AWS

tags = {
  environment = "production"
  team        = "ml-platform"
  cost-center = "1234"
}

disable_default_tags = true

cluster_addons_vpc_cni_additional_configurations = {
    env = {
      AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG = "true"
      ENI_CONFIG_LABEL_DEF               = "topology.kubernetes.io/zone"
    }
}

kubectl set env daemonset aws-node -n kube-system "AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG=true"
kubectl set env daemonset aws-node -n kube-system "ENI_CONFIG_LABEL_DEF=topology.kubernetes.io/zone"

apiVersion: crd.k8s.amazonaws.com/v1alpha1
kind: ENIConfig
metadata:
  name: us-east-1a   # AZ of the EKS nodes
spec:
  securityGroups:
    - sg-0dff111a1d11c1c11   # security group of the EKS nodes
  subnet: subnet-011b111c1f11fdf11   # subnet with the secondary CIDR

Error: creating S3 Bucket (<bucket-name>) Public Access Block:
operation error S3: PutPublicAccessBlock, https response error StatusCode: 403,
api error AccessDenied: User: arn:aws:iam::<account-id>:user/truefoundry is not
authorized to perform: s3:PutBucketPublicAccessBlock on resource:
"arn:aws:s3:::<bucket-name>" with an explicit deny in a service control policy

module "tfy-control-plane" {
  source = "truefoundry/truefoundry-control-plane/aws"

  # ... existing arguments ...

  truefoundry_s3_attach_public_policy = false
}

module "tfy-platform-features" {
  source = "truefoundry/truefoundry-platform-features/aws"

  # ... existing arguments ...

  blob_storage_attach_public_policy = false
}

kubectl get svc -n istio-system tfy-istio-ingress

NAME                TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)
tfy-istio-ingress   LoadBalancer   172.xx.xx.xx    <pending>     80:30490/TCP,443:30955/TCP

kubectl describe svc tfy-istio-ingress -n istio-system

Warning  FailedDeployModel  12m  service  Failed deploy model due to operation error Elastic Load Balancing v2: CreateLoadBalancer,
https response error StatusCode: 403, api error AccessDenied:
User: arn:aws:sts::123456789012:assumed-role/example-controller-role/example-session
is not authorized to perform: iam:CreateServiceLinkedRole
on resource: arn:aws:iam::123456789012:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing
because no permissions boundary allows the iam:CreateServiceLinkedRole action

aws iam get-role \
  --role-name AWSServiceRoleForElasticLoadBalancing

module "eks" {
  source  = "truefoundry/truefoundry-cluster/aws"

  # ... existing arguments ...

  cluster_addons_coredns_additional_configurations = {
    autoScaling = {
      enabled     = true
      minReplicas = 2
      maxReplicas = 10
    }
  }
}

instanceFamilies:
  notAllowed: ["c5", "m5", "r5"]
instanceSizes:
  notAllowed: ["metal", "24xlarge"]

module "eks" {
  source = "truefoundry/truefoundry-cluster/aws"

  # ... existing arguments ...

  additional_eks_managed_node_groups = {
    gpu = {
      ami_type       = "AL2023_x86_64_NVIDIA"
      instance_types = ["g5.xlarge"]
      capacity_type  = "ON_DEMAND"

      min_size     = 0
      max_size     = 1
      desired_size = 0

      block_device_mappings = {
        xvda = {
          device_name = "/dev/xvda"
          ebs = {
            volume_size           = 200
            volume_type           = "gp3"
            encrypted             = true
            delete_on_termination = true
          }
        }
      }

      labels = {
        "truefoundry.com/node-pool" = "gpu"
        "nvidia.com/gpu"            = "true"
      }

      taints = {
        gpu = {
          key    = "nvidia.com/gpu"
          value  = "true"
          effect = "NO_SCHEDULE"
        }
      }

      tags = var.tags
    }
  }
}

resource "aws_wafv2_ip_set" "allowlist" {
  count              = var.enable_waf && length(var.waf_ip_allowlist) > 0 ? 1 : 0
  name               = "${local.waf_name_effective}-allowlist"
  description        = "Trusted IPs that bypass WAF managed rules"
  scope              = var.waf_scope
  ip_address_version = "IPV4"
  addresses          = var.waf_ip_allowlist
  tags               = local.waf_required_tags
}

resource "aws_wafv2_web_acl" "this" {
  count       = var.enable_waf ? 1 : 0
  name        = local.waf_name_effective
  description = "WAFv2 Web ACL for ${var.cluster_name}"
  scope       = var.waf_scope
  tags        = local.waf_required_tags

  # WAF-016 (Info): default action kept as `allow`. See note above for the
  # deny-by-default alternative.
  default_action {
    allow {}
  }

  # ... insert rule blocks here (see sections below) ...

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "WebAclMetrics"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWSManagedRulesKnownBadInputsRuleSet"
  priority = 0

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesKnownBadInputsRuleSet"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesKnownBadInputsRuleSet"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWSManagedRulesSQLiRuleSet"
  priority = 1

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesSQLiRuleSet"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesSQLiRuleSet"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWSManagedRulesAmazonIpReputationList"
  priority = 2

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesAmazonIpReputationList"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesAmazonIpReputationList"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWS-AWSManagedRulesCommonRuleSet"
  priority = 3

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesCommonRuleSet"
      vendor_name = "AWS"

      rule_action_override {
        name = "SizeRestrictions_BODY"

        action_to_use {
          allow {}
        }
      }

      rule_action_override {
        name = "NoUserAgent_HEADER"

        action_to_use {
          count {}
        }
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWS-AWSManagedRulesCommonRuleSet"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "Rate_limit_by_IP_Address_to_manage_DDoS_attacks"
  priority = 4

  action {
    block {}
  }

  statement {
    rate_based_statement {
      limit                 = var.waf_rate_limit
      aggregate_key_type    = "IP"
      evaluation_window_sec = var.waf_evaluation_window_sec

      scope_down_statement {
        byte_match_statement {
          search_string         = "/api/"
          positional_constraint = "STARTS_WITH"

          field_to_match {
            uri_path {}
          }

          text_transformation {
            priority = 0
            type     = "LOWERCASE"
          }
        }
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "LimitRequests100"
    sampled_requests_enabled   = true
  }
}

dynamic "rule" {
  for_each = length(aws_wafv2_ip_set.allowlist) > 0 ? [1] : []

  content {
    name     = "cargill_whitelist_ips"
    priority = 5

    action {
      allow {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.allowlist[0].arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "cargill_whitelist_ips"
      sampled_requests_enabled   = true
    }
  }
}

rule {
  name     = "AWSManagedRulesAnonymousIpList"
  priority = 6

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesAnonymousIpList"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesAnonymousIpList"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "BlockSQLiAttacks"
  priority = 7

  action {
    count {} # TODO: switch to `block {}` after validating no false positives
  }

  statement {
    sqli_match_statement {
      field_to_match {
        body {}
      }

      text_transformation {
        priority = 0
        type     = "URL_DECODE"
      }

      text_transformation {
        priority = 1
        type     = "HTML_ENTITY_DECODE"
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "BlockSQLiAttacks"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "BlockXSSAttacks"
  priority = 8

  action {
    count {} # TODO: switch to `block {}` after validating no false positives
  }

  statement {
    xss_match_statement {
      field_to_match {
        all_query_arguments {}
      }

      text_transformation {
        priority = 0
        type     = "URL_DECODE"
      }

      text_transformation {
        priority = 1
        type     = "HTML_ENTITY_DECODE"
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "BlockXSSAttacks"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "GeoBlockRule"
  priority = 9

  action {
    block {}
  }

  statement {
    not_statement {
      statement {
        geo_match_statement {
          country_codes = var.waf_geo_allowed_country_codes
        }
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "GeoBlockRule"
    sampled_requests_enabled   = true
  }
}

data_protection_config {
  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["authorization"]
    }
  }

  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["cookie"]
    }
  }

  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["x-api-key"]
    }
  }

  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["x-auth-token"]
    }
  }
}

resource "aws_cloudwatch_log_group" "waf" {
  count             = var.enable_waf ? 1 : 0
  name              = "aws-waf-logs-${local.waf_name_effective}"
  retention_in_days = var.waf_log_retention_days
  tags              = local.waf_required_tags
}

resource "aws_wafv2_web_acl_logging_configuration" "this" {
  count                   = var.enable_waf ? 1 : 0
  log_destination_configs = [aws_cloudwatch_log_group.waf[0].arn]
  resource_arn            = aws_wafv2_web_acl.this[0].arn

  redacted_fields {
    single_header {
      name = "authorization"
    }
  }

  redacted_fields {
    single_header {
      name = "cookie"
    }
  }
}

resource "aws_wafv2_web_acl_association" "alb" {
  count        = var.enable_waf && var.waf_associate_alb_arn != "" ? 1 : 0
  resource_arn = var.waf_associate_alb_arn
  web_acl_arn  = aws_wafv2_web_acl.this[0].arn
}