From 005f90228db76864339310303a43e0a822736b79 Mon Sep 17 00:00:00 2001 From: Vuong Date: Sat, 21 Oct 2023 11:03:43 +0700 Subject: [PATCH 1/5] Enable mainnet value for bugsnag --- indexer/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/indexer/variables.tf b/indexer/variables.tf index 192754c4..b6bd2529 100644 --- a/indexer/variables.tf +++ b/indexer/variables.tf @@ -71,7 +71,7 @@ variable "bugsnag_release_stage" { validation { condition = contains( - ["development", "staging", "testnet"], + ["development", "staging", "testnet", "mainnet"], var.bugsnag_release_stage ) error_message = "Err: invalid bugsnag release stage. Must be one of {development | staging | testnet}." From 44fe12af6c7dcc43a853f882a9c13fc19ed65b2d Mon Sep 17 00:00:00 2001 From: Vuong Date: Sat, 21 Oct 2023 16:53:05 +0700 Subject: [PATCH 2/5] Add mainnet to description of bugsnag --- indexer/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/indexer/variables.tf b/indexer/variables.tf index b6bd2529..b2dd8d6c 100644 --- a/indexer/variables.tf +++ b/indexer/variables.tf @@ -74,7 +74,7 @@ variable "bugsnag_release_stage" { ["development", "staging", "testnet", "mainnet"], var.bugsnag_release_stage ) - error_message = "Err: invalid bugsnag release stage. Must be one of {development | staging | testnet}." + error_message = "Err: invalid bugsnag release stage. Must be one of {development | staging | testnet | mainnet}." } } From 9524279cc7a3c572afc67c46b27871c83d947a5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Piotr=20=C5=9Awi=C4=99s?= <10480513+pswies@users.noreply.github.com> Date: Thu, 8 Feb 2024 10:04:31 +0100 Subject: [PATCH 3/5] Configure Amplitude API gw for dydxopsdao --- amplitude_api_gateway/providers.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/amplitude_api_gateway/providers.tf b/amplitude_api_gateway/providers.tf index 0c435fd5..04dd9bcd 100644 --- a/amplitude_api_gateway/providers.tf +++ b/amplitude_api_gateway/providers.tf @@ -1,6 +1,6 @@ terraform { cloud { - organization = "dydxprotocol" + organization = "dydxopsdao" workspaces { name = ["amplitude-api-gateway"] @@ -10,11 +10,11 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "~> 3.0" + version = "~> 5.32" } } - required_version = "~> 1.3.2" + required_version = "~> 1.5" } provider "aws" { From 25c0fac20843f72e5de134e21915b4d8525f6400 Mon Sep 17 00:00:00 2001 From: Rudi Mocnik <17800978+rudimocnik@users.noreply.github.com> Date: Wed, 12 Jun 2024 22:10:39 +0200 Subject: [PATCH 4/5] replace ec2connect with ssm --- modules/metric_ingestor/ec2.tf | 4 ---- modules/metric_ingestor/iam.tf | 9 +++++++++ modules/metric_ingestor/security_group.tf | 11 ----------- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/modules/metric_ingestor/ec2.tf b/modules/metric_ingestor/ec2.tf index 1f92004f..74041bb5 100644 --- a/modules/metric_ingestor/ec2.tf +++ b/modules/metric_ingestor/ec2.tf @@ -10,10 +10,6 @@ locals { user_data = <> /etc/ecs/ecs.config EOH diff --git a/modules/metric_ingestor/iam.tf b/modules/metric_ingestor/iam.tf index 38522889..71edc11c 100644 --- a/modules/metric_ingestor/iam.tf +++ b/modules/metric_ingestor/iam.tf @@ -63,3 +63,12 @@ resource "aws_iam_role_policy_attachment" "ecs_list_tags" { role = aws_iam_role.ecs_instance_iam_role.name policy_arn = aws_iam_policy.ecs_list_tags_policy.arn } + +# ----------------------------------------------------------------------------- +# SSM policy for the ECS instance role to support secure management +# ----------------------------------------------------------------------------- + +resource "aws_iam_role_policy_attachment" "ssm_policy_attachment" { + role = aws_iam_role.ecs_instance_iam_role.name + policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" +} diff --git a/modules/metric_ingestor/security_group.tf b/modules/metric_ingestor/security_group.tf index 1effe71d..4359548f 100644 --- a/modules/metric_ingestor/security_group.tf +++ b/modules/metric_ingestor/security_group.tf @@ -3,17 +3,6 @@ resource "aws_security_group" "main" { name = "${var.environment}-${var.name}-sg" vpc_id = aws_vpc.main.id - # Allow port 22 for "ec2-instance-connect". - # This allows us to SSH into the hosts from the AWS Deveoper console. - # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.html - ingress { - protocol = "tcp" - from_port = 22 - to_port = 22 - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] - } - # For outgoing traffic, allow all. egress { protocol = "-1" From bf5f44cd56f4be6334d1587d9346fd72ac5db5de Mon Sep 17 00:00:00 2001 From: Rudi Mocnik <17800978+rudimocnik@users.noreply.github.com> Date: Thu, 13 Jun 2024 21:34:33 +0200 Subject: [PATCH 5/5] Remove inbound ssh security group --- modules/metric_ingestor/security_group.tf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/metric_ingestor/security_group.tf b/modules/metric_ingestor/security_group.tf index 4359548f..d3da63f6 100644 --- a/modules/metric_ingestor/security_group.tf +++ b/modules/metric_ingestor/security_group.tf @@ -3,6 +3,14 @@ resource "aws_security_group" "main" { name = "${var.environment}-${var.name}-sg" vpc_id = aws_vpc.main.id + ingress { + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = [] + ipv6_cidr_blocks = [] + } + # For outgoing traffic, allow all. egress { protocol = "-1"