Align DBs resources name creation with 'imperva-dsf' prefix

modules/aws/db-with-agent/iam_role.tf

@@ -37,18 +37,17 @@ locals {
 }
 
 resource "aws_iam_instance_profile" "dsf_node_instance_iam_profile" {
-  name_prefix = join("-", [var.friendly_name, "agent", "instance-iam-profile"])
+  name_prefix = join("-", [var.friendly_name, "instance-iam-profile"])
   role        = local.role_name
   tags        = var.tags
 }
 
 resource "aws_iam_role" "dsf_node_role" {
-  # name_prefix         = join("-", [var.friendly_name, "agent", "role"])
-  description         = join("-", [var.friendly_name, "agent", "role"])
+  name                = join("-", [var.friendly_name, "role"])
   managed_policy_arns = null
   assume_role_policy  = local.role_assume_role_policy
   inline_policy {
-    name   = "${var.friendly_name}-s3-access"
+    name   = join("-", [var.friendly_name, "s3-access"])
     policy = local.inline_policy_s3
   }
   tags = var.tags

modules/aws/rds-mssql-db/iam_role.tf

@@ -114,44 +114,43 @@ locals {
 }
 
 resource "aws_iam_role" "rds_db_og_role" {
-  name_prefix         = replace("${local.db_identifier}-og-role", "_", "-")
-  description         = replace("${local.db_identifier}-og-role", "_", "-")
+  name                = join("-", [local.db_identifier, "og-role"])
   managed_policy_arns = null
   assume_role_policy  = local.rds_db_og_role_assume_role_policy
   inline_policy {
-    name   = "imperva-dsf-s3-access"
+    name   = join("-", [local.db_identifier, "s3-access"])
     policy = local.rds_db_og_role_inline_policy_s3
   }
   tags = var.tags
 }
 
 resource "aws_iam_instance_profile" "lambda_mssql_infra_instance_iam_profile" {
   count       = var.instance_profile_name == null ? 1 : 0
-  name_prefix = "lambda-mssql-infra-instance-iam-profile"
+  name_prefix = join("-", [local.db_identifier, "infra", "instance-iam-profile"])
   role        = local.role_name
   tags        = var.tags
 }
 
 resource "aws_iam_role" "lambda_mssql_infra_role" {
   count               = var.instance_profile_name == null ? 1 : 0
-  name_prefix         = "imperva-mssql-infra-role"
-  description         = "imperva-mssql-infra-role"
+  name                = join("-", [local.db_identifier, "infra-role"])
   managed_policy_arns = null
   assume_role_policy  = local.role_assume_role_policy
   inline_policy {
-    name   = "imperva-dsf-mssql-log-group"
+    name   = join("-", [local.db_identifier, "log-group"])
     policy = local.inline_policy_log_group
   }
   inline_policy {
-    name   = "imperva-dsf-mssql-s3-access"
+    name   = join("-", [local.db_identifier, "s3-access"])
     policy = local.inline_policy_s3
   }
   inline_policy {
-    name   = "imperva-dsf-mssql-ec2-access"
+    name   = join("-", [local.db_identifier, "ec2-access"])
     policy = local.inline_policy_ec2
   }
   tags = var.tags
 }
+
 data "aws_iam_instance_profile" "profile" {
   count = var.instance_profile_name != null ? 1 : 0
   name  = var.instance_profile_name

modules/aws/rds-mssql-db/lambdas.tf

@@ -4,7 +4,7 @@ data "aws_iam_role" "lambda_mssql_assignee_role" {
 }
 
 resource "aws_lambda_function" "lambda_mssql_infra" {
-  function_name     = join("-", ["dsf-mssql-infra", local.lambda_salt])
+  function_name     = join("-", [var.name_prefix, "infra", local.lambda_salt])
   s3_bucket         = data.aws_s3_object.mssql_lambda_package.bucket
   s3_key            = data.aws_s3_object.mssql_lambda_package.key
   s3_object_version = data.aws_s3_object.mssql_lambda_package.version_id
@@ -42,7 +42,7 @@ resource "aws_lambda_invocation" "mssql_infra_invocation" {
 }
 
 resource "aws_lambda_function" "lambda_mssql_scheduled" {
-  function_name     = join("-", ["dsf-mssql-traffic-and-suspicious-activity", local.lambda_salt])
+  function_name     = join("-", [var.name_prefix, "traffic-and-suspicious-activity", local.lambda_salt])
   s3_bucket         = data.aws_s3_object.mssql_lambda_package.bucket
   s3_key            = data.aws_s3_object.mssql_lambda_package.key
   s3_object_version = data.aws_s3_object.mssql_lambda_package.version_id
@@ -75,7 +75,7 @@ resource "aws_lambda_function" "lambda_mssql_scheduled" {
 
 # add scheduled events each 1 minute for the traffic queries
 resource "aws_cloudwatch_event_rule" "trafficEachMinute" {
-  name                = join("-", ["dsf-mssql-lambda-traffic-every-minute", local.lambda_salt])
+  name                = join("-", [var.name_prefix, "lambda-traffic-every-minute", local.lambda_salt])
   description         = "Schedule a lambda for DSF SQL Server that run traffic each 1 minute"
   schedule_expression = "rate(1 minute)"
   tags                = var.tags
@@ -97,7 +97,7 @@ resource "aws_lambda_permission" "allow_cloudwatchTraffic" {
 
 # add scheduled events each 10 minutes for the suspicious activity queries
 resource "aws_cloudwatch_event_rule" "suspiciousActivityEach10Minutes" {
-  name                = join("-", ["dsf-mssql-lambda-suspicious-activity-every-10-minutes", local.lambda_salt])
+  name                = join("-", [var.name_prefix, "lambda-suspicious-act-each-10-minutes", local.lambda_salt])
   description         = "Schedule a lambda for DSF SQL Server that run suspicious activity each 10 minutes"
   schedule_expression = "rate(10 minutes)"
   tags                = var.tags

modules/aws/rds-mssql-db/main.tf

@@ -14,7 +14,7 @@ data "aws_region" "current" {}
 locals {
   db_username           = var.username
   db_password           = length(var.password) > 0 ? var.password : random_password.db_password.result
-  db_identifier         = length(var.identifier) > 0 ? var.identifier : "edsf-db-demo-${random_pet.db_id.id}"
+  db_identifier         = length(var.identifier) > 0 ? var.identifier : join("-", [var.name_prefix, random_pet.db_id.id])
   db_name               = "master"
   mssql_connect_db_name = "rdsadmin"
   lambda_salt           = random_id.salt.hex
@@ -140,7 +140,7 @@ data "aws_s3_object" "source" {
 }
 
 resource "aws_s3_bucket" "mssql_lambda_bucket" {
-  bucket        = join("-", ["dsf-sql-scripts-bucket", local.lambda_salt])
+  bucket        = join("-", [var.name_prefix, "sql-scripts-bucket", local.lambda_salt])
   force_destroy = true
 }
 

modules/aws/rds-mssql-db/variables.tf

@@ -28,6 +28,12 @@ variable "identifier" {
   }
 }
 
+variable "name_prefix" {
+  type        = string
+  description = "Prefix to the name to identify all resources"
+  default     = "imperva-dsf-mssql"
+}
+
 variable "name" {
   type        = string
   description = "Name of your rds instance"

modules/aws/rds-mysql-db/main.tf

@@ -9,8 +9,8 @@ resource "random_pet" "db_id" {
 locals {
   db_username             = var.username
   db_password             = length(var.password) > 0 ? var.password : random_password.db_password.result
-  db_identifier           = length(var.identifier) > 0 ? var.identifier : "edsf-db-demo-${random_pet.db_id.id}"
-  db_name                 = length(var.name) > 0 ? var.name : replace("edsf-db-demo-${random_pet.db_id.id}", "-", "_")
+  db_identifier           = length(var.identifier) > 0 ? var.identifier : join("-", [var.name_prefix, random_pet.db_id.id])
+  db_name                 = length(var.name) > 0 ? var.name : replace(join("-", [var.name_prefix, random_pet.db_id.id]), "-", "_")
   cloudwatch_stream_names = ["audit", "error", "general", "slowquery"]
 }
 

modules/aws/rds-mysql-db/variables.tf

@@ -28,6 +28,12 @@ variable "identifier" {
   }
 }
 
+variable "name_prefix" {
+  type        = string
+  description = "Prefix to the name to identify all resources"
+  default     = "imperva-dsf-mysql"
+}
+
 variable "name" {
   type        = string
   description = "Name of your rds instance"

modules/aws/rds-postgres-db/main.tf

@@ -9,8 +9,8 @@ resource "random_pet" "db_id" {
 locals {
   db_username             = var.username
   db_password             = length(var.password) > 0 ? var.password : random_password.db_password.result
-  db_identifier           = length(var.identifier) > 0 ? var.identifier : "edsf-db-demo-${random_pet.db_id.id}"
-  db_name                 = length(var.name) > 0 ? var.name : replace("edsf-db-demo-${random_pet.db_id.id}", "-", "_")
+  db_identifier           = length(var.identifier) > 0 ? var.identifier : join("-", [var.name_prefix, random_pet.db_id.id])
+  db_name                 = length(var.name) > 0 ? var.name : replace(join("-", [var.name_prefix, random_pet.db_id.id]), "-", "_")
   cloudwatch_stream_names = ["postgresql"]
 }
 

modules/aws/rds-postgres-db/variables.tf

@@ -28,6 +28,12 @@ variable "identifier" {
   }
 }
 
+variable "name_prefix" {
+  type        = string
+  description = "Prefix to the name to identify all resources"
+  default     = "imperva-dsf-postgres"
+}
+
 variable "name" {
   type        = string
   description = "Name of your rds instance"

modules/aws/sonar-base-instance/iam_role.tf

@@ -59,22 +59,22 @@ locals {
 
 resource "aws_iam_instance_profile" "dsf_node_instance_iam_profile" {
   count       = var.instance_profile_name == null ? 1 : 0
-  name_prefix = "${var.name}-${var.resource_type}-instance-iam-profile"
+  name_prefix = join("-", [var.name, var.resource_type, "instance-iam-profile"])
   role        = local.role_name
   tags        = var.tags
 }
 
 resource "aws_iam_role" "dsf_node_role" {
   count               = var.instance_profile_name == null ? 1 : 0
-  name                = "${var.name}-role"
+  name                = join("-", [var.name, "role"])
   managed_policy_arns = null
   assume_role_policy  = local.role_assume_role_policy
   inline_policy {
-    name   = "${var.name}-s3-access"
+    name   = join("-", [var.name, "s3-access"])
     policy = local.inline_policy_s3
   }
   inline_policy {
-    name   = "${var.name}-secret-access"
+    name   = join("-", [var.name, "secret-access"])
     policy = local.inline_policy_secret
   }
   tags = var.tags

modules/azurerm/mssql-db/main.tf

@@ -8,7 +8,7 @@ resource "random_pet" "db_id" {}
 locals {
   db_username      = var.username
   db_password      = length(var.password) > 0 ? var.password : random_password.db_password.result
-  db_identifier    = length(var.identifier) > 0 ? var.identifier : "edsf-db-demo-${random_pet.db_id.id}"
+  db_identifier    = length(var.identifier) > 0 ? var.identifier : join("-", [var.name_prefix, random_pet.db_id.id])
   db_address       = "${local.db_identifier}.database.windows.net"
   server_name      = local.db_identifier
   database_name    = local.db_identifier

modules/azurerm/mssql-db/variables.tf

@@ -36,6 +36,12 @@ variable "identifier" {
   }
 }
 
+variable "name_prefix" {
+  type        = string
+  description = "Prefix to the name to identify all resources"
+  default     = "imperva-dsf-mssql"
+}
+
 variable "security_group_ingress_cidrs" {
   type        = list(string)
   description = "List of allowed ingress cidr ranges for access to the database"

permissions_samples/aws/OnboardMssqlRdsWithDataPermissions.txt

@@ -240,10 +240,8 @@
                 "s3:PutAccountPublicAccessBlock"
             ],
             "Resource": [
-                "arn:aws:s3:::dsf-sql-scripts-bucket*",
-                "arn:aws:s3:::dsf-sql-scripts-bucket*/*",
-                "arn:aws:s3:::edsf-db-demo*",
-                "arn:aws:s3:::edsf-db-demo*/*"
+                "arn:aws:s3:::imperva-dsf-*",
+                "arn:aws:s3:::imperva-dsf-*/*"
             ]
         }
     ]