automated terminal push

ansible/configure_ecs.yml

@@ -1,49 +1,493 @@
 ---
-- name: Configure EC2 for ECS Cluster
+- name: Configure and Deploy ECS Application (Enterprise Security)
   hosts: inventory_hosts
-  become: yes
-
+  # DO NOT use blanket root access
+  become: no
+  gather_facts: yes
   vars:
     ecs_cluster_name: "nvhi-atsila-cluster"
+    service_name: "nvhi-atsila-cluster-service"
+    task_family: "nvhi-atsila-cluster-task"
+    container_name: "nvhi-atsila-microservice"
+    app_version: "{{ app_version | default('latest') }}"
+    aws_region: "{{ aws_region | default('us-east-2') }}"
+    log_group: "/ecs/{{ ecs_cluster_name }}"
+    # Security: Use dedicated service account
+    ecs_user: "ecs-user"
+    ecs_group: "ecs-group"
+    
+  pre_tasks:
+    - name: Validate required variables
+      assert:
+        that:
+          - ecs_cluster_name is defined
+          - aws_region is defined
+          - aws_account_id is defined
+          - task_execution_role_arn is defined
+        fail_msg: "Required variables missing. Check app_version, aws_account_id, task_execution_role_arn"
+      tags: [validation]
+
+    - name: Test connectivity
+      ping:
+      tags: [validation]
+
+    # Security: Create dedicated service account
+    - name: Create ECS service group
+      group:
+        name: "{{ ecs_group }}"
+        state: present
+      become: yes
+      become_user: root
+      tags: [security, users]
+
+    - name: Create ECS service user
+      user:
+        name: "{{ ecs_user }}"
+        group: "{{ ecs_group }}"
+        system: yes
+        shell: /bin/bash
+        home: /home/{{ ecs_user }}
+        create_home: yes
+        state: present
+      become: yes
+      become_user: root
+      tags: [security, users]
+
+    - name: Add ECS user to docker group
+      user:
+        name: "{{ ecs_user }}"
+        groups: docker
+        append: yes
+      become: yes
+      become_user: root
+      tags: [security, users]
 
   tasks:
-    - name: Update all packages
+    # Infrastructure Setup - Only escalate when necessary
+    - name: Update system packages
       yum:
         name: '*'
         state: latest
+        update_cache: yes
+      become: yes
+      become_user: root
+      async: 300
+      poll: 0
+      register: yum_update
+      tags: [infrastructure]
 
-    - name: Install Docker
-      yum:
-        name: docker
-        state: present
+    - name: Wait for package update to complete
+      async_status:
+        jid: "{{ yum_update.ansible_job_id }}"
+      register: update_result
+      until: update_result.finished
+      retries: 30
+      delay: 10
+      tags: [infrastructure]
 
-    - name: Install ECS init
+    - name: Install required packages
       yum:
-        name: ecs-init
+        name:
+          - docker
+          - ecs-init
+          - curl
+          - wget
+          - jq
         state: present
+      become: yes
+      become_user: root
+      retries: 3
+      delay: 5
+      tags: [infrastructure]
+
+    # Security: Configure Docker securely
+    - name: Create Docker configuration directory
+      file:
+        path: /etc/docker
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+      become: yes
+      become_user: root
+      tags: [infrastructure, security]
+
+    - name: Configure Docker daemon securely
+      copy:
+        dest: /etc/docker/daemon.json
+        content: |
+          {
+            "log-driver": "json-file",
+            "log-opts": {
+              "max-size": "100m",
+              "max-file": "3"
+            },
+            "live-restore": true,
+            "userland-proxy": false,
+            "no-new-privileges": true
+          }
+        mode: '0644'
+        owner: root
+        group: root
+      become: yes
+      become_user: root
+      notify: restart docker
+      tags: [infrastructure, security]
 
     - name: Start and enable Docker
-      service:
+      systemd:
         name: docker
         state: started
         enabled: true
+        daemon_reload: true
+      become: yes
+      become_user: root
+      register: docker_service
+      tags: [infrastructure]
 
+    - name: Verify Docker is running
+      command: docker info
+      register: docker_check
+      failed_when: docker_check.rc != 0
+      retries: 3
+      delay: 5
+      changed_when: false
+      # Security: Run as regular user (ECS user is in docker group)
+      become: yes
+      become_user: "{{ ecs_user }}"
+      tags: [infrastructure, validation]
+
+    # Security: Create ECS directory with proper permissions
     - name: Create ECS config directory
       file:
         path: /etc/ecs
         state: directory
         mode: '0755'
+        owner: root
+        group: "{{ ecs_group }}"
+      become: yes
+      become_user: root
+      tags: [infrastructure, security]
 
-    - name: Write ECS config file
+    - name: Configure ECS agent
       copy:
         dest: /etc/ecs/ecs.config
         content: |
           ECS_CLUSTER={{ ecs_cluster_name }}
           ECS_AVAILABLE_LOGGING_DRIVERS=["json-file","awslogs"]
+          ECS_ENABLE_TASK_IAM_ROLE=true
+          ECS_ENABLE_CONTAINER_METADATA=true
+          ECS_CONTAINER_STOP_TIMEOUT=30s
+          # Security: Disable privileged containers by default
+          ECS_DISABLE_PRIVILEGED=true
+          # Security: Enable AppArmor/SELinux support
+          ECS_SELINUX_CAPABLE=true
+          ECS_APPARMOR_CAPABLE=true
+        mode: '0640'  # Security: More restrictive permissions
+        owner: root
+        group: "{{ ecs_group }}"  # Security: Group ownership for ECS
+        backup: yes
+      become: yes
+      become_user: root
+      notify: restart ecs
+      tags: [infrastructure, security]
+
+    # Security: Configure ECS agent service with proper user
+    - name: Create ECS service override directory
+      file:
+        path: /etc/systemd/system/ecs.service.d
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+      become: yes
+      become_user: root
+      tags: [infrastructure, security]
+
+    - name: Configure ECS service security settings
+      copy:
+        dest: /etc/systemd/system/ecs.service.d/security.conf
+        content: |
+          [Service]
+          # Security: Additional hardening
+          NoNewPrivileges=true
+          ProtectSystem=strict
+          ProtectHome=true
+          PrivateTmp=true
+          # Allow access to ECS directories
+          ReadWritePaths=/var/lib/ecs /var/log/ecs /etc/ecs
         mode: '0644'
+        owner: root
+        group: root
+      become: yes
+      become_user: root
+      notify: 
+        - reload systemd
+        - restart ecs
+      tags: [infrastructure, security]
 
     - name: Start and enable ECS agent
-      service:
+      systemd:
         name: ecs
         state: started
-        enabled: true
+        enabled: true
+        daemon_reload: true
+      become: yes
+      become_user: root
+      tags: [infrastructure]
+
+    - name: Wait for ECS agent to register
+      shell: |
+        count=0
+        while [ $count -lt 30 ]; do
+          instances=$(aws ecs list-container-instances --cluster {{ ecs_cluster_name }} --region {{ aws_region }} --query 'length(containerInstanceArns)' --output text 2>/dev/null || echo "0")
+          if [ "$instances" != "0" ] && [ "$instances" != "None" ]; then
+            echo "ECS agent registered successfully"
+            exit 0
+          fi
+          echo "Waiting for ECS agent registration (attempt $((count+1))/30)..."
+          sleep 10
+          count=$((count+1))
+        done
+        echo "ECS agent failed to register"
+        exit 1
+      environment:
+        AWS_DEFAULT_REGION: "{{ aws_region }}"
+      delegate_to: localhost
+      run_once: true
+      # Security: Run AWS CLI as regular user with proper AWS credentials
+      become: no
+      tags: [infrastructure]
+
+    # Application Deployment - No root required
+    - name: Create CloudWatch log group
+      shell: |
+        aws logs create-log-group --log-group-name "{{ log_group }}" --region {{ aws_region }} 2>/dev/null || echo "Log group exists"
+        aws logs put-retention-policy --log-group-name "{{ log_group }}" --retention-in-days 7 --region {{ aws_region }} 2>/dev/null || echo "Retention policy exists"
+      environment:
+        AWS_DEFAULT_REGION: "{{ aws_region }}"
+      delegate_to: localhost
+      run_once: true
+      # Security: No root required for AWS API calls
+      become: no
+      tags: [deployment]
+
+    # Security: Create temp file in user's home directory
+    - name: Create task definition file
+      copy:
+        dest: "/tmp/task-definition-{{ ansible_date_time.epoch }}.json"
+        content: |
+          {
+            "family": "{{ task_family }}",
+            "executionRoleArn": "{{ task_execution_role_arn }}",
+            "networkMode": "bridge",
+            "requiresCompatibilities": ["EC2"],
+            "cpu": "256",
+            "memory": "512",
+            "containerDefinitions": [
+              {
+                "name": "{{ container_name }}",
+                "image": "{{ aws_account_id }}.dkr.ecr.{{ aws_region }}.amazonaws.com/{{ container_name }}:{{ app_version }}",
+                "cpu": 256,
+                "memory": 512,
+                "essential": true,
+                "user": "1000:1000",
+                "readonlyRootFilesystem": true,
+                "portMappings": [
+                  {
+                    "containerPort": 8080,
+                    "hostPort": 8080,
+                    "protocol": "tcp"
+                  }
+                ],
+                "logConfiguration": {
+                  "logDriver": "awslogs",
+                  "options": {
+                    "awslogs-group": "{{ log_group }}",
+                    "awslogs-region": "{{ aws_region }}",
+                    "awslogs-stream-prefix": "ecs"
+                  }
+                },
+                "healthCheck": {
+                  "command": [
+                    "CMD-SHELL",
+                    "curl -f http://localhost:8080/health || exit 1"
+                  ],
+                  "interval": 30,
+                  "timeout": 5,
+                  "retries": 3,
+                  "startPeriod": 60
+                },
+                "tmpfs": [
+                  {
+                    "containerPath": "/tmp",
+                    "size": 100
+                  }
+                ],
+                "mountPoints": [],
+                "volumesFrom": []
+              }
+            ]
+          }
+        mode: '0644'
+        # Security: File owned by current user, not root
+        owner: "{{ ansible_user | default(ansible_ssh_user) }}"
+        group: "{{ ansible_user | default(ansible_ssh_user) }}"
+      delegate_to: localhost
+      run_once: true
+      # Security: No root required
+      become: no
+      register: task_def_file
+      tags: [deployment, security]
+
+    - name: Register task definition
+      shell: |
+        aws ecs register-task-definition \
+          --cli-input-json file://{{ task_def_file.dest }} \
+          --region {{ aws_region }} \
+          --output json
+      environment:
+        AWS_DEFAULT_REGION: "{{ aws_region }}"
+      delegate_to: localhost
+      run_once: true
+      # Security: No root required for AWS API calls
+      become: no
+      register: task_registration
+      tags: [deployment]
+
+    - name: Update ECS service
+      shell: |
+        aws ecs update-service \
+          --cluster {{ ecs_cluster_name }} \
+          --service {{ service_name }} \
+          --task-definition {{ task_family }} \
+          --desired-count 1 \
+          --force-new-deployment \
+          --region {{ aws_region }} \
+          --output json
+      environment:
+        AWS_DEFAULT_REGION: "{{ aws_region }}"
+      delegate_to: localhost
+      run_once: true
+      # Security: No root required
+      become: no
+      register: service_update
+      tags: [deployment]
+
+    - name: Wait for service deployment to complete
+      shell: |
+        echo "Waiting for service to stabilize..."
+        count=0
+        while [ $count -lt 30 ]; do
+          service_status=$(aws ecs describe-services \
+            --cluster {{ ecs_cluster_name }} \
+            --services {{ service_name }} \
+            --region {{ aws_region }} \
+            --query 'services[0]' \
+            --output json 2>/dev/null)
+          
+          if [ $? -eq 0 ]; then
+            running=$(echo "$service_status" | jq -r '.runningCount // 0')
+            pending=$(echo "$service_status" | jq -r '.pendingCount // 0')
+            
+            echo "Running: $running, Pending: $pending"
+            
+            if [ "$running" -ge "1" ] && [ "$pending" -eq "0" ]; then
+              echo "Service deployment completed successfully"
+              exit 0
+            fi
+          fi
+          
+          echo "Waiting for deployment completion (attempt $((count+1))/30)..."
+          sleep 20
+          count=$((count+1))
+        done
+        
+        echo "Service deployment did not complete within expected time"
+        exit 1
+      environment:
+        AWS_DEFAULT_REGION: "{{ aws_region }}"
+      delegate_to: localhost
+      run_once: true
+      # Security: No root required
+      become: no
+      tags: [deployment]
+
+    # Health Verification - No root required
+    - name: Wait for application health check
+      uri:
+        url: "http://{{ ansible_default_ipv4.address }}:8080/health"
+        method: GET
+        timeout: 10
+        status_code: 200
+      register: health_check
+      until: health_check.status == 200
+      retries: 10
+      delay: 15
+      # Security: No root required for HTTP requests
+      become: no
+      tags: [verification]
+
+    - name: Display deployment summary
+      debug:
+        msg: |
+          ========================================
+          🎉 SECURE DEPLOYMENT COMPLETED
+          ========================================
+          Cluster: {{ ecs_cluster_name }}
+          Service: {{ service_name }}
+          Task Family: {{ task_family }}
+          Image Version: {{ app_version }}
+          Instance IP: {{ ansible_default_ipv4.address }}
+          Health Status: HEALTHY
+          Security: Non-root containers, least privilege
+          Application URL: http://{{ ansible_default_ipv4.address }}:8080
+          ========================================
+      tags: [reporting]
+
+  handlers:
+    - name: reload systemd
+      systemd:
+        daemon_reload: yes
+      become: yes
+      become_user: root
+
+    - name: restart docker
+      systemd:
+        name: docker
+        state: restarted
+      become: yes
+      become_user: root
+
+    - name: restart ecs
+      systemd:
+        name: ecs
+        state: restarted
+        daemon_reload: true
+      become: yes
+      become_user: root
+
+  post_tasks:
+    - name: Cleanup temporary files
+      file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - "/tmp/task-definition-{{ ansible_date_time.epoch }}.json"
+      delegate_to: localhost
+      # Security: No root required for cleanup
+      become: no
+      tags: [cleanup]
+
+    # Security: Audit log
+    - name: Log deployment action
+      lineinfile:
+        path: /var/log/ecs-deployments.log
+        line: "{{ ansible_date_time.iso8601 }} - Deployment v{{ app_version }} by {{ ansible_user | default('unknown') }} from {{ ansible_env.SSH_CLIENT.split()[0] | default('unknown') }}"
+        create: yes
+        mode: '0644'
+        owner: root
+        group: "{{ ecs_group }}"
+      become: yes
+      become_user: root
+      tags: [audit, security]