎terraform/cloudwatch_metric_alarm.tf‎

Lines changed: 44 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,13 @@
22

33
locals {
44
// Use the existing SNS alarm topic if specified, otherwise use the created one
5-
alarm_target = "${element(concat(aws_sns_topic.metric_alarms.*.arn, list(var.metric_alarm_sns_topic_arn)), 0)}"
5+
alarm_target = element(
6+
concat(
7+
aws_sns_topic.metric_alarms.*.arn,
8+
[var.metric_alarm_sns_topic_arn],
9+
),
10+
0,
11+
)
612
}
713

814
// The production BinaryAlert analyzer is not analyzing binaries.
@@ -15,17 +21,19 @@ ${module.binaryalert_analyzer.function_name} is not analyzing any binaries!
1521
- Binaries may not be arriving in the S3 bucket.
1622
EOF
1723

24+
1825
namespace = "BinaryAlert"
1926
metric_name = "AnalyzedBinaries"
2027
statistic = "Sum"
2128

2229
// No binaries analyzed for a while.
23-
comparison_operator = "LessThanOrEqualToThreshold"
24-
threshold = 0
25-
period = "${format("%d", var.expected_analysis_frequency_minutes * 60)}"
26-
evaluation_periods = 1
27-
alarm_actions = ["${local.alarm_target}"]
28-
insufficient_data_actions = ["${local.alarm_target}"]
30+
comparison_operator = "LessThanOrEqualToThreshold"
31+
threshold = 0
32+
period = format("%d", var.expected_analysis_frequency_minutes * 60)
33+
evaluation_periods = 1
34+
35+
alarm_actions = [local.alarm_target]
36+
insufficient_data_actions = [local.alarm_target]
2937
}
3038

3139
// The analyzer SQS queue is falling behind.
@@ -39,48 +47,52 @@ messages are reaching 75% of the queue retention and may be expired soon.
3947
- Consider raising the retention period for this queue
4048
EOF
4149

50+
4251
namespace = "AWS/SQS"
4352
metric_name = "ApproximateAgeOfOldestMessage"
4453
statistic = "Minimum"
4554

4655
dimensions = {
47-
QueueName = "${aws_sqs_queue.analyzer_queue.name}"
56+
QueueName = aws_sqs_queue.analyzer_queue.name
4857
}
4958

50-
comparison_operator = "GreaterThanThreshold"
51-
threshold = "${format("%d", ceil(var.analyze_queue_retention_secs * 0.75))}"
52-
period = 60
53-
evaluation_periods = 10
54-
alarm_actions = ["${local.alarm_target}"]
55-
insufficient_data_actions = ["${local.alarm_target}"]
59+
comparison_operator = "GreaterThanThreshold"
60+
threshold = format("%d", ceil(var.analyze_queue_retention_secs * 0.75))
61+
period = 60
62+
evaluation_periods = 10
63+
64+
alarm_actions = [local.alarm_target]
65+
insufficient_data_actions = [local.alarm_target]
5666
}
5767

5868
// The downloader SQS queue is falling behind.
5969
resource "aws_cloudwatch_metric_alarm" "downloader_sqs_age" {
60-
count = "${var.enable_carbon_black_downloader ? 1 : 0}"
61-
alarm_name = "${aws_sqs_queue.downloader_queue.name}_old_age"
70+
count = var.enable_carbon_black_downloader ? 1 : 0
71+
alarm_name = "${aws_sqs_queue.downloader_queue[0].name}_old_age"
6272

6373
alarm_description = <<EOF
64-
The queue ${aws_sqs_queue.downloader_queue.name} is not being processed quickly enough:
74+
The queue ${aws_sqs_queue.downloader_queue[0].name} is not being processed quickly enough:
6575
messages are reaching 75% of the queue retention and may be expired soon.
6676
- Consider increasing the lambda_download_concurrency_limit to process more events
6777
- Consider raising the retention period for this queue
6878
EOF
6979

80+
7081
namespace = "AWS/SQS"
7182
metric_name = "ApproximateAgeOfOldestMessage"
7283
statistic = "Minimum"
7384

7485
dimensions = {
75-
QueueName = "${aws_sqs_queue.downloader_queue.name}"
86+
QueueName = aws_sqs_queue.downloader_queue[0].name
7687
}
7788

78-
comparison_operator = "GreaterThanThreshold"
79-
threshold = "${format("%d", ceil(var.download_queue_retention_secs * 0.75))}"
80-
period = 60
81-
evaluation_periods = 10
82-
alarm_actions = ["${local.alarm_target}"]
83-
insufficient_data_actions = ["${local.alarm_target}"]
89+
comparison_operator = "GreaterThanThreshold"
90+
threshold = format("%d", ceil(var.download_queue_retention_secs * 0.75))
91+
period = 60
92+
evaluation_periods = 10
93+
94+
alarm_actions = [local.alarm_target]
95+
insufficient_data_actions = [local.alarm_target]
8496
}
8597

8698
// There are very few YARA rules.
@@ -92,6 +104,7 @@ The number of YARA rules in BinaryAlert is surprisingly low.
92104
Check if a recent deploy accidentally removed most YARA rules.
93105
EOF
94106

107+
95108
namespace = "BinaryAlert"
96109
metric_name = "YaraRules"
97110
statistic = "Maximum"
@@ -101,7 +114,8 @@ EOF
101114
threshold = 5
102115
period = 300
103116
evaluation_periods = 1
104-
alarm_actions = ["${local.alarm_target}"]
117+
118+
alarm_actions = [local.alarm_target]
105119
}
106120

107121
// Dynamo requests are being throttled.
@@ -117,17 +131,20 @@ Read or write requests to the BinaryAlert DynamoDB table are being throttled.
117131
- If this is normal/expected behavior, increase the dynamo_read_capacity in the BinaryAlet config.
118132
EOF
119133

134+
120135
namespace = "AWS/DynamoDB"
121136
metric_name = "ThrottledRequests"
122137
statistic = "Sum"
123138

124139
dimensions = {
125-
TableName = "${aws_dynamodb_table.binaryalert_yara_matches.name}"
140+
TableName = aws_dynamodb_table.binaryalert_yara_matches.name
126141
}
127142

128143
comparison_operator = "GreaterThanThreshold"
129144
threshold = 0
130145
period = 60
131146
evaluation_periods = 1
132-
alarm_actions = ["${local.alarm_target}"]
147+
148+
alarm_actions = [local.alarm_target]
133149
}
150+

‎terraform/dynamo.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ resource "aws_dynamodb_table" "binaryalert_yara_matches" {
33
name = "${var.name_prefix}_binaryalert_matches"
44
hash_key = "SHA256"
55
range_key = "AnalyzerVersion"
6-
read_capacity = "${var.dynamo_read_capacity}"
7-
write_capacity = "${var.dynamo_write_capacity}"
6+
read_capacity = var.dynamo_read_capacity
7+
write_capacity = var.dynamo_write_capacity
88

99
// Only attributes used as hash/range keys are defined here.
1010
attribute {
@@ -22,7 +22,8 @@ resource "aws_dynamodb_table" "binaryalert_yara_matches" {
2222
enabled = true
2323
}
2424

25-
tags {
26-
Name = "${var.tagged_name}"
25+
tags = {
26+
Name = var.tagged_name
2727
}
2828
}
29+

0 commit comments

Comments
 (0)