shotaromatsuya / minecraft-server-automation Goto Github PK

View Code? Open in Web Editor NEW

1.0 2.0 0.0 102.64 MB

Building minecraft server on ecs fargate via terraform

HCL 75.72% Dockerfile 2.11% Lua 0.83% Shell 12.02% Python 9.31%

docker ecs-fargate minecraft-server terraform tflint tfsec fluentbit

minecraft-server-automation's People

Contributors

Stargazers

Watchers

minecraft-server-automation's Issues

Fix code scanning alert - IAM policy should avoid use of wildcards and instead apply the principle of least privilege

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/16

Fix code scanning alert - Instances in a subnet should not receive a public IP address by default.

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/6

ユーザーログをslack通知

参加ユーザーがゲームオーバーになったログ、実績解除したログなどをslackに通知したい

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository. View logs.

WARN: Use matchDepNames instead of matchPackageNames
WARN: Invalid hashicorp constraint

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

chore(deps): update actions/checkout digest to 692973e
chore(deps): update secretlint monorepo to v8.2.4 (@secretlint/secretlint-rule-preset-recommend, secretlint)
🔐 Create all rate-limited PRs at once 🔐

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

chore(deps): update terraform terraform-aws-modules/alb/aws to v9

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

docker-compose

docker-compose.yml

dockerfile

docker/fluentbit/Dockerfile

amazon/aws-for-fluent-bit sha256:f89e4ab5ef51eead950717b99932414ffb1ca01aeb18084ec4314f9c32382b64

docker/fluentbit/Dockerfile.local

amazon/aws-for-fluent-bit sha256:f89e4ab5ef51eead950717b99932414ffb1ca01aeb18084ec4314f9c32382b64

docker/minecraft/Dockerfile

itzg/minecraft-server sha256:9d3d3d2bf46c7dcbb31001078407b4555f7759869f3d35eda4cfe36d660899ce

docker/minecraft/Dockerfile.local

itzg/minecraft-server sha256:9d3d3d2bf46c7dcbb31001078407b4555f7759869f3d35eda4cfe36d660899ce

docker/minecraft/Dockerfile.restore

itzg/minecraft-server sha256:9d3d3d2bf46c7dcbb31001078407b4555f7759869f3d35eda4cfe36d660899ce

github-actions

.github/workflows/action_lint.yml

actions/checkout v4

.github/workflows/apply.yml

actions/checkout v4

aws-actions/configure-aws-credentials v4

hashicorp/setup-terraform v3

.github/workflows/auto-approve.yml

hmarr/auto-approve-action v3

.github/workflows/auto-assign-author.yml

technote-space/assign-author v1

.github/workflows/backup.yml

actions/checkout v4

aws-actions/configure-aws-credentials v4

.github/workflows/build_image.yml

actions/checkout v4

aws-actions/configure-aws-credentials v4

actions/setup-go v5

docker/setup-buildx-action v3

technote-space/get-diff-action v6.1.2

actions/github-script v7

aws-actions/amazon-ecr-login v2

.github/workflows/drift.yml

actions/checkout v4

aws-actions/configure-aws-credentials v4

hashicorp/setup-terraform v3

rtCamp/action-slack-notify v2

rtCamp/action-slack-notify v2

.github/workflows/release-drafter.yml

release-drafter/release-drafter v5

.github/workflows/release-to-branch.yml

actions/checkout v4@b4ffde65f46336ab88eb53be808477a3936bae11

.github/workflows/retore-and-set-recoverypoint.yml

actions/checkout v4

aws-actions/configure-aws-credentials v4

hashicorp/setup-terraform v3

rtCamp/action-slack-notify v2

rtCamp/action-slack-notify v2

.github/workflows/schedule_job.yml

actions/checkout v4

aws-actions/configure-aws-credentials v4

hashicorp/setup-terraform v3

rtCamp/action-slack-notify v2

rtCamp/action-slack-notify v2

.github/workflows/secret_lint.yml

actions/checkout v4

actions/setup-node v4

.github/workflows/terraform_ci.yml

actions/checkout v4

technote-space/get-diff-action v6.1.2

aws-actions/configure-aws-credentials v4

hashicorp/setup-terraform v3

actions/github-script v7

actions/github-script v7

actions/github-script v7.0.1

aquasecurity/tfsec-pr-commenter-action v1.3.1

aquasecurity/tfsec-sarif-action v0.1.4

github/codeql-action v3

actions/github-script v7

jenkins

docker/minecraft/plugins.txt

npm

package.json

@secretlint/secretlint-rule-preset-recommend ^8.0.0

secretlint ^8.0.0

pip_requirements

terraform/modules/slash_command/fixtures/python3.9/requirements.txt

urllib3 <2

terraform

terraform/keeping/main.tf

terraform/keeping/versions.tf

aws 5.41.0

null 3.2.2

hashicorp/terraform ~> 1.2

terraform/modules/chatbot/chatbot.tf

waveaccounting/chatbot-slack-configuration/aws 1.1.0

terraform/modules/lambda/lambda.tf

terraform-aws-modules/lambda/aws 6.5.0

terraform/modules/nlb/nlb.tf

terraform-aws-modules/alb/aws 8.7.0

terraform/modules/slash_command/lambda.tf

terraform-aws-modules/lambda/aws 6.5.0

terraform/modules/vpc/security_group.tf

terraform-aws-modules/security-group/aws 5.1.0

terraform-aws-modules/security-group/aws 5.1.0

terraform/modules/vpc/vpc.tf

terraform-aws-modules/vpc/aws 5.5.2

terraform/scheduling/main.tf

terraform/scheduling/versions.tf

aws 5.41.0

null 3.2.2

hashicorp/terraform ~> 1.2

Check this box to trigger a request for Renovate to run again on this repository

Schedule job actionでは最新ワールドデータからrestoreするように修正

Fix code scanning alert - IAM policy should avoid use of wildcards and instead apply the principle of least privilege

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/17

BackUpジョブのstate changeを監視する

参照リンク

eventbridgeを使用しイベント監視する
https://docs.aws.amazon.com/ja_jp/aws-backup/latest/devguide/eventbridge.html
cloudwatch metric alarmを使用する
https://docs.aws.amazon.com/ja_jp/aws-backup/latest/devguide/cloudwatch.html

An error occurred (AccessDenied) when calling the DeleteObject operation: Access Denied

{"date":"2023-09-30T14:01:53.152023Z","jst_time":"2023-09-30T23:01:53.152023Z","log":"delete failed: s3://minecraft-backend/backups/2023-09-30/minecraft-20230930130807.tar.gz An error occurred (AccessDenied) when calling the DeleteObject operation: Access Denied","tag":"minecraft","source":"stderr","container_name":"minecraft"}

EFSのassume roleの修正

バックアップジョブがfailしていたので権限の修正が必要と思われる
ログ詳細
assumed-role/AWSServiceRoleForBackup/AWSBackup-AWSServiceRoleForBackup is not authorized to perform: elasticfilesystem:DescribeTags on the specified resource

特定のbackupからworldをrestoreできるようにする

現状は最新のworldのbackupをrestoreをするようにEntrypointで指定しているが、最新以外のbackup(特定の日時のもの)を指定してEntrypointから復元できるようにしたい。

shellcheck reported issue in this script: SC2001:style:3:17

.github/workflows/build_image.yml:84:9: shellcheck reported issue in this script: SC2001:style:3:17: See if you can use ${variable//search/replace} instead [shellcheck]
   |
84 |         run: |
   |         ^~~~

Error: Process completed with exit code 1.

Fix code scanning alert - IAM policy should avoid use of wildcards and instead apply the principle of least privilege

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/18

Fix code scanning alert - Load balancer is exposed to the internet.

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/10

Fix code scanning alert - IAM policy should avoid use of wildcards and instead apply the principle of least privilege

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/14

Fix code scanning alert - An egress security group rule allows traffic to /0.

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/3

Fix code scanning alert - IAM policy should avoid use of wildcards and instead apply the principle of least privilege

Tracking issue for:

https://github.com/ShotaroMatsuya/minecraft-server-automation/security/code-scanning/15

リソースの仕分け

persistするリソースとrecreateするリソースを分離し、それぞれ別のstateで管理する

CloudWatchLogsにminecraft tailログが出力されていない

S3には出力されているが、cloudwatch log groupにminecraft由来のログがroutingされていない。
そのためsubscription filterが作成できない。
fluentbit streamのタグ付与を再度見直す必要ありそう

cron式でeventbridegeトリガーを定義し、codebuildプロジェクトを呼び出す
codebuildプロジェクトでは、ecs task definitionの更新やs3バケットへのworld dataのバックアップ、リストアjobを定義する (terraformコマンドを実行する)
アーティファクト用s3とecrレジストリはterraformの管理下には含めない（誤ってdestoryされないようにするため予め手動作成する）