feat: Warnings added to all public endpoints and IGW etc.

rajarshighosal · Sep 22, 2023 · f3715f6 · f3715f6
1 parent 53b77e8
commit f3715f6
Show file tree

Hide file tree

Showing 30 changed files with 69 additions and 7 deletions.
diff --git a/ai-ml/emr-spark-rapids/README.md b/ai-ml/emr-spark-rapids/README.md
@@ -34,7 +34,6 @@ Checkout the [documentation website](https://awslabs.github.io/data-on-eks/docs/
 | <a name="module_eks_data_addons"></a> [eks\_data\_addons](#module\_eks\_data\_addons) | aws-ia/eks-data-addons/aws | ~> 1.0 |
 | <a name="module_emr_containers"></a> [emr\_containers](#module\_emr\_containers) | terraform-aws-modules/emr/aws//modules/virtual-cluster | ~> 1.0 |
 | <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
-| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
 
 ## Resources
 

diff --git a/ai-ml/emr-spark-rapids/eks.tf b/ai-ml/emr-spark-rapids/eks.tf
@@ -9,6 +9,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
 
   vpc_id = module.vpc.vpc_id

diff --git a/ai-ml/jark-stack/terraform/eks.tf b/ai-ml/jark-stack/terraform/eks.tf
@@ -10,6 +10,7 @@ module "eks" {
 
   # if true, Your cluster API server is accessible from the internet.
   # You can, optionally, limit the CIDR blocks that can access the public endpoint.
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true
 
   vpc_id = module.vpc.vpc_id

diff --git a/ai-ml/jark-stack/terraform/vpc.tf b/ai-ml/jark-stack/terraform/vpc.tf
@@ -13,6 +13,9 @@ locals {
 #---------------------------------------------------------------
 # VPC
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/ai-ml/jupyterhub/main.tf b/ai-ml/jupyterhub/main.tf
@@ -20,6 +20,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
 
   vpc_id = module.vpc.vpc_id

diff --git a/ai-ml/jupyterhub/vpc.tf b/ai-ml/jupyterhub/vpc.tf
@@ -13,6 +13,9 @@ locals {
 #---------------------------------------------------------------
 # VPC
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/ai-ml/ray/terraform/main.tf b/ai-ml/ray/terraform/main.tf
@@ -92,8 +92,9 @@ module "eks" {
   source  = "terraform-aws-modules/eks/aws"
   version = "~> 19.15"
 
-  cluster_name                   = local.name
-  cluster_version                = local.cluster_version
+  cluster_name    = local.name
+  cluster_version = local.cluster_version
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true
 
   vpc_id = module.vpc.vpc_id

diff --git a/ai-ml/ray/terraform/vpc.tf b/ai-ml/ray/terraform/vpc.tf
@@ -2,6 +2,9 @@
 # VPC
 #---------------------------------------------------------------
 
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/ai-ml/trainium-inferentia/eks.tf b/ai-ml/trainium-inferentia/eks.tf
@@ -8,6 +8,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
 
   vpc_id = module.vpc.vpc_id

diff --git a/ai-ml/trainium-inferentia/vpc.tf b/ai-ml/trainium-inferentia/vpc.tf
@@ -13,6 +13,9 @@ locals {
 #---------------------------------------------------------------
 # VPC
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/analytics/terraform/datahub-on-eks/vpc.tf b/analytics/terraform/datahub-on-eks/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # Supporting Network Resources
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/analytics/terraform/emr-eks-ack/vpc.tf b/analytics/terraform/emr-eks-ack/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # VPC and Subnets
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/analytics/terraform/emr-eks-fargate/main.tf b/analytics/terraform/emr-eks-fargate/main.tf
@@ -43,8 +43,9 @@ module "eks" {
   source  = "terraform-aws-modules/eks/aws"
   version = "~> 19.15"
 
-  cluster_name                   = local.name
-  cluster_version                = var.eks_cluster_version
+  cluster_name    = local.name
+  cluster_version = var.eks_cluster_version
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true
 
   vpc_id     = module.vpc.vpc_id

diff --git a/analytics/terraform/emr-eks-fargate/vpc.tf b/analytics/terraform/emr-eks-fargate/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # Supporting Network Resources
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/analytics/terraform/emr-eks-karpenter/main.tf b/analytics/terraform/emr-eks-karpenter/main.tf
@@ -75,6 +75,7 @@ module "eks" {
   cluster_version = var.eks_cluster_version
 
   # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true
 
   vpc_id = module.vpc.vpc_id

diff --git a/analytics/terraform/emr-eks-karpenter/vpc.tf b/analytics/terraform/emr-eks-karpenter/vpc.tf
@@ -13,6 +13,9 @@ locals {
 #---------------------------------------------------------------
 # VPC
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/analytics/terraform/spark-k8s-operator/main.tf b/analytics/terraform/spark-k8s-operator/main.tf
@@ -22,6 +22,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true
 
   vpc_id = module.vpc.vpc_id

diff --git a/analytics/terraform/spark-k8s-operator/vpc.tf b/analytics/terraform/spark-k8s-operator/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # Supporting Network Resources
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/distributed-databases/cloudnative-postgres/vpc.tf b/distributed-databases/cloudnative-postgres/vpc.tf
@@ -3,6 +3,9 @@
 # Supporting Resources
 #---------------------------------------------------------------
 
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/schedulers/terraform/argo-workflow/eks.tf b/schedulers/terraform/argo-workflow/eks.tf
@@ -8,6 +8,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
 
   vpc_id = module.vpc.vpc_id

diff --git a/schedulers/terraform/argo-workflow/vpc.tf b/schedulers/terraform/argo-workflow/vpc.tf
@@ -1,3 +1,6 @@
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/schedulers/terraform/managed-airflow-mwaa/eks.tf b/schedulers/terraform/managed-airflow-mwaa/eks.tf
@@ -5,6 +5,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
 
   vpc_id     = module.vpc.vpc_id

diff --git a/schedulers/terraform/managed-airflow-mwaa/vpc.tf b/schedulers/terraform/managed-airflow-mwaa/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # Supporting Resources
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/schedulers/terraform/self-managed-airflow/eks.tf b/schedulers/terraform/self-managed-airflow/eks.tf
@@ -8,6 +8,7 @@ module "eks" {
   cluster_name    = local.name
   cluster_version = var.eks_cluster_version
 
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true # if true, Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint.
 
   vpc_id = module.vpc.vpc_id

diff --git a/schedulers/terraform/self-managed-airflow/vpc.tf b/schedulers/terraform/self-managed-airflow/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # Supporting Network Resources
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/streaming/flink/vpc.tf b/streaming/flink/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # Supporting Network Resources
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/streaming/kafka/main.tf b/streaming/kafka/main.tf
@@ -33,8 +33,9 @@ module "eks" {
   source  = "terraform-aws-modules/eks/aws"
   version = "~> 19.15"
 
-  cluster_name                   = local.name
-  cluster_version                = local.cluster_version
+  cluster_name    = local.name
+  cluster_version = local.cluster_version
+  #WARNING: Avoid using this option (cluster_endpoint_public_access = true) in preprod or prod accounts. This feature is designed for sandbox accounts, simplifying cluster deployment and testing.
   cluster_endpoint_public_access = true
 
   vpc_id     = module.vpc.vpc_id

diff --git a/streaming/kafka/vpc.tf b/streaming/kafka/vpc.tf
@@ -1,3 +1,6 @@
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/streaming/nifi/vpc.tf b/streaming/nifi/vpc.tf
@@ -1,6 +1,9 @@
 #---------------------------------------------------------------
 # VPC
 #---------------------------------------------------------------
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"

diff --git a/workshop/emr-eks/modules/vpc/main.tf b/workshop/emr-eks/modules/vpc/main.tf
@@ -11,6 +11,9 @@ locals {
 
 data "aws_availability_zones" "available" {}
 
+# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
+# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
+
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 5.0"