aquasecurity/aqua-aws

The repository not supported any more. Please use this one https://github.com/aquasecurity/deployments

aqua-aws's Issues

Support AssignPublicIp Private

Please extend support for AssignPublicIp flag in the actual CloudFormation template.

Support Connecting to Pre-existing DB

This would be helpful for upgrades where we can specify an already established Postgres database endpoint.

AquaConsole Load Balancer is Always Internet-facing

Deployed Aqua from this branch using private subnets and CIDR blocks only from private IP addressing space (10.X.X.X).

After deployment, the aquaNlb is Internal (expected), but the AquaConsole is Internet-facing, even after specifying in the CloudFormation template to use private subnets and private CIDR blocks (unexpected).

Please submit a toggle or a way to specify whether the AquaConsole can use Internal or Internet-facing scheme.

Updating the AllowedValues of RdsInstanceClass

Currently, RDS instances such as Nitro generation T3 and R5 are available for RDS instances.

Reference URL: https://aws.amazon.com/rds/instance- types/

In the CloudFormation template file "aquaEcs.yaml" The following values are added to RdsInstanceClass of Parameters. We believe it is better to do so.

• T3
• M5
• R5

Runtime go 1.x for aqua-lambda will be deprecated 31 dec 2023

The aqua-lambda is using a runtime that will soon be deprecated:
See https://aws.amazon.com/blogs/compute/migrating-aws-lambda-functions-from-the-go1-x-runtime-to-the-custom-runtime-on-amazon-linux-2/#:~:text=Lambda%20is%20deprecating%20the%20go1,al2%20runtime.

Resources:
aquaAuditHandlerFunction:
Type: AWS::Serverless::Function
Properties:
Handler: auditlambda
Runtime: go1.x

LoadBalancer creation needed strings for subnets (not list)

I needed to change lines 211 & 399 to use "[ !Ref LbSubnet1, !Ref LbSubnet2 ]" notation with 2 new variables rather than "!Ref LbSubnets"

Verbiage change

Please change Select Yes to create a separate Manage RDS instance for Audit' to something like 'Select Yes if you have a separate AuditDB Endpoint' under Aqua Manage DB Configuration.

https://github.com/aquasecurity/aqua-aws/blob/6.0/cloudformation/aqua-ecs-ec2/aquaEcs-external.yaml
https://github.com/aquasecurity/aqua-aws/blob/6.0/cloudformation/aqua-ecs-fargate/ecs-fargate-nonSSL-external.yaml
https://github.com/aquasecurity/aqua-aws/blob/6.0/cloudformation/aqua-ecs-fargate/aquaFargate-external.yaml

Expected use of Aqua database container

Surprised there is no reference to the Aqua database container (only Server, Gateway, and Enforcer). Although it creates the RDS instance, no data is loaded.