feat: add test environment support and standardize GOAD deployment configuration#81
Merged
Conversation
…iven secrets
**Added:**
- Introduced a new GOAD test environment under `infra/goad-deployment/test/`
- Added environment configuration (`env.hcl`) for the test environment, setting
deployment name, AWS account ID, environment, and VPC CIDR
- Created regional configuration (`region.hcl`) for `us-east-2`
- Implemented a new VPC network module for the test environment with SSM/S3 VPC
endpoints and tagging
- Added reusable PowerShell user data templates for domain controllers and
member servers, ensuring TLS 1.2, SSM agent installation, and secure
admin/ansible account setup
- Added wrapper script templates for injecting compressed, base64-encoded
PowerShell user data
- Added terragrunt configuration for deploying domain controllers (`dc01`,
`dc02`, `dc03`) and member servers (`srv02`, `srv03`) in the test
environment, sourcing secrets and host metadata from a single config file
- Introduced a comprehensive test lab configuration in
`ad/GOAD/data/test-config.json` defining hosts, domains, users, groups,
ACLs, and vulnerabilities for the test environment
**Changed:**
- Added prominent region-specific AMI ID warnings and marketplace reference
comments to all AWS provider `linux.tf` and `windows.tf` files for clarity
- Updated `infra/goad-deployment/host.hcl` to use `find_in_parent_folders` for
locating `host-registry.yaml`, improving portability
- Modified `infra/goad-deployment/staging/env.hcl` to auto-discover the AWS
account ID using `get_aws_account_id()`
- Refactored DC and server terragrunt modules (`dc01`, `dc02`, `dc03`, `srv02`,
`srv03`) in `staging/us-west-1/goad`:
- Now read admin passwords directly from the lab config JSON for single
source of truth
- Use mock outputs for dependencies to support `init`, `validate`, `plan`
without AWS resources
- Updated Windows AMI lookup logic to filter by AMI name patterns
(`goad-dc-base-*`, `goad-member-base-2016-*`, etc.), removing hardcoded
AMI IDs and supporting most recent self-owned images
- Improved documentation comments and streamlined input blocks
dreadnode-renovate-bot
Bot
added
lab/NHA
l50
force-pushed
the
feat/terraform-terragrunt-updates
branch
from
9b805ed to
76d5774
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
Added:
env.hcl,region.hcl, and VPC/network setup forus-east-2admin password injection from
ad/GOAD/data/test-config.jsonand SSM agent setup in the test environment
test-config.json) for the test environment, supportinghost definitions, domains, users, groups, and vulnerabilities
Changed:
region-specific usage and reference the AWS Marketplace for correct AMI IDs
test) to pull from environment-specific lab config JSON instead of environment
variables, ensuring a single source of truth
host registry file resolution for improved portability and maintainability
AMIs by name glob (
goad-dc-base-*,goad-member-base-2016-*, etc.) andrestricts to AMIs owned by the current account (
owners = ["self"])aws-sdk-go-v2/config,credentials,smithy-go, and others to improvereliability and compatibility
settings_updatesandwazuh_agent_linuxwith task breakdownsRemoved:
Terragrunt host configs, eliminating the risk of password drift or accidental
exposure
confusion and ensure always using up-to-date AMIs