vpc-baseline module tags error. about terraform-aws-secure-baseline HOT 8 CLOSED

Damn my bad somehow the registry was on the wrong version!

from terraform-aws-secure-baseline.

Hi @jarrettj !

Is is possible to provide the code where you source vpc-baseline module?

Also could you check if you have edited the module source locally?
The error message indicates that there exists tags { .... } block somewhere(the correct way to define tags is to use a map like tags = { ... }), but I haven't found such code in the latest commit.

from terraform-aws-secure-baseline.

In my variables.tf:

variable "vpc_flow_logs_group_name" {
  default = "vpc_flow_logs"
}
variable "vpc_flow_logs_iam_role_arn" {
  default = ""
}

I am not sure what vpc_flow_logs_iam_role_arn should be?

And in my main.tf:

module "secure-baseline_vpc-baseline" {
  source  = "nozaq/secure-baseline/aws//modules/vpc-baseline"
  version = "0.3.0"
  vpc_flow_logs_group_name = var.vpc_flow_logs_group_name
  vpc_flow_logs_iam_role_arn = var.vpc_flow_logs_iam_role_arn
}

Thanks again for the quick reply. And no I have not modified any of the code.

Of yes and the version I am using as on the terraform registry is 0.3.0, maybe the wrong version then?

from terraform-aws-secure-baseline.

Do you have to manually create the vpc_flow_logs_iam_role_arn?

from terraform-aws-secure-baseline.

@jarrettj
Yes, the reason it's designed so is that vpc-baseline module needs to be enabled in each region but the IAM role can be shared across all of them.
If you want to use vpc-baseline alone without the whole secure-baseline module, you can create your role as below.

• https://github.com/nozaq/terraform-aws-secure-baseline/blob/master/vpc_baselines.tf#L15
• https://github.com/nozaq/terraform-aws-secure-baseline/blob/master/vpc_baselines.tf#L35

from terraform-aws-secure-baseline.

Thanks man. That helped, got my iam role setup using that info. So once that is done, how would I go about being able to connect to a machine in the vpc? I tried to boot a machine but I can't access it on any ports. Any idea? Thanks.

from terraform-aws-secure-baseline.

@jarrettj
Blocking any ports is the expected behavior. The goal of vpc-baseline module is to retrict the use of default VPCs as guided in CIS benchmark.
So I would recommend to create a different VPC in which boot any instances for actual use.

To create a new VPC with secure configurations, I've created secure-vpc module. I guess there should be similar modules out there as well.

from terraform-aws-secure-baseline.

Ah yes, that makes sense. This is only for default as you said. Will checkout secure-vpc. Thanks, noob here :).

from terraform-aws-secure-baseline.