search

ministryofjustice / observability-platform

Observability Platform
https://observability-platform.service.justice.gov.uk/
MIT License
0 stars 1 forks source link

🔒 Update Grafana API key rotator's CloudWatch log publishing #57

Open jacobwoffenden opened 5 months ago

jacobwoffenden commented 5 months ago

User Story

As an Observability Platform product engineer I want my AWS Lambda functions to follow prescribed best practice from static analysis providers So that we have a healthy and secure codebase

Value / Purpose

Grafana API key rotator's IAM role (via Terraform module) has wildcard permissions to logs:CreateLogGroup

Useful Contacts

@jacobwoffenden

User Types

Observability Platform Product Engineering

Hypothesis

If we create a KMS CMK encrypted CloudWatch Log group, and provide scoped access to the Lambda's role Then we can resolve static analysis alerts

Proposal

  1. Create KMS CMK
  2. Create CloudWatch log group
  3. Set logging_log_group to output of 2
  4. Update Lambda IAM policy to access KMS and publish to CloudWatch Logs
  5. Set attach_cloudwatch_logs_policy to false
  6. Set attach_create_log_group_permission to false

Additional Information

https://registry.terraform.io/modules/terraform-aws-modules/lambda/aws/latest?tab=inputs

Definition of Done