Add support for disabling egress traffic

[jalgraves]

what

• Add support for disabling egress security-group rule in default security group

why

tl;dr My boss told me to.

We had a third party do a pen test and afterwards they suggested we remove egress traffic from our DB subnets. If I'm missing something and there is another way to accomplish this without changing the module I'd be happy and grateful to hear it.

[bridgecrew]

Bridgecrew has found infrastructure configuration errors in this PR ⬇️

[bridgecrew]

  Ensure RDS clusters and instances have deletion protection enabled
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_69
Error in referred variable: variable "deletion_protection"

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

[bridgecrew]

  Ensure RDS clusters have an AWS Backup backup plan
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_49

How to Fix

resource "aws_rds_cluster" "rds_cluster_good" {
  cluster_identifier      = "aurora-cluster-demo"
  engine                  = "aurora-mysql"
  engine_version          = "5.7.mysql_aurora.2.03.2"
  availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
  database_name           = "mydb"
  master_username         = "foo"
  master_password         = "bar"
}


resource "aws_backup_plan" "example" {
  name = "tf_example_backup_plan"

  rule {
    rule_name         = "tf_example_backup_rule"
    target_vault_name = "vault-name"
    schedule          = "cron(0 12 * * ? *)"
  }
}

resource "aws_backup_selection" "backup_good" {
  iam_role_arn = "arn:partition:service:region:account-id:resource-id"
  name         = "tf_example_backup_selection"
  plan_id      = aws_backup_plan.example.id

  resources = [
    aws_rds_cluster.rds_cluster_good.arn
  ]
}

Description

TBA

[bridgecrew]

  Ensure RDS cluster has IAM authentication enabled
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_IAM_66
Error in referred variable: variable "iam_database_authentication_enabled"

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

[bridgecrew]

  Ensure all data stored in Aurora is securely encrypted at rest
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_38
Error in referred variable: variable "storage_encrypted"

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

[bridgecrew]

  Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_IAM_59
Error in referred variable: variable "iam_database_authentication_enabled"

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

[bridgecrew]

  Ensure Postgres RDS has Query Logging enabled
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_96

[Gowiem]

/test all

This Pull Request has been updated, so we're dismissing all reviews.

[Gowiem]

/test all

[Gowiem]

@jalgraves
Thanks for the contribution! Released as https://github.com/cloudposse/terraform-aws-rds-cluster/releases/tag/0.50.0.