shadowdaoandClaude Opus 4.7
d1d4c60f2d
Reviewer flagged two security-relevant items and two operational bugs on the external-DB + Terraform module merge. 1. Terraform: `enable_execute_command = true` was hardcoded on the app and embedder services. Production attack surface (anyone with `ecs:ExecuteCommand` on the service gets a container shell) AND non-functional today since the task roles have no `ssmmessages:*` permission. Added a new `enable_execute_command` boolean input variable defaulting to `false`; when flipped on, the SSM messages policy is conditionally attached to both task roles so the feature actually works. README's variable description tells operators to flip on for incidents, off afterward. 2. Terraform: `secret_arns` output was not marked `sensitive`. The ARNs themselves aren't secrets, but the embedded secret names print to `terraform apply` stdout and CI logs. Marked sensitive on both the module output and the example output. Operators wanting the values can still `terraform output -json secret_arns`. 3. Terraform: embedder task definition was missing `HOST=0.0.0.0` and `PORT=8080`. Fargate awsvpc tasks each get their own ENI; default Node HTTP servers bind 127.0.0.1, which would make every app→embedder Service Connect call time out. Added both vars to `embedder_environment`. Also added `NEXT_TELEMETRY_DISABLED=1` to `app_environment` per the spec's hardening checklist. 4. Compose: docker-compose.external-db.yml uses the `!override` YAML tag, which requires Docker Compose >= 2.24.0. Silently ignored on older Compose, causing the `db` dependency to survive the merge and startup to fail. Documented the minimum version in the override file's header AND in the main README prerequisites with a deep link to the External Postgres section. terraform fmt + validate (module + examples/basic) both clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
56 lines
1.6 KiB
Terraform
56 lines
1.6 KiB
Terraform
# Surface the module outputs so `terraform output` from this directory
|
|
# gives the operator everything they need without diving into the module.
|
|
|
|
output "alb_dns_name" {
|
|
description = "Point your Route53 record (alias) at this."
|
|
value = module.shared_memory.alb_dns_name
|
|
}
|
|
|
|
output "alb_zone_id" {
|
|
description = "Used as alias.zone_id on aws_route53_record."
|
|
value = module.shared_memory.alb_zone_id
|
|
}
|
|
|
|
output "ecs_cluster_name" {
|
|
description = "Pass to `aws ecs run-task --cluster`."
|
|
value = module.shared_memory.ecs_cluster_name
|
|
}
|
|
|
|
output "migrator_task_definition_family" {
|
|
description = "Pass to `aws ecs run-task --task-definition`."
|
|
value = module.shared_memory.migrator_task_definition_family
|
|
}
|
|
|
|
output "migrator_security_group_id" {
|
|
description = "Whitelist on RDS SG (inbound 5432)."
|
|
value = module.shared_memory.migrator_security_group_id
|
|
}
|
|
|
|
output "app_security_group_id" {
|
|
description = "Whitelist on RDS SG (inbound 5432)."
|
|
value = module.shared_memory.app_security_group_id
|
|
}
|
|
|
|
output "private_subnet_ids" {
|
|
description = "Echoed from input — handy for `aws ecs run-task --network-configuration`."
|
|
value = module.shared_memory.private_subnet_ids_for_run_task
|
|
}
|
|
|
|
output "app_log_group_name" {
|
|
value = module.shared_memory.app_log_group_name
|
|
}
|
|
|
|
output "embedder_log_group_name" {
|
|
value = module.shared_memory.embedder_log_group_name
|
|
}
|
|
|
|
output "migrator_log_group_name" {
|
|
value = module.shared_memory.migrator_log_group_name
|
|
}
|
|
|
|
output "secret_arns" {
|
|
description = "Visibility into where the module stored its secrets."
|
|
value = module.shared_memory.secret_arns
|
|
sensitive = true
|
|
}
|