Skip to content

Commit b5ee69f

Browse files
samrosesamrose
committed
feat: organize into ami build and deployed
1 parent 7b6dce3 commit b5ee69f

28 files changed

+458
-2
lines changed

‎ansible/files/cis_baseline_check.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
set -euo pipefail
1010

11-
BASELINES_DIR="${1:-/tmp/ansible-playbook/audit-specs/baselines}"
11+
BASELINES_DIR="${1:-/tmp/ansible-playbook/audit-specs/baselines/ami-build}"
1212

1313
echo "============================================================"
1414
echo "Baseline Validation"

‎ansible/playbook.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@
223223
- name: Run CIS baseline validation
224224
become: yes
225225
shell: |
226-
/bin/bash /tmp/ansible-playbook/ansible/files/cis_baseline_check.sh /tmp/ansible-playbook/audit-specs/baselines
226+
/bin/bash /tmp/ansible-playbook/ansible/files/cis_baseline_check.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build
227227
when: stage2_nix
228228

229229
- name: Remove supascan after validation

‎audit-specs/baselines/ami-build/group.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Group baseline for AMI build
2+
# Checks that critical system and application groups exist
3+
# GIDs may vary between builds - only checking existence
4+
group:
5+
# System groups
6+
root:
7+
exists: true
8+
sudo:
9+
exists: true
10+
adm:
11+
exists: true
12+
admin:
13+
exists: true
14+
users:
15+
exists: true
16+
nogroup:
17+
exists: true
18+
ubuntu:
19+
exists: true
20+
21+
# PostgreSQL ecosystem
22+
postgres:
23+
exists: true
24+
pgbouncer:
25+
exists: true
26+
wal-g:
27+
exists: true
28+
ssl-cert:
29+
exists: true
30+
31+
# Supabase services
32+
gotrue:
33+
exists: true
34+
postgrest:
35+
exists: true
36+
adminapi:
37+
exists: true
38+
kong:
39+
exists: true
40+
envoy:
41+
exists: true
42+
nginx:
43+
exists: true
44+
vector:
45+
exists: true
46+
supabase-admin-agent:
47+
exists: true
48+
49+
# System service groups
50+
messagebus:
51+
exists: true
52+
systemd-network:
53+
exists: true
54+
systemd-resolve:
55+
exists: true
56+
systemd-timesync:
57+
exists: true
58+
systemd-journal:
59+
exists: true
60+
polkitd:
61+
exists: true
62+
tcpdump:
63+
exists: true
64+
_ssh:
65+
exists: true
66+
salt:
67+
exists: true
68+
69+
# Nix
70+
nixbld:
71+
exists: true
72+
73+
# Other system groups
74+
disk:
75+
exists: true
76+
tty:
77+
exists: true
78+
audio:
79+
exists: true
80+
video:
81+
exists: true
82+
plugdev:
83+
exists: true
84+
netdev:
85+
exists: true
86+
lxd:
87+
exists: true
88+
crontab:
89+
exists: true

‎audit-specs/baselines/ami-build/mount.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Mount baseline for AMI build
2+
# Only checks that critical mounts exist with correct filesystem type
3+
# Mount options vary by kernel version and environment - not checked
4+
mount:
5+
/:
6+
exists: true
7+
filesystem: ext4
8+
/boot/efi:
9+
exists: true
10+
filesystem: vfat
11+
/data:
12+
exists: true
13+
filesystem: ext4
14+
/dev:
15+
exists: true
16+
filesystem: devtmpfs
17+
/dev/pts:
18+
exists: true
19+
filesystem: devpts
20+
/dev/shm:
21+
exists: true
22+
filesystem: tmpfs
23+
/proc:
24+
exists: true
25+
filesystem: proc
26+
/run:
27+
exists: true
28+
filesystem: tmpfs
29+
/sys:
30+
exists: true
31+
filesystem: sysfs
32+
/sys/fs/cgroup:
33+
exists: true
34+
filesystem: cgroup2

‎audit-specs/baselines/ami-build/package.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
# Package baseline for AMI build
2+
# Only checks that critical packages are installed - no version checks
3+
# Version drift is expected between builds
4+
package:
5+
# Core system
6+
bash:
7+
installed: true
8+
coreutils:
9+
installed: true
10+
systemd:
11+
installed: true
12+
systemd-sysv:
13+
installed: true
14+
apt:
15+
installed: true
16+
dpkg:
17+
installed: true
18+
19+
# Security
20+
apparmor:
21+
installed: true
22+
apparmor-utils:
23+
installed: true
24+
auditd:
25+
installed: true
26+
fail2ban:
27+
installed: true
28+
ufw:
29+
installed: true
30+
nftables:
31+
installed: true
32+
ca-certificates:
33+
installed: true
34+
openssl:
35+
installed: true
36+
37+
# Networking
38+
openssh-server:
39+
installed: true
40+
curl:
41+
installed: true
42+
wget:
43+
installed: true
44+
iproute2:
45+
installed: true
46+
47+
# Cloud
48+
cloud-init:
49+
installed: true
50+
cloud-guest-utils:
51+
installed: true
52+
ec2-instance-connect:
53+
installed: true
54+
amazon-ec2-utils:
55+
installed: true
56+
57+
# PostgreSQL ecosystem (installed via nix, but system deps needed)
58+
libpq5:
59+
installed: true
60+
61+
# Supabase components
62+
vector:
63+
installed: true
64+
65+
# Build/runtime dependencies
66+
locales:
67+
installed: true
68+
acl:
69+
installed: true
70+
sudo:
71+
installed: true
72+
logrotate:
73+
installed: true
74+
sysstat:
75+
installed: true
76+
acpid:
77+
installed: true
78+
at:
79+
installed: true
80+
cron:
81+
installed: true
82+
83+
# Grub/boot
84+
grub-common:
85+
installed: true
86+
grub-efi-arm64:
87+
installed: true
88+
efibootmgr:
89+
installed: true
90+
initramfs-tools:
91+
installed: true
92+
93+
# Filesystem
94+
e2fsprogs:
95+
installed: true
96+
gdisk:
97+
installed: true
98+
99+
# Python (needed for ansible and scripts)
100+
python3:
101+
installed: true
102+
103+
# Compression
104+
gzip:
105+
installed: true
106+
bzip2:
107+
installed: true
108+
xz-utils:
109+
installed: true
110+
zstd:
111+
installed: true

‎audit-specs/baselines/ami-build/service.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# Service baseline for AMI build
2+
# Only checks that critical services exist - not their enabled/running state during build
3+
# Services are configured but many are stopped during AMI build process
4+
service:
5+
# Core system services (should be running during build)
6+
cron:
7+
enabled: true
8+
running: true
9+
cloud-config:
10+
enabled: true
11+
running: true
12+
cloud-final:
13+
enabled: true
14+
running: true
15+
cloud-init:
16+
enabled: true
17+
running: true
18+
cloud-init-local:
19+
enabled: true
20+
running: true
21+
systemd-resolved:
22+
enabled: true
23+
running: true
24+
systemd-timesyncd:
25+
enabled: true
26+
running: true
27+
ufw:
28+
enabled: true
29+
running: true
30+
unattended-upgrades:
31+
enabled: true
32+
running: true
33+
sysstat:
34+
enabled: true
35+
running: true
36+
nix-daemon:
37+
enabled: false
38+
running: true
39+
nftables:
40+
enabled: false
41+
running: true
42+
ssh:
43+
enabled: false
44+
running: true
45+
atd:
46+
enabled: true
47+
running: true
48+
getty@tty1:
49+
enabled: true
50+
running: true
51+
grub-common:
52+
enabled: true
53+
running: false
54+
grub-initrd-fallback:
55+
enabled: true
56+
running: false
57+
hibinit-agent:
58+
enabled: true
59+
running: false
60+
ec2-instance-connect-harvest-hostkeys:
61+
enabled: true
62+
running: false
63+
networkd-dispatcher:
64+
enabled: true
65+
running: false
66+
systemd-pstore:
67+
enabled: true
68+
running: false
69+
e2scrub_reap:
70+
enabled: true
71+
running: false
72+
73+
# Supabase services - these are STOPPED during AMI build but should exist
74+
# We check enabled: false because they're disabled during build
75+
postgresql:
76+
enabled: false
77+
running: false
78+
pgbouncer:
79+
enabled: false
80+
running: false
81+
postgrest:
82+
enabled: false
83+
running: false
84+
gotrue:
85+
enabled: false
86+
running: false
87+
adminapi:
88+
enabled: false
89+
running: false
90+
envoy:
91+
enabled: false
92+
running: false
93+
vector:
94+
enabled: false
95+
running: false
96+
postgres_exporter:
97+
enabled: false
98+
running: false
99+
pg_egress_collect:
100+
enabled: false
101+
running: false
102+
fail2ban:
103+
enabled: false
104+
running: false
105+
auditd:
106+
enabled: false
107+
running: false
108+
apparmor:
109+
enabled: false
110+
running: false
111+
112+
# Services that should not be running
113+
kong:
114+
enabled: false
115+
running: false
116+
supabase-admin-agent_salt:
117+
enabled: false
118+
running: false
119+
database-optimizations:
120+
enabled: false
121+
running: false
122+
postgrest-optimizations:
123+
enabled: false
124+
running: false
125+
NetworkManager:
126+
enabled: false
127+
running: false
128+
firewalld:
129+
enabled: false
130+
running: false
131+
iptables:
132+
enabled: false
133+
running: false
134+
display-manager:
135+
enabled: false
136+
running: false

0 commit comments

Comments
 (0)