EBS Disk Encryption + Fix an extra log group #47
Conversation
| @@ -113,6 +113,8 @@ resource "aws_launch_template" "executor" { | |||
| volume_type = "gp3" | |||
| iops = var.boot_disk_iops | |||
| throughput = var.boot_disk_throughput | |||
| encrypted = true | |||
There was a problem hiding this comment.
This is 💥 if people use this code, so maybe we want to shim this with a var for "false" for awhile?
There was a problem hiding this comment.
You mean it would depend on the boot_disk_kms_key_id variable being set correctly? Could we say
| encrypted = true | |
| encrypted = var.boot_disk_kms_key_id != null ? true : false |
to mitigate it?
There was a problem hiding this comment.
Wait, no that can't be it.. we set encryption to true for the docker thing as well 🤔 I'm lost, what do you mean? 😬
There was a problem hiding this comment.
😅 aws_launch_template
Nevermind, new instances will just start to get encrypted. I thought this part of an aws_instance definition, which would cause the instance to be recreated.
| @@ -0,0 +1 @@ | |||
| 1.1.9 | |||
There was a problem hiding this comment.
maybe this is annoying? it makes my life nicer.
There was a problem hiding this comment.
we usually use asdf at sourcegraph which uses .tool-versions, could that help you, too?
| @@ -73,6 +73,7 @@ resource "aws_security_group" "metrics_access" { | |||
|
|
|||
| resource "aws_cloudwatch_log_group" "syslogs" { | |||
| # TODO: This is hardcoded in the executor image. | |||
| count = var.need_syslogs ? 1 : 0 | |||
There was a problem hiding this comment.
ideally i think we'd pull some of this stuff out into a different module altogether
There was a problem hiding this comment.
I was wondering if using a data source to check for existence might work. We don't actually need to create it, that happens automatically when the first log comes in, we just want to configure retention, really.
flyinprogrammer
force-pushed
the
master
branch
from
043f443 to
8f48a2f
Compare
Test plan
Using this module I ran these changes locally against an AWS account and it worked.