Project: KICS (Provisioning / Security & Compliance)
File: 051f2063-2517-4295-ad8e-ba88c1bf5cfc.md

title: BOM - AWS MSK hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 051f2063-2517-4295-ad8e-ba88c1bf5cfc Query name: BOM - AWS MSK Platform: Terraform Severity: <span style="color:#CCCCCC">Trace</span> Category: Bill Of Materials URL: A list of MSK resources specified. Amazon Managed Streaming for Apache Kafka (Amazon MSK) is a fully managed service that enables you to build and run applications that use Apache Kafka to process streaming data.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="84" resource "aws_vpc" "vpc" { cidr_block = "192.168.0.0/22" } data "awsavailabilityzones" "azs" { state = "available" } resource "awssubnet" "subnetaz1" { availabilityzone = data.awsavailability_zones.azs.names[0] cidr_block = "192.168.0.0/24" vpcid = awsvpc.vpc.id } resource "awssubnet" "subnetaz2" { availabilityzone = data.awsavailability_zones.azs.names[1] cidr_block = "192.168.1.0/24" vpcid = awsvpc.vpc.id } resource "awssubnet" "subnetaz3" { availabilityzone = data.awsavailability_zones.azs.names[2] cidr_block = "192.168.2.0/24" vpcid = awsvpc.vpc.id } resource "awssecuritygroup" "sg" { vpcid = awsvpc.vpc.id } resource "awskmskey" "kms" { description = "positive1" } resource "awscloudwatchlog_group" "test" { name = "mskbrokerlogs" } resource "awss3bucket" "bucket" { bucket = "msk-broker-logs-bucket" acl = "private" } resource "awsiamrole" "firehose_role" { name = "firehosetestrole" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "firehose.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awskinesisfirehosedeliverystream" "test_stream" { name = "terraform-kinesis-firehose-msk-broker-logs-stream" destination = "s3" s3_configuration { rolearn = awsiamrole.firehoserole.arn bucketarn = awss3_bucket.bucket.arn } tags = { LogDeliveryEnabled = "placeholder" } lifecycle { ignore_changes = [ tags["LogDeliveryEnabled"], ] } } resource "awsmskcluster" "positive1" { cluster_name = "positive1" kafka_version = "2.4.1" numberofbroker_nodes = 3 brokernodegroup_info { connectivity_info { public_access { type = "SERVICEPROVIDEDEIPS" } } instance_type = "kafka.m5.large" ebsvolumesize = 1000 client_subnets = [ awssubnet.subnetaz1.id, awssubnet.subnetaz2.id, awssubnet.subnetaz3.id, ] securitygroups = [awssecurity_group.sg.id] } encryption_info { encryptionatrestkmskeyarn = awskms_key.kms.arn } open_monitoring { prometheus { jmx_exporter { enabledinbroker = true } node_exporter { enabledinbroker = true } } } logging_info { broker_logs { cloudwatch_logs { enabled = true loggroup = awscloudwatchloggroup.test.name } firehose { enabled = true deliverystream = awskinesisfirehosedeliverystream.teststream.name } s3 { enabled = true bucket =

prefix = "logs/msk-" } } } tags = { foo = "bar" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="84" resource "aws_vpc" "vpc" { cidr_block = "192.168.0.0/22" } data "awsavailabilityzones" "azs" { state = "available" } resource "awssubnet" "subnetaz1" { availabilityzone = data.awsavailability_zones.azs.names[0] cidr_block = "192.168.0.0/24" vpcid = awsvpc.vpc.id } resource "awssubnet" "subnetaz2" { availabilityzone = data.awsavailability_zones.azs.names[1] cidr_block = "192.168.1.0/24" vpcid = awsvpc.vpc.id } resource "awssubnet" "subnetaz3" { availabilityzone = data.awsavailability_zones.azs.names[2] cidr_block = "192.168.2.0/24" vpcid = awsvpc.vpc.id } resource "awssecuritygroup" "sg" { vpcid = awsvpc.vpc.id } resource "awskmskey" "kms" { description = "positive2" } resource "awscloudwatchlog_group" "test" { name = "mskbrokerlogs" } resource "awss3bucket" "bucket" { bucket = "msk-broker-logs-bucket" acl = "private" } resource "awsiamrole" "firehose_role" { name = "firehosetestrole" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "firehose.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awskinesisfirehosedeliverystream" "test_stream" { name = "terraform-kinesis-firehose-msk-broker-logs-stream" destination = "s3" s3_configuration { rolearn = awsiamrole.firehoserole.arn bucketarn = awss3_bucket.bucket.arn } tags = { LogDeliveryEnabled = "placeholder" } lifecycle { ignore_changes = [ tags["LogDeliveryEnabled"], ] } } resource "awsmskcluster" "positive2" { cluster_name = "positive2" kafka_version = "2.4.1" numberofbroker_nodes = 3 brokernodegroup_info { instance_type = "kafka.m5.large" ebsvolumesize = 1000 client_subnets = [ awssubnet.subnetaz1.id, awssubnet.subnetaz2.id, awssubnet.subnetaz3.id, ] securitygroups = [awssecurity_group.sg.id] } open_monitoring { prometheus { jmx_exporter { enabledinbroker = true } node_exporter { enabledinbroker = true } } } logging_info { broker_logs { cloudwatch_logs { enabled = true loggroup = awscloudwatchloggroup.test.name } firehose { enabled = true deliverystream = awskinesisfirehosedeliverystream.teststream.name } s3 { enabled = true bucket = awss3bucket.bucket.id prefix = "logs/msk-" } } } tags = { foo = "bar" } } ``` ```tf title="Negative test num. 1 - tf file" module "kafka" { source = "cloudposse/msk-apache-kafka-cluster/aws" version = "0.7.2" namespace = "eg" stage = "prod" name = "app" vpc_id = "vpc-XXXXXXXX" zone_id = "Z14EN2YD427LRQ" security_groups = ["sg-XXXXXXXXX", "sg-YYYYYYYY"] subnet_ids = ["subnet-XXXXXXXXX", "subnet-YYYYYYYY"] kafka_version = "2.4.1" numberofbrokernodes = 2 # this has to be a multiple of the # of subnetids brokerinstancetype = "kafka.m5.large" } ```