Skip to content

Commit cbd7487

Browse files
ViktorLindstrmViktorLindstrm
committed
tests for matching ECS queries
1 parent 37be913 commit cbd7487

36 files changed

Lines changed: 681 additions & 0 deletions

‎ql/test/queries-tests/CloudFormation/ECS/ContainerInsights/ContainerInsights.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| ecs.yml:41:5:47:2 | CloudFormation ECS Cluster | ECS Cluster should have cluster settings enabled |

‎ql/test/queries-tests/CloudFormation/ECS/ContainerInsights/ContainerInsights.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CloudFormation/ECS/ContainerInsights.ql

‎ql/test/queries-tests/CloudFormation/ECS/ContainerInsights/ecs.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'Infrastructure for the ECS Fargate deployment pattern workshop service.'
3+
4+
Resources:
5+
#------------------------------------------------
6+
# ECS task definition
7+
#------------------------------------------------
8+
ComponentTaskDefinition:
9+
Type: 'AWS::ECS::TaskDefinition'
10+
Properties:
11+
ContainerDefinitions:
12+
- Image: !Sub '${image}:${version}'
13+
Name: !Ref Component
14+
PortMappings:
15+
- ContainerPort: 443
16+
LogConfiguration:
17+
LogDriver: 'awslogs'
18+
Options:
19+
awslogs-create-group: true
20+
awslogs-region: !Ref AWS::Region
21+
awslogs-group: !Sub '/fargate/${Component}'
22+
awslogs-stream-prefix: !Ref Component
23+
Environment:
24+
# Normally mandatory (but e.g. SHORTNAME and FLAVOUR may not always be applicable)
25+
Secrets:
26+
# Normally mandatory (but e.g. SHORTNAME and FLAVOUR may not always be applicable)
27+
- Name: 'AWS_ACCESS_KEY_ID'
28+
ValueFrom: arn:aws:secretsmanager:region:account-id:secret:aws-key-id
29+
Name: 'AWS_SECRET_ACCESS_KEY'
30+
ValueFrom: arn:aws:secretsmanager:region:account-id:secret:aws-secret-key
31+
Cpu: 512
32+
ExecutionRoleArn: !GetAtt ComponentTaskDefinitionExecutionRole.Arn
33+
TaskRoleArn: !GetAtt ComponentTaskDefinitionRole.Arn
34+
Family: !Ref Component
35+
Memory: 1024
36+
RequiresCompatibilities:
37+
- 'FARGATE'
38+
39+
40+
ClusterService:
41+
Type: 'AWS::ECS::Cluster'
42+
Properties:
43+
ClusterName: !Sub 'group${UserPartition}-ecs-fargate-ws-cluster'
44+
#------------------------------------------------
45+
# ECS Service
46+
#------------------------------------------------
47+
ComponentEcsService:
48+
Type: 'AWS::ECS::Service'
49+
DependsOn: ListenerRule
50+
Properties:
51+
Cluster:
52+
Fn::ImportValue: !Sub 'group$-ecs-fargate-cluster-arn'
53+
DesiredCount: 1
54+
LaunchType: 'FARGATE'
55+
LoadBalancers:
56+
- ContainerName: !Ref Component
57+
ContainerPort: !Ref ContainerPort
58+
TargetGroupArn: !Ref ComponentTargetGroup
59+
NetworkConfiguration:
60+
AwsvpcConfiguration:
61+
AssignPublicIp: 'ENABLED'
62+
SecurityGroups:
63+
- !Ref ComponentEcsServiceSecurityGroup
64+
- !Ref CiSecurityGroupId
65+
Subnets:
66+
- !Ref Subnet1
67+
ServiceName: !Sub '${RegionalPrefix}-${Component}-${Version}-${Launch}'
68+
TaskDefinition: !Ref ComponentTaskDefinition
69+
PropagateTags: 'TASK_DEFINITION'
70+
# Note: The value has been lowered from the recommended 180, for production use please choose this value wisely.
71+
HealthCheckGracePeriodSeconds: 90

‎ql/test/queries-tests/CloudFormation/ECS/ContainerInsights/something.tf‎

Whitespace-only changes.

‎ql/test/queries-tests/CloudFormation/ECS/LogConfiguration/LogConfiguration.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| ecs.yml:11:7:33:2 | CloudFormation Resource Properties | ContainerDefinitions must have a log configuration |

‎ql/test/queries-tests/CloudFormation/ECS/LogConfiguration/LogConfiguration.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CloudFormation/ECS/LogConfiguration.ql

‎ql/test/queries-tests/CloudFormation/ECS/LogConfiguration/ecs.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'Infrastructure for the ECS Fargate deployment pattern workshop service.'
3+
4+
Resources:
5+
#------------------------------------------------
6+
# ECS task definition
7+
#------------------------------------------------
8+
ComponentTaskDefinition:
9+
Type: 'AWS::ECS::TaskDefinition'
10+
Properties:
11+
ContainerDefinitions:
12+
- Image: !Sub '${image}:${version}'
13+
Name: !Ref Component
14+
PortMappings:
15+
- ContainerPort: 443
16+
Environment:
17+
# Normally mandatory (but e.g. SHORTNAME and FLAVOUR may not always be applicable)
18+
Secrets:
19+
# Normally mandatory (but e.g. SHORTNAME and FLAVOUR may not always be applicable)
20+
- Name: 'AWS_ACCESS_KEY_ID'
21+
ValueFrom: arn:aws:secretsmanager:region:account-id:secret:aws-key-id
22+
Name: 'AWS_SECRET_ACCESS_KEY'
23+
ValueFrom: arn:aws:secretsmanager:region:account-id:secret:aws-secret-key
24+
Cpu: 512
25+
ExecutionRoleArn: !GetAtt ComponentTaskDefinitionExecutionRole.Arn
26+
TaskRoleArn: !GetAtt ComponentTaskDefinitionRole.Arn
27+
Family: !Ref Component
28+
Memory: 1024
29+
RequiresCompatibilities:
30+
- 'FARGATE'
31+
32+
33+
ClusterService:
34+
Type: 'AWS::ECS::Cluster'
35+
Properties:
36+
ClusterName: !Sub 'group${UserPartition}-ecs-fargate-ws-cluster'
37+
#------------------------------------------------
38+
# ECS Service
39+
#------------------------------------------------
40+
ComponentEcsService:
41+
Type: 'AWS::ECS::Service'
42+
DependsOn: ListenerRule
43+
Properties:
44+
Cluster:
45+
Fn::ImportValue: !Sub 'group$-ecs-fargate-cluster-arn'
46+
DesiredCount: 1
47+
LaunchType: 'FARGATE'
48+
LoadBalancers:
49+
- ContainerName: !Ref Component
50+
ContainerPort: !Ref ContainerPort
51+
TargetGroupArn: !Ref ComponentTargetGroup
52+
NetworkConfiguration:
53+
AwsvpcConfiguration:
54+
AssignPublicIp: 'ENABLED'
55+
SecurityGroups:
56+
- !Ref ComponentEcsServiceSecurityGroup
57+
- !Ref CiSecurityGroupId
58+
Subnets:
59+
- !Ref Subnet1
60+
ServiceName: !Sub '${RegionalPrefix}-${Component}-${Version}-${Launch}'
61+
TaskDefinition: !Ref ComponentTaskDefinition
62+
PropagateTags: 'TASK_DEFINITION'
63+
# Note: The value has been lowered from the recommended 180, for production use please choose this value wisely.
64+
HealthCheckGracePeriodSeconds: 90

‎ql/test/queries-tests/CloudFormation/ECS/LogConfiguration/something.tf‎

Whitespace-only changes.

‎ql/test/queries-tests/CloudFormation/ECS/NetworkMode/NetworkMode.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| ecs.yml:9:5:42:2 | CloudFormation ECS Task Definition | ContainerDefinitions must not run as root or be privileged when networkmode Host is used |

‎ql/test/queries-tests/CloudFormation/ECS/NetworkMode/NetworkMode.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CloudFormation/ECS/NetworkMode.ql

0 commit comments

Comments
 (0)