From ee46af68989acb232c820b8031c081d0bf6dad1a Mon Sep 17 00:00:00 2001 From: nitro Date: Fri, 26 Feb 2021 10:24:15 -0500 Subject: [PATCH 1/6] Default var.transit_encryption_enabled to false --- variables.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/variables.tf b/variables.tf index f85c292..dc87801 100644 --- a/variables.tf +++ b/variables.tf @@ -92,8 +92,8 @@ variable "at_rest_encryption_enabled" { variable "transit_encryption_enabled" { type = bool - default = true - description = "Enable TLS" + default = false + description = "Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis" } variable "notification_topic_arn" { From c113e1dd33d962cabfd3b22a8484f1b89f154255 Mon Sep 17 00:00:00 2001 From: nitro Date: Fri, 26 Feb 2021 10:26:21 -0500 Subject: [PATCH 2/6] trans enc to true if token unless explicitly set --- main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.tf b/main.tf index 63faebc..b226e14 100644 --- a/main.tf +++ b/main.tf @@ -95,7 +95,7 @@ resource "aws_elasticache_replication_group" "default" { notification_topic_arn = var.notification_topic_arn engine_version = var.engine_version at_rest_encryption_enabled = var.at_rest_encryption_enabled - transit_encryption_enabled = var.transit_encryption_enabled + transit_encryption_enabled = var.auth_token != null ? coalesce(true, var.transit_encryption_enabled) : var.transit_encryption_enabled kms_key_id = var.at_rest_encryption_enabled ? var.kms_key_id : null snapshot_name = var.snapshot_name snapshot_arns = var.snapshot_arns From 3702f35d73bd9509a7790739946991eafa0d6391 Mon Sep 17 00:00:00 2001 From: nitro Date: Fri, 26 Feb 2021 10:30:00 -0500 Subject: [PATCH 3/6] Update variables.tf --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index dc87801..0ff271b 100644 --- a/variables.tf +++ b/variables.tf @@ -92,7 +92,7 @@ variable "at_rest_encryption_enabled" { variable "transit_encryption_enabled" { type = bool - default = false + default = null description = "Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis" } From 5a526858b4eca60c83cedad18059d4e4629feb91 Mon Sep 17 00:00:00 2001 From: cloudpossebot <11232728+cloudpossebot@users.noreply.github.com> Date: Fri, 26 Feb 2021 15:30:42 +0000 Subject: [PATCH 4/6] Auto Format --- README.md | 14 +++++++------- docs/terraform.md | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 4146ebf..8472f43 100644 --- a/README.md +++ b/README.md @@ -206,12 +206,12 @@ Available targets: | Name | |------| -| [aws_cloudwatch_metric_alarm](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/cloudwatch_metric_alarm) | -| [aws_elasticache_parameter_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/elasticache_parameter_group) | -| [aws_elasticache_replication_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/elasticache_replication_group) | -| [aws_elasticache_subnet_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/elasticache_subnet_group) | -| [aws_security_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/security_group) | -| [aws_security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/security_group_rule) | +| [aws_cloudwatch_metric_alarm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | +| [aws_elasticache_parameter_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_parameter_group) | +| [aws_elasticache_replication_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_replication_group) | +| [aws_elasticache_subnet_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | +| [aws_security_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | +| [aws_security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | ## Inputs @@ -267,7 +267,7 @@ Available targets: | stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | subnets | Subnet IDs | `list(string)` | `[]` | no | | tags | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no | -| transit\_encryption\_enabled | Enable TLS | `bool` | `true` | no | +| transit\_encryption\_enabled | Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis | `bool` | `null` | no | | use\_existing\_security\_groups | Flag to enable/disable creation of Security Group in the module. Set to `true` to disable Security Group creation and provide a list of existing security Group IDs in `existing_security_groups` to place the cluster into | `bool` | `false` | no | | vpc\_id | VPC ID | `string` | n/a | yes | | zone\_id | Route53 DNS Zone ID | `string` | `""` | no | diff --git a/docs/terraform.md b/docs/terraform.md index 7c6649a..f0cf705 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -24,12 +24,12 @@ | Name | |------| -| [aws_cloudwatch_metric_alarm](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/cloudwatch_metric_alarm) | -| [aws_elasticache_parameter_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/elasticache_parameter_group) | -| [aws_elasticache_replication_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/elasticache_replication_group) | -| [aws_elasticache_subnet_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/elasticache_subnet_group) | -| [aws_security_group](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/security_group) | -| [aws_security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/2.0/docs/resources/security_group_rule) | +| [aws_cloudwatch_metric_alarm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | +| [aws_elasticache_parameter_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_parameter_group) | +| [aws_elasticache_replication_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_replication_group) | +| [aws_elasticache_subnet_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | +| [aws_security_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | +| [aws_security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | ## Inputs @@ -85,7 +85,7 @@ | stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | subnets | Subnet IDs | `list(string)` | `[]` | no | | tags | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no | -| transit\_encryption\_enabled | Enable TLS | `bool` | `true` | no | +| transit\_encryption\_enabled | Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis | `bool` | `null` | no | | use\_existing\_security\_groups | Flag to enable/disable creation of Security Group in the module. Set to `true` to disable Security Group creation and provide a list of existing security Group IDs in `existing_security_groups` to place the cluster into | `bool` | `false` | no | | vpc\_id | VPC ID | `string` | n/a | yes | | zone\_id | Route53 DNS Zone ID | `string` | `""` | no | From 69c043f9438e4398b5d414a8db64cc820439ea12 Mon Sep 17 00:00:00 2001 From: PePe Amengual Date: Fri, 26 Feb 2021 11:35:13 -0800 Subject: [PATCH 5/6] Trigger validate-codeowners From b6d12f9b05abbf9cc675058c408c78c2c1eb4cf6 Mon Sep 17 00:00:00 2001 From: PePe Amengual Date: Fri, 26 Feb 2021 14:36:01 -0800 Subject: [PATCH 6/6] Reverting to transit_encryption_enabled = true --- README.md | 2 +- docs/terraform.md | 2 +- main.tf | 2 +- variables.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8472f43..1a3a680 100644 --- a/README.md +++ b/README.md @@ -267,7 +267,7 @@ Available targets: | stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | subnets | Subnet IDs | `list(string)` | `[]` | no | | tags | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no | -| transit\_encryption\_enabled | Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis | `bool` | `null` | no | +| transit\_encryption\_enabled | Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis | `bool` | `true` | no | | use\_existing\_security\_groups | Flag to enable/disable creation of Security Group in the module. Set to `true` to disable Security Group creation and provide a list of existing security Group IDs in `existing_security_groups` to place the cluster into | `bool` | `false` | no | | vpc\_id | VPC ID | `string` | n/a | yes | | zone\_id | Route53 DNS Zone ID | `string` | `""` | no | diff --git a/docs/terraform.md b/docs/terraform.md index f0cf705..a6934e7 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -85,7 +85,7 @@ | stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | subnets | Subnet IDs | `list(string)` | `[]` | no | | tags | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no | -| transit\_encryption\_enabled | Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis | `bool` | `null` | no | +| transit\_encryption\_enabled | Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis | `bool` | `true` | no | | use\_existing\_security\_groups | Flag to enable/disable creation of Security Group in the module. Set to `true` to disable Security Group creation and provide a list of existing security Group IDs in `existing_security_groups` to place the cluster into | `bool` | `false` | no | | vpc\_id | VPC ID | `string` | n/a | yes | | zone\_id | Route53 DNS Zone ID | `string` | `""` | no | diff --git a/main.tf b/main.tf index b226e14..63faebc 100644 --- a/main.tf +++ b/main.tf @@ -95,7 +95,7 @@ resource "aws_elasticache_replication_group" "default" { notification_topic_arn = var.notification_topic_arn engine_version = var.engine_version at_rest_encryption_enabled = var.at_rest_encryption_enabled - transit_encryption_enabled = var.auth_token != null ? coalesce(true, var.transit_encryption_enabled) : var.transit_encryption_enabled + transit_encryption_enabled = var.transit_encryption_enabled kms_key_id = var.at_rest_encryption_enabled ? var.kms_key_id : null snapshot_name = var.snapshot_name snapshot_arns = var.snapshot_arns diff --git a/variables.tf b/variables.tf index 0ff271b..9e819f4 100644 --- a/variables.tf +++ b/variables.tf @@ -92,7 +92,7 @@ variable "at_rest_encryption_enabled" { variable "transit_encryption_enabled" { type = bool - default = null + default = true description = "Whether to enable encryption in transit. If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis" }