mirror of
https://github.com/cdr/code-server.git
synced 2026-04-27 17:33:43 +02:00
b8094ac6a0
This commit adds complete Terraform infrastructure as code for deploying code-server on both EC2 and EKS platforms with enterprise-grade security and SAML/OIDC authentication. Features: - EC2 deployment with Auto Scaling Groups and Application Load Balancer - EKS deployment with managed node groups and AWS Load Balancer Controller - Private network setup with VPC, private subnets, and NAT gateways - SAML/OIDC authentication using OAuth2 Proxy - Security hardening: - KMS encryption for data at rest - TLS encryption in transit - IAM roles with least privilege - Security groups with minimal access - VPC Flow Logs - IMDSv2 enforcement - Auto-scaling capabilities for both EC2 and EKS - CloudWatch logging and monitoring - Automated deployment scripts Terraform Modules: - modules/vpc: VPC with public/private subnets, NAT, and VPC endpoints - modules/security: Security groups, IAM roles, and KMS keys - modules/ec2: EC2 Auto Scaling deployment with ALB - modules/eks: EKS cluster with managed node groups and addons Deployments: - deployments/ec2: EC2 deployment configuration - deployments/eks: EKS deployment configuration with Kubernetes manifests Documentation: - README.md: Comprehensive deployment and operations guide - QUICK-START.md: Quick reference for fast deployment - SAML-SETUP-GUIDE.md: Step-by-step IdP configuration guide Scripts: - scripts/deploy-ec2.sh: Automated EC2 deployment - scripts/deploy-eks.sh: Automated EKS deployment - scripts/destroy-ec2.sh: EC2 cleanup - scripts/destroy-eks.sh: EKS cleanup
241 lines
6.6 KiB
JSON
241 lines
6.6 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:CreateServiceLinkedRole"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:DescribeAccountAttributes",
|
|
"ec2:DescribeAddresses",
|
|
"ec2:DescribeAvailabilityZones",
|
|
"ec2:DescribeInternetGateways",
|
|
"ec2:DescribeVpcs",
|
|
"ec2:DescribeVpcPeeringConnections",
|
|
"ec2:DescribeSubnets",
|
|
"ec2:DescribeSecurityGroups",
|
|
"ec2:DescribeInstances",
|
|
"ec2:DescribeNetworkInterfaces",
|
|
"ec2:DescribeTags",
|
|
"ec2:GetCoipPoolUsage",
|
|
"ec2:DescribeCoipPools",
|
|
"elasticloadbalancing:DescribeLoadBalancers",
|
|
"elasticloadbalancing:DescribeLoadBalancerAttributes",
|
|
"elasticloadbalancing:DescribeListeners",
|
|
"elasticloadbalancing:DescribeListenerCertificates",
|
|
"elasticloadbalancing:DescribeSSLPolicies",
|
|
"elasticloadbalancing:DescribeRules",
|
|
"elasticloadbalancing:DescribeTargetGroups",
|
|
"elasticloadbalancing:DescribeTargetGroupAttributes",
|
|
"elasticloadbalancing:DescribeTargetHealth",
|
|
"elasticloadbalancing:DescribeTags"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cognito-idp:DescribeUserPoolClient",
|
|
"acm:ListCertificates",
|
|
"acm:DescribeCertificate",
|
|
"iam:ListServerCertificates",
|
|
"iam:GetServerCertificate",
|
|
"waf-regional:GetWebACL",
|
|
"waf-regional:GetWebACLForResource",
|
|
"waf-regional:AssociateWebACL",
|
|
"waf-regional:DisassociateWebACL",
|
|
"wafv2:GetWebACL",
|
|
"wafv2:GetWebACLForResource",
|
|
"wafv2:AssociateWebACL",
|
|
"wafv2:DisassociateWebACL",
|
|
"shield:GetSubscriptionState",
|
|
"shield:DescribeProtection",
|
|
"shield:CreateProtection",
|
|
"shield:DeleteProtection"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:AuthorizeSecurityGroupIngress",
|
|
"ec2:RevokeSecurityGroupIngress"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:CreateSecurityGroup"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:CreateTags"
|
|
],
|
|
"Resource": "arn:aws:ec2:*:*:security-group/*",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"ec2:CreateAction": "CreateSecurityGroup"
|
|
},
|
|
"Null": {
|
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:CreateTags",
|
|
"ec2:DeleteTags"
|
|
],
|
|
"Resource": "arn:aws:ec2:*:*:security-group/*",
|
|
"Condition": {
|
|
"Null": {
|
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
|
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:AuthorizeSecurityGroupIngress",
|
|
"ec2:RevokeSecurityGroupIngress",
|
|
"ec2:DeleteSecurityGroup"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"Null": {
|
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:CreateLoadBalancer",
|
|
"elasticloadbalancing:CreateTargetGroup"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"Null": {
|
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:CreateListener",
|
|
"elasticloadbalancing:DeleteListener",
|
|
"elasticloadbalancing:CreateRule",
|
|
"elasticloadbalancing:DeleteRule"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:AddTags",
|
|
"elasticloadbalancing:RemoveTags"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
|
|
],
|
|
"Condition": {
|
|
"Null": {
|
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
|
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:AddTags",
|
|
"elasticloadbalancing:RemoveTags"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:ModifyLoadBalancerAttributes",
|
|
"elasticloadbalancing:SetIpAddressType",
|
|
"elasticloadbalancing:SetSecurityGroups",
|
|
"elasticloadbalancing:SetSubnets",
|
|
"elasticloadbalancing:DeleteLoadBalancer",
|
|
"elasticloadbalancing:ModifyTargetGroup",
|
|
"elasticloadbalancing:ModifyTargetGroupAttributes",
|
|
"elasticloadbalancing:DeleteTargetGroup"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"Null": {
|
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:AddTags"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
|
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
|
|
],
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"elasticloadbalancing:CreateAction": [
|
|
"CreateTargetGroup",
|
|
"CreateLoadBalancer"
|
|
]
|
|
},
|
|
"Null": {
|
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:RegisterTargets",
|
|
"elasticloadbalancing:DeregisterTargets"
|
|
],
|
|
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:SetWebAcl",
|
|
"elasticloadbalancing:ModifyListener",
|
|
"elasticloadbalancing:AddListenerCertificates",
|
|
"elasticloadbalancing:RemoveListenerCertificates",
|
|
"elasticloadbalancing:ModifyRule"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|