Infrastructure release: 1.2.37

[patheard]

Summary

Update Production infrastructure with the new CloudWatch error alarm metric filter which will suppress 403 errors triggered by fuzzing attacks.

Related

• chore: ignore HTTP 403 errors #1481

[github-actions]

Production: load-balancer

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_s3_bucket.cloudfront_logs

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_s3_bucket.cloudfront_logs will be updated in-place
  ~ resource "aws_s3_bucket" "cloudfront_logs" {
        id                          = "wordpress-fargate-production-cloudfront-logs"
        tags                        = {}
        # (11 unchanged attributes hidden)

      ~ lifecycle_rule {
            id                                     = "tf-s3-lifecycle-20211214191202112600000003"
            tags                                   = {}
            # (2 unchanged attributes hidden)

          ~ expiration {
              ~ expired_object_delete_marker = false -> true
                # (1 unchanged attribute hidden)
            }

            # (1 unchanged block hidden)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.cloudfront_logs,
  on s3.tf line 4, in resource "aws_s3_bucket" "cloudfront_logs":
   4: resource "aws_s3_bucket" "cloudfront_logs" {

Use the aws_s3_bucket_server_side_encryption_configuration resource instead

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.wordpress_cloudfront"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.wordpress_new[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.wordpress_new_cloudfront[0]"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudfront_distribution.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cache_buster"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.firehose_waf_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.firehose_waf_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_user.cache_buster"]
WARN - plan.json - main - Missing Common Tags: ["aws_lb.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_lb_listener.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_lb_target_group.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_s3_bucket.cloudfront_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_web_acl.wordpress_waf"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_web_acl.wordpress_waf_alb"]

32 tests, 17 passed, 15 warnings, 0 failures, 0 exceptions

[github-actions]

Production: alarms

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_cloudwatch_log_metric_filter.wordpress_errors

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudwatch_log_metric_filter.wordpress_errors will be updated in-place
  ~ resource "aws_cloudwatch_log_metric_filter" "wordpress_errors" {
        id             = "WordPressErrors"
        name           = "WordPressErrors"
      ~ pattern        = "[(w1=\"*Failed*\" || w1=\"*failed*\" || w1=\"*Error*\" || w1=\"*error*\" || w1=\"*Fatal*\" || w1=\"*fatal*\") && w1!=\"*AH01276*\" && w1!=\"*AH01630*\" && w1!=\"*AH01797*\" && w1!=\"*action=lostpassword&error*\" && w1!=\"*database error*\" && w1!=\"*GET /notification-gc-notify/wp-json/wp/v2/pages*\" && w1!=\"*HTTP/1.1\\\" 404*\"]" -> "[(w1=\"*Failed*\" || w1=\"*failed*\" || w1=\"*Error*\" || w1=\"*error*\" || w1=\"*Fatal*\" || w1=\"*fatal*\") && w1!=\"*AH01276*\" && w1!=\"*AH01630*\" && w1!=\"*AH01797*\" && w1!=\"*action=lostpassword&error*\" && w1!=\"*database error*\" && w1!=\"*GET /notification-gc-notify/wp-json/wp/v2/pages*\" && w1!=\"*HTTP/1.1\\\" 403*\" && w1!=\"*HTTP/1.1\\\" 404*\"]"
        # (1 unchanged attribute hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Cloudwatch log metric pattern is invalid: ["aws_cloudwatch_log_metric_filter.wordpress_ecs_warn_error_event"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.alb_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.alb_target_response_time_average"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.alb_target_unhealthy_host"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.cloudfront_4xx_response"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.cloudfront_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.ecs_cpu_utilization"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.ecs_memory_utilization"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.rds_aurora_replica_lag"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.rds_cpu_utilization_reader"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.rds_cpu_utilization_writer"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.rds_freeable_memory_reader"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.rds_freeable_memory_writer"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.route53_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.wordpress_database_errors"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.wordpress_ecs_warn_error_event"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.wordpress_errors"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.wordpress_failed_login"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.wordpress_suspicious_login"]
WARN - plan.json - main...