Skip to content

fix: Added Deny for CreateLogGroup action in EKS cluster role#1594

Merged
antonbabenko merged 3 commits into
terraform-aws-modules:masterfrom
haarchri:fix/920-cw-loggroup
Nov 2, 2021
Merged

fix: Added Deny for CreateLogGroup action in EKS cluster role#1594
antonbabenko merged 3 commits into
terraform-aws-modules:masterfrom
haarchri:fix/920-cw-loggroup

Conversation

@haarchri

@haarchri haarchri commented Sep 21, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor

Signed-off-by: Christopher Haar chhaar30@googlemail.com

PR o'clock

Description

cloudwatch log group now gets auto destroyed with new iam policy deny for create log group in eks cluster role

Fixes: #920

Checklist

@haarchri haarchri mentioned this pull request Sep 21, 2021
Closed
4 tasks
@stale

stale Bot commented Oct 21, 2021

Copy link
Copy Markdown

This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
To track this PR (even if closed), please open a corresponding issue if one does not already exist.

@stale stale Bot added the stale label Oct 21, 2021
navaati
navaati approved these changes Oct 21, 2021
View reviewed changes

@navaati navaati left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, this does fix #920, thanks for writing this patch.

Comment thread main.tf
actions = [
"logs:CreateLogGroup"
]
resources = ["*"]

@navaati navaati Oct 21, 2021

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you have a simple way to do that, you could restrain the policy to just the log group that would be created, to make the change even smaller. Not strictly necessary tho.

@stale stale Bot removed the stale label Oct 21, 2021
@daroga0002

daroga0002 commented Nov 2, 2021

Copy link
Copy Markdown
Contributor

@haarchri please correct tittle of PR to fix: added deny log group in eks cluster role as CI will fail.

Also seems you using different version of terraform-docs which made some changes in lines 137-147, if possible revert those lines to original.

@haarchri haarchri changed the title fix(cw-loggroup): added deny log group in eks cluster role fix: added deny log group in eks cluster role Nov 2, 2021
@haarchri haarchri force-pushed the fix/920-cw-loggroup branch from e93d207 to aa9aba1 Compare November 2, 2021 11:03
@haarchri
fix(cw-loggroup): added deny in eks cluster role to fix cw-loggroup r…
3cace1f 
…ecreate in cleanup/deletion

Signed-off-by: haarchri <chhaar30@googlemail.com>
@haarchri haarchri force-pushed the fix/920-cw-loggroup branch from aa9aba1 to 3cace1f Compare November 2, 2021 11:06
@haarchri

haarchri commented Nov 2, 2021

Copy link
Copy Markdown
Contributor Author

@daroga0002 rebased and changed readme

daroga0002
daroga0002 approved these changes Nov 2, 2021
View reviewed changes

@daroga0002 daroga0002 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@haarchri thank your for your contribution 🎉

@daroga0002

daroga0002 commented Nov 2, 2021

Copy link
Copy Markdown
Contributor

@antonbabenko lets merge this (I will let you know when we can make release as I still looking into few other PRs)

@antonbabenko antonbabenko changed the title fix: added deny log group in eks cluster role fix: Added Deny for logs:CreateLogGroup action in EKS cluster role Nov 2, 2021
@antonbabenko antonbabenko changed the title fix: Added Deny for logs:CreateLogGroup action in EKS cluster role fix: Added Deny for CreateLogGroup action in EKS cluster role Nov 2, 2021
@antonbabenko antonbabenko merged commit 6959b9b into terraform-aws-modules:master Nov 2, 2021
@Nuru Nuru mentioned this pull request Nov 2, 2021
Closed
@nitrocode nitrocode mentioned this pull request Nov 4, 2021
Merged
antonbabenko pushed a commit that referenced this pull request Nov 22, 2021
@semantic-release-bot
chore(release): version 17.24.0 [skip ci]
e90c877 
# [17.24.0](v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([#1594](#1594)) ([6959b9b](6959b9b))
* update CI/CD process to enable auto-release workflow ([#1698](#1698)) ([b876ff9](b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([#1614](#1614)) ([b7539dc](b7539dc))
* Removed ng_depends_on variable and related hack ([#1672](#1672)) ([56e93d7](56e93d7))
@antonbabenko

antonbabenko commented Nov 22, 2021

Copy link
Copy Markdown
Member

This PR is included in version 17.24.0 🎉

astech-mweber3 pushed a commit to spring-media/terraform-aws-eks that referenced this pull request Dec 1, 2021
@haarchri
fix: Added Deny for CreateLogGroup action in EKS cluster role (terraf…
1aa5fe0 
…orm-aws-modules#1594)
astech-mweber3 pushed a commit to spring-media/terraform-aws-eks that referenced this pull request Dec 1, 2021
@semantic-release-bot
chore(release): version 17.24.0 [skip ci]
dfde867 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([terraform-aws-modules#1594](terraform-aws-modules#1594)) ([6959b9b](terraform-aws-modules@6959b9b))
* update CI/CD process to enable auto-release workflow ([terraform-aws-modules#1698](terraform-aws-modules#1698)) ([b876ff9](terraform-aws-modules@b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([terraform-aws-modules#1614](terraform-aws-modules#1614)) ([b7539dc](terraform-aws-modules@b7539dc))
* Removed ng_depends_on variable and related hack ([terraform-aws-modules#1672](terraform-aws-modules#1672)) ([56e93d7](terraform-aws-modules@56e93d7))
bryantbiggs pushed a commit to bryantbiggs/terraform-aws-eks that referenced this pull request Dec 13, 2021
@semantic-release-bot @bryantbiggs
chore(release): version 17.24.0 [skip ci]
15d7c9f 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([terraform-aws-modules#1594](terraform-aws-modules#1594)) ([6959b9b](terraform-aws-modules@6959b9b))
* update CI/CD process to enable auto-release workflow ([terraform-aws-modules#1698](terraform-aws-modules#1698)) ([b876ff9](terraform-aws-modules@b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([terraform-aws-modules#1614](terraform-aws-modules#1614)) ([b7539dc](terraform-aws-modules@b7539dc))
* Removed ng_depends_on variable and related hack ([terraform-aws-modules#1672](terraform-aws-modules#1672)) ([56e93d7](terraform-aws-modules@56e93d7))
bryantbiggs pushed a commit to bryantbiggs/terraform-aws-eks that referenced this pull request Dec 13, 2021
@semantic-release-bot @bryantbiggs
chore(release): version 17.24.0 [skip ci]
32a1803 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([terraform-aws-modules#1594](terraform-aws-modules#1594)) ([6959b9b](terraform-aws-modules@6959b9b))
* update CI/CD process to enable auto-release workflow ([terraform-aws-modules#1698](terraform-aws-modules#1698)) ([b876ff9](terraform-aws-modules@b876ff9))

### Features

* Add ability to define custom timeout for fargate profiles ([terraform-aws-modules#1614](terraform-aws-modules#1614)) ([b7539dc](terraform-aws-modules@b7539dc))
* Removed ng_depends_on variable and related hack ([terraform-aws-modules#1672](terraform-aws-modules#1672)) ([56e93d7](terraform-aws-modules@56e93d7))
@JoelOtter

JoelOtter commented Mar 18, 2022

Copy link
Copy Markdown

To anyone landing on this confused like I was about whether this breaks compatibility with Fluent Bit: the IAM role you want to attach the CloudWatch policy to is the node role, not the cluster role.

@bryantbiggs bryantbiggs mentioned this pull request Mar 29, 2022
Merged
3 tasks
baibailiha added a commit to baibailiha/terraform-aws-eks that referenced this pull request Sep 13, 2022
@baibailiha @semantic-release-bot
chore(release): version 17.24.0 [skip ci]
1cb3060 
# [17.24.0](terraform-aws-modules/terraform-aws-eks@v17.23.0...v17.24.0) (2021-11-22)

### Bug Fixes

* Added Deny for CreateLogGroup action in EKS cluster role ([#1594](terraform-aws-modules/terraform-aws-eks#1594)) ([d240238](terraform-aws-modules/terraform-aws-eks@d240238))
* update CI/CD process to enable auto-release workflow ([#1698](terraform-aws-modules/terraform-aws-eks#1698)) ([cd93161](terraform-aws-modules/terraform-aws-eks@cd93161))

### Features

* Add ability to define custom timeout for fargate profiles ([#1614](terraform-aws-modules/terraform-aws-eks#1614)) ([43b675b](terraform-aws-modules/terraform-aws-eks@43b675b))
* Removed ng_depends_on variable and related hack ([#1672](terraform-aws-modules/terraform-aws-eks#1672)) ([e610b83](terraform-aws-modules/terraform-aws-eks@e610b83))
@github-actions

github-actions Bot commented Nov 9, 2022

Copy link
Copy Markdown

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Nov 9, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@antonbabenko antonbabenko Awaiting requested review from antonbabenko

2 more reviewers

@navaati navaati navaati approved these changes

@daroga0002 daroga0002 daroga0002 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Cloudwatch Log Group created with options does not get auto destroyed

5 participants

@haarchri @daroga0002 @antonbabenko @JoelOtter @navaati
⚡