new: add policy ecc-aws-872-autoscaling_launch_template_hop_limit

iam/All-permissions_2.json

@@ -14,9 +14,11 @@
 				"kafka:ListClustersV2",
 				"cloudformation:ListStacks",
 				"iam:ListVirtualMFADevices",
-                "cloudwatch:DescribeAlarmsForMetric"
+                "cloudwatch:DescribeAlarmsForMetric",
+				"ec2:DescribeLaunchTemplates",
+				"ec2:DescribeLaunchTemplateVersions"
 			],
 			"Resource": "*"
 		}
 	]
-}
+}

policies/ecc-aws-872-autoscaling_launch_template_hop_limit.yml

@@ -0,0 +1,18 @@
+# Copyright (c) 2024 EPAM Systems, Inc.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+policies:
+  - name: ecc-aws-872-autoscaling_launch_template_hop_limit
+    comment: '010024032000'
+    description: |
+      Auto Scaling launch template hop limit is greater than 1
+    resource: aws.launch-template-version
+    filters:
+      - type: value
+        key: LaunchTemplateData.MetadataOptions.HttpPutResponseHopLimit
+        op: gt
+        value: 1

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/green/asg.tf

@@ -0,0 +1,20 @@
+resource "aws_launch_template" "this" {
+  name_prefix   = "872_launch_template_green"
+  image_id      = data.aws_ami.this.id
+  instance_type = "t2.micro"
+  metadata_options {
+    http_endpoint               = "enabled"
+    http_tokens                 = "required"
+    http_put_response_hop_limit = "1"
+  }
+}
+
+data "aws_ami" "this" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name   = "name"
+    values = ["amzn2-ami-hvm*"]
+  }
+}

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/green/provider.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5"
+    }
+  }
+}
+
+provider "aws" {
+  profile = var.profile
+  region  = var.default-region
+  default_tags {
+    tags = {
+      CustodianRule    = "ecc-aws-872-autoscaling_launch_template_hop_limit"
+      ComplianceStatus = "Green"
+    }
+  }
+}

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/green/terraform.tfvars

@@ -0,0 +1,2 @@
+profile        = "c7n"
+default-region = "us-east-1"

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/green/variables.tf

@@ -0,0 +1,9 @@
+variable "default-region" {
+  type        = string
+  description = "Default region for resources will be created"
+}
+
+variable "profile" {
+  type        = string
+  description = "Profile name configured before running apply"
+}

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/iam/872-policy.json

@@ -0,0 +1,13 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeLaunchTemplateVersions"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/red/asg.tf

@@ -0,0 +1,20 @@
+resource "aws_launch_template" "this" {
+  name_prefix   = "872_launch_template_red"
+  image_id      = data.aws_ami.this.id
+  instance_type = "t2.micro"
+  metadata_options {
+    http_endpoint               = "enabled"
+    http_tokens                 = "required"
+    http_put_response_hop_limit = "5"
+  }
+}
+
+data "aws_ami" "this" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name   = "name"
+    values = ["amzn2-ami-hvm*"]
+  }
+}

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/red/provider.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5"
+    }
+  }
+}
+
+provider "aws" {
+  profile = var.profile
+  region  = var.default-region
+  default_tags {
+    tags = {
+      CustodianRule    = "ecc-aws-872-autoscaling_launch_template_hop_limit"
+      ComplianceStatus = "Red"
+    }
+  }
+}

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/red/terraform.tfvars

@@ -0,0 +1,2 @@
+profile        = "c7n"
+default-region = "us-east-1"

terraform/ecc-aws-872-autoscaling_launch_template_hop_limit/red/variables.tf

@@ -0,0 +1,9 @@
+variable "default-region" {
+  type        = string
+  description = "Default region for resources will be created"
+}
+
+variable "profile" {
+  type        = string
+  description = "Profile name configured before running apply"
+}