Fixed bug where the variable definitions passed in the CLI did not have the highest precedence, being overwritten by the variable definitions on the Dependency.
Fixed bug where boilerplate preferred the variable defaults defined in the variablesfield of the dependency object over the var file values, unlike what was implied by the documentation.
This release has two intentional behavior changes:
boilerplate will now prefer values specified in var_files on the dependency over the default value of variables.
boilerplate will no longer ask for variables specified on dependency in interactive mode.
boilerplate no longer supports bare variable definitions on dependency config (that is, you must specify a default or reference when adding a variable to the variables list on a dependency config.
If you were relying on either of these behaviors, please file a GitHub issue with your use case so we can discuss alternatives.
Fixes attachment of security groups in the server-group module when using both the option to create ENIs and externally attaching additional security groups.
Exposed flag enable_root_account_mfa_rule for AWS Config to allow disabling the root user MFA AWS Config rule. This should only be turned off for AWS partitions that do not support a root user (e.g., GovCloud).
Exposed the ability to configure cross account SNS Topic access. You can use the new cloudtrail_benchmark_alarm_external_aws_account_ids_with_publish_access and cloudtrail_benchmark_alarm_external_iam_entities_with_list_subscription_access input variables to configure cross account access for various scenarios.
Updated cloudtrail to configure object level data logging for ALL S3 buckets, not just the CloudTrail bucket. Previously the compliance requirement 3.10 and 3.11 was misinterpreted to mean only the CloudTrail bucket when in reality all S3 buckets in the account required to be monitored.
Exposed the additional_data_logging_resources input variable in the account-baseline modules to configure additional data logging resources on the CloudTrail instance.
Added the ability to configure AWS Organizations metric filters in child accounts. While these are not strictly necessary, configuring them may be useful for satisfying various automated checks for CIS.
Fixed bug where the CloudTrail metric filter SNS topics were not being encrypted with the CloudTrail KMS Key as originally intended.
Updated the AWS Config Aggregator to force to aggregating all regions. This is due to the CIS control 3.5 that requires AWS Config be enabled in all regions, so it makes sense to always require aggregating all regions.
Fixed a CIS Compliance misinterpretation for control 5.1 (VPC NACLs). Control 5.1 states Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports, which was originally interpreted to mean that there should be no network ACL that effectively allows ingress from 0.0.0.0/0 on admin ports, but the popular interpretation is that there should be no network ACL rule that allows ingress from 0.0.0.0/0, even if a higher priority rule explicitly denies access. As such, starting this release, the network ACL rules are adjusted to ensure that no rule allows ingress from 0.0.0.0/0 in all rules configured.
Added the ability to configure an aggregator region to roll up the findings to in Security Hub. Note that only administrator accounts can designate an aggregator region.
Added the ability to disable private SSH and RDP access at the NACL level, using the new enable_administrative_remote_access_private_subnets_from_self (for mgmt VPC), enable_administrative_remote_access_private_app_subnets_from_self and enable_administrative_remote_access_private_persistence_subnets_from_self (for app VPC) variables.
Added the ability to configure the remote administrative ports for the NACLs from the VPC layer using the new remote_administrative_ports variable.
Unlock AWS provider v4. Require minimum 3.75.1. This update includes a few tests that make sure upgrading to this module from the last release is easy. However, you may need to bump your AWS provider version. See the migration guide notes below for more.
Fixed a perpetual diff problem in examples/rds-mysql-with-cross-region-replica. If you've used this example, you've probably already noticed this in your own code when re-running apply. We've updated the example to include the var.storage_encrypted setting in all example code that references the modules/rds module.
Uncovered an undocumented (as of this release) backward incompatibility in the AWS Provider v4 upgrade from v3.75. We've handled this within the modules/rds logic so you don't have to update your code.
Unlock AWS provider v4. Require minimum 3.75.1. This update includes a few tests that make sure upgrading to this module from the last release is easy. However, you may need to bump your AWS provider version. See the migration guide notes below for more info.
Updated sns-to-slack module to require passing through the Slack webhook URL using AWS Secrets Manager instead of directly as module variables. This is to treat the webhook URL more like a Secret as recommended by Slack.
Fixes bug where IAM roles that were created through the AWS console could not be passed to the single-server module because of duplicate instance profile. Allows disabling the creation of instance profile internally inside the module.
Unlock AWS provider v4. Require minimum 3.75.1 just for Landing Zone modules. This update includes a few tests that make sure upgrading to this module from the last release is easy. However, you may need to bump your AWS provider version. See the migration guide notes below for more info.
Added a new input variable exclude_ports_from_inbound_all that can be used to exclude a list of ports from the inbound global CIDR rules in the network acl modules. This is useful for adhering to certain compliance standards like CIS that explicitly deny any allow rule for administrative ports.
Removed the log:CreateLogGroup permissions from the VPC Flow Logs. This was unnecessary as the Log Groups are managed in Terraform, and in fact can lead to a race condition where the Log Group gets recreated after deletion.