> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastfoundation.nimble.la/llms.txt
> Use this file to discover all available pages before exploring further.
# Changelog
> Fresh updates, powerful features—see what’s new and what’s next!
# Version 1.5.0
v1.5.0 is the most significant Fast Foundation release to date. The module architecture was redesigned for faster, safer upgrades; new accounts now get automatic compliance baselines; the access management system was rebuilt for much greater flexibility; and dozens of security, monitoring, and reliability improvements were shipped across the board.
## Architecture: Module Repository
All 30 reusable Terraform modules were extracted into a dedicated repository with independent versioning. Each module is pinned to its own git tag (`/v1.5.0`), enabling individual module updates without touching the rest of the stack -- faster rollouts, smaller blast radius, and cleaner dependency management.
## Breaking Changes
* **SSO Module: N:M Permission Set Refactor** -- The SSO module was completely rebuilt. Permission sets are now defined independently and reused across groups. One group can hold different permission sets on different accounts. This requires a state migration per client.
* **root.hcl: custom\_provider Removal** -- The legacy `custom_provider` disable flag was removed from provider generation.
* **Terraform Version** -- Minimum version bumped from `>= 1.9.0` to `>= 1.11.3`.
## New Modules
* **Firewall Manager** -- AWS Firewall Manager policies and Shield Advanced enrollment across the entire organization, with flexible deployment modes. See [Account Security](/introduction-key-concepts/4-account-security).
* **CloudFormation StackSets** -- New accounts automatically get compliance baselines (AWS Config, security standards). See [Account Security](/introduction-key-concepts/4-account-security).
## Features
* **ECS:** New `family` parameter for task definitions, zero-scale deployments with `desired_count` defaulting to 0, ALB-integrated IAM roles, updated blue/green CodeDeploy configuration, and FireLens log shipping via conditional FluentBit sidecar
* **EKS:** Production Karpenter nodepools now include on-demand instance fallback for workload continuity when Spot capacity is unavailable
* **Security Tooling:** API Gateway added to CloudWatch alarm system, new root user activity alarm, fractional alarm threshold support (e.g., `WriteLatency=0.2`)
* **Secrets & Permissions:** Application cluster permissions refactored with new KMS integration for secrets handling, tighter deployer roles, and updated IRSA configurations
* **Organization:** New outputs for StackSets and Firewall Manager integration, plus a helper script for generating org structures from JSON
## Fixes
* **Alarm Thresholds:** ElastiCache CPU/memory thresholds raised, Lambda duration corrected (60ms → 60s)
* **CloudFront:** Restored `distribution_id` in log delivery source name, fixed S3 log delivery suffix path
* **ACM:** Dynamic hosted zone input support
* **VPN:** Module update with NLB improvements
* **S3 Logging:** WAF logging bucket support
* **OpenSearch:** Cluster setup and snapshot fixes
* **Security Common:** Security Hub configuration updates, alarm Lambda fixes, deterministic packaging for code updater Lambda
* **root.hcl:** Fixed provider filename typo (`providers_terregrunt.tf` → `providers_terragrunt.tf`)
## Security Updates
* axios bumped to 1.13.6
* lodash bumped to 4.17.23
* qs bumped to 6.14.1
* ajv bumped to 8.18.0
## Terraform Provider Versions
| Component | Old (v1.4.2) | New (v1.5.0) |
| -------------- | ------------ | ------------ |
| Terraform | >= 1.9.0 | >= 1.11.3 |
| hashicorp/aws | 6.30.0 | 6.49.0 |
| hashicorp/helm | 3.1.1 | 3.1.1 |
# Version 1.4.2
# Overview
This patch includes multiple fixes, upgrades, and new features, described below:
## Upgrades
* Upgraded Terraform providers and removed unused providers
* Upgraded VPN module
* Upgraded ACM module
## Features
* Added support for CloudFront Standard Logging (v2)
* Added support for blue/green deployments for ECS applications using single or multiple listeners
* Added a new strategy for managing `inputs.hcl` files
* `inputs.hcl` files are now stored in the GitHub repository for tracking and collaboration
* Sensitive parameters can be stored in AWS Systems Manager Parameter Store and are automatically imported during `terraform plan/apply`
* Added a new module for AWS ElastiCache
## Fixes
* Fixed Datadog output in FluentBit configuration
* Fixed automated snapshots misconfiguration in OpenSearch
* Fixed ping port for the new version of the Traefik ingress
* Fixed insufficient permissions in Karpenter by adding the `ListInstanceProfiles` permission
* Fixed Metrics Server add-on installation
* Fixed default name for the Terraform backend S3 bucket
* Added `priorityClassName` to the Datadog Agent so it is always scheduled across all nodes
* Fixed increased Prometheus metrics in the latest release impacting cost and compute efficiency
* Fixed FluentBit alerts
* Fixed EKS control plane log enablement configuration logic
## Terraform Provider Versions
| Component | Old (Helm/App) | New (Helm/App) |
| ------------------- | -------------- | -------------- |
| hashicorp/aws | 5.63.1 | 5.67.0 |
| gavinbunney/kubectl | 1.14.0 | 1.19.0 |
| hashicorp/helm | 2.15.0 | 3.1.0 |
# Version 1.4.1
This patch updates the environment to the latest version of EKS (v1.34), which will remain under standard support until December 2026. It also includes upgrades to related add-ons, tooling, and AWS modules associated with EKS resources.
# Tooling and Terraform Modules Versions
| Component | Old (Helm/App) | New (Helm/App) |
| ------------------------------------- | ------------------------------------------- | ---------------------- |
| coreDNS | – / v1.11.3-eksbuild.1 | – / v1.12.3-eksbuild.1 |
| kube-proxy | – / v1.31.0-eksbuild.2 | – / v1.34.0-eksbuild.2 |
| vpc-cni | – / v1.18.3-eksbuild.2 | – / v1.20.4-eksbuild.1 |
| karpenter | 1.0.6 / – | 1.8.1 / – |
| argo-cd | 7.6.12 / 2.12.6 | 9.0.5 / 3.1.9 |
| linkerd | – / edge-24.10.4 | – / 25.10.6 |
| aws-ebs-csi-driver | 2.42.0 / – | 2.51.0 / 1.51.0 |
| aws-efs-csi-driver | 3.0.8 / 2.0.7 | 3.2.4 / 2.1.13 |
| aws-load-balancer-controller | 1.11.0 / v2.11.0 | 1.14.1 / v2.14.1 |
| secrets-store-csi-driver | 1.4.6 / 1.4.6 | 1.5.4 / 1.5.4 |
| secrets-store-csi-driver-provider-aws | 0.3.9 / 1.0.r2-72-gfb78a36-2024.05.29.23.03 | 2.1.1 / 2.1.0 |
| datadog-operator | 2.1.0 / 1.9.0 | 2.14.3 / 1.19.1 |
| fluent-bit | 0.47.10 / – | 0.54.0 / 4.1.0 |
| kube-prometheus-stack | 65.3.1 / – | 78.5.0 / v0.86.1 |
| node-exporter | – / – | – / 4.48.0 |
| kube-state-metrics | – / – | – / 6.3.0 |
| kubecost | 2.4.2 / – | 3.0.2 / – |
| metrics-server | – / – | 3.12.2 / 0.7.2 |
| prometheus-adapter | 4.11.0 / – | 5.2.0 / – |
| cert-manager | – / v1.16.1 | – / v1.19.1 |
| linkerd-viz | – / 24.10.4 | – / 25.10.6 |
| traefik | 32.1.1 / – | 37.2.0 / v3.5.3 |
| Module | Old Version | New Version | Notes |
| -------------------------------------------------------------------------------------------------------- | ----------- | ----------- | --------------- |
| terraform-aws-modules/eks/aws | 20.24.0 | 21.1.5 | |
| terraform-aws-modules/iam/aws//modules/iam-assumable-role | 5.44.0 | 6.18.0 | |
| terraform-aws-modules/sqs/aws | 4.2.1 | 5.1.0 | |
| terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks → iam-role-for-service-accounts | 5.48.0 | 6.2.2 | Module renamed |
| terraform-aws-modules/iam/aws//modules/iam-assumable-role → iam-role | 5.44.0 | 6.2.2 | Module replaced |
# Version 1.4.0
**Fast Foundation v1.4.0 delivers a major architectural upgrade that dramatically improves your infrastructure’s scalability, security, and operational efficiency. This release leverages Terragrunt and introduces a modular, flexible foundation designed for multi-region resilience, reduced maintenance overhead, and standardized automation across environments.**
**Whether managing a single cloud region or multiple global environments, v1.4.0 enables scaling confidently and quickly while ensuring compliance.**
## Architecture Redesign & Core Enhancements
* **Adopted Terragrunt for infrastructure orchestration**:
* **Centralized configuration and DRY principles across environments**
* **Simplified multi-region, multi-cluster deployments**
* Scalable, environment-specific overrides and reusability of modules
* Clear separation of global vs regional resources in code structure
* **Global Repository Refactor**:
* **Applied modular design with reusable Terraform modules for common components (e.g., networking, IAM, logging)**
* **Isolated environment-specific configurations for improved clarity and separation of concerns**
* Reduced duplication and improved maintainability through standardized structure
## Features
* **New Terraform Modules Added**
* **Route53 and ACM (AWS Certificate Manager) modules** for DNS and TLS automation
* **Custom VPN module**, migrated from Cloud Connexa to pure Terraform, incorporating security and compliance best practices
* **Permissions module** now integrated directly into the core infrastructure repository
## Improvements
* **Universal CI/CD Pipeline**:
* Introduced a standardized pipeline pattern to support the majority of use cases
* Enables consistent delivery, automated testing, and streamlined environment rollout
* **User Management**:
* IAM Role Naming Overhaul. Adopted a new naming convention for IAM roles, optimizing them for automation and manual management
* Enables cleaner policy assignments and reduces friction in permission debugging
* Added a default role for user provisioning and access control enforcement across environments
* **Observability & Automation**:
* **Drift Alert Manager**: Parameter Management Automation where Input files for each Organizational Unit are automatically synchronized with S3 and the integrated drift detection mechanism triggers alerts for unsynced or modified parameters.
* Automated OpenSearch Logging Cluster Provisioning through Lambda-based automation, covering Index creation, Lifecycle policy management, Retention and rollover configuration, removing the need for manual setup and reducing misconfiguration risk
# Version 1.3.2
**This update adds advanced configuration options to improve scalability and control, including topology spread constraints for applications and tag-based customization of alarm behavior in the Alarms Module. Security has been enhanced by restricting who can modify alarm-related tags, and EKS now supports custom cluster security group rules. Karpenter nodepools can exclude specific Availability Zones to improve spot instance reliability. Additionally, a new EBS CSI Driver Helm chart improves EKS deployment stability and speed**
## Features
* **Added topology constraint configurations to Application's charts** - Added topologySpreadConstraints feature to standard application
* **Alarms Module now allows for tag-based custom behavior** - Custom behavior for alarms can now be managed using tags in AWS Resources. This includes enabling/disabling an alarm, and configuring thresholds
* Allowed specific users to create, delete and edit Automatic Alarm Tags in resources - Allowed only alarm Lambda, Karpenter and admin roles to modify alarm-related tags in resources. Increased security for the Alarms Custom Behavior Based on Tags feature
* Added custom cluster security group rules for EKS - Added cluster\_security\_group\_additional\_rules to add security groups to EKS. Changed default values of public and private deploy key parameter name
* Allowed excluding AZs from Karpenter's nodepools - Allow Excluding AZs that do not have good support for ec2 spot instances
## Improvements
* Added EBS CSI Driver Helm Chart - Allows installing EBS driver as separate add-on, increasing EKS deploy stability and decreasing deploy times or errors
## Tooling
| Area | Tool | Current (Chart/App) | Previous | |
| :-------------- | :---------------------------------------------------------------------- | :----------------------- | :--------------- | - |
| FastFoundation | Nucleus | 1.1.0 | | |
| | /modules/access\_groups | 1.0.0 | | |
| | /modules/group\_and\_permissions | 1.0.0 | | |
| Monitoring | Prometheus Stack | 65.3.1 / v0.77.1 | | |
| | Metrics Server | 3.12.1 / 0.7.1 | | |
| | FluentBit | 0.47.10 / 3.1.9 | | |
| Networking | LinkerD Control Plane | 2024.10.4 / edge-24.10.4 | | |
| | LinkerD CRDS | 2024.10.4 | | |
| | LinkerD Viz | 2024.10.4 / edge-24.10.4 | | |
| | cert-manager | v1.16.1 / v1.16.1 | | |
| | Traefik | 32.1.1 / v3.1.6 | | |
| Cost Management | Kubecost | 2.4.2 / 2.4.2 | | |
| Tooling | CSI Secret Store Driver | 1.4.6 / 1.4.6 | | |
| | CSI Secrets Store Provider AWS Secrets | 0.3.9 | | |
| | EBS CSI Controller | v1.36.0-eksbuild.1 | | |
| | EFS CSI Driver | 3.0.8 / 2.0.7 | | |
| | AWS LB Controller | 1.11.0 / v2.11.0 | | |
| Autoscaling | Karpenter | 1.0.6 | | |
| CD | Argo | 7.6.12 / v2.12.6 | | |
| EKS | Kubernetes | 1.31 | | |
| | KubeProxy | v1.31.0-eksbuild.2 | | |
| | CoreDNS | v1.11.3-eksbuild.1 | | |
| | awsnode | v1.18.3-eksbuild.2 | | |
| AWS | OpenSearch | \* | OpenSearch\_2.13 | |
| terraform | terraform-aws-modules/alb/aws | 9.11.0 | | |
| | terraform-aws-modules/cloudfront/aws | 3.4.0 | | |
| | terraform-aws-modules/cloudwatch/aws | 5.5.0 | | |
| | terraform-aws-modules/ecr/aws | 2.2.1 | | |
| | terraform-aws-modules/eks/aws | 20.24.0 | | |
| | terraform-aws-modules/eks/aws/modules/eks-managed-node-group | 20.24.0 | | |
| | terraform-aws-modules/iam/aws | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/assumable-role-with-oidc | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/iam-github-oidc-provider | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/iam-github-oidc-role | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/iam-role-for-service-accounts-eks | 5.48.0 | | |
| | terraform-aws-modules/kms/aws | 3.1.0 | | |
| | terraform-aws-modules/notify-slack/aws | 6.4.0 | | |
| | terraform-aws-modules/rds/aws | 6.9.0 | | |
| | terraform-aws-modules/s3-bucket/aws | 4.1.2 | | |
| | terraform-aws-modules/s3-bucket/aws/modules/notification | 4.1.2 | | |
| | terraform-aws-modules/sns/aws | 6.1.0 | | |
| | terraform-aws-modules/vpc/aws | 5.13.0 | | |
## Providers
| Provider | Version | Previous |
| :------------------ | :------ | :------- |
| hashicorp/aws | 5.67.0 | |
| gavinbunney/kubectl | 1.14.0 | |
| hashicorp/helm | 2.15.0 | |
# Version 1.3.1
**This update introduces Terraform-based VPN connector deployment, giving Fast Foundation more flexibility and improved AWS compliance. CloudFront templating has been added for dynamic content delivery, and IRSA role names now support namespaces for better security. Critical S3 buckets have been hardened with longer retention periods, tighter versioning rules, and enhanced logging and monitoring**
## Features
* **Deploy VPN connector with Terraform**: gives Fast Foundation independence from traditional OpenVPN deployment, allowing a better management of resources, and making it more compliant, addressing some AWS SecurityHub findings
## Improvements
* **Added templating in CloudFront module**: allows for dynamic content delivery based on variables and conditions
* **Use namespace in IRSA name if specified**: enhances security by ensuring unique role names for each namespace
* **Critical S3 buckets hardening**:
* Increased object lock retention time to 10 years
* Current version expiration deleted
* Increased non-current version object expiration to 2 years and 10 versions
* Created event notification lambda slack integration
* Created Access logs bucket in infrastructure account
# Version 1.3.0
**This release brings major new features including ECS cluster support, persistent storage for Prometheus, centralized root access and billing alarms, and enhanced monitoring with FluentBit. Security and operational improvements include centralized Security Hub management, tagged alarms, restricted OpenSearch roles, and topology constraints for critical services. Key fixes address VPN configurations, Lambda alarms, and ECR policies**
## Features
* **💎 ECS module** - Fast Foundation now supports ECS clusters
* **Added Persistent Storage Configuration for Prometheus**
* **Added AWS Centralized Root Access Management**
* **Added FluentBit Service Monitor and Alerts**
* **Added Organization Budget and Billing alarms**
* Added Timeout Metric Alarm for automatic alarm creation Lambda Function
## Improvements
* **Security Hub Centralized Management**
* **Alarms Created by Automatic Alarm Creation and Deletion module are now tagged**
* Added Static Security Group for Communicating with RDS
* Added Cluster Name to Argo Alarms for easier identification
* Stopped Notifying when Alarm goes from Insufficient Data to OK State
* Trust Relationship for Opensearch Ingestion roles are now restricted to specific roles
* Added Topology Constraint for Critical Services
* Conditional creation for deployKey ssm parameter
* Bumped axios from 1.6.8 to 1.8.4 in /additional\_resources/modules/serverless/cicd/gitlab-node-project-repo
## Fixes
* Added try clause to VPN CIDR blocks
* Added try clause and index to alb\_vpn\_security\_group output
* Fixed cluster-permissions output
* Added conditional creation for OpenSearch ingressroute
* Increased Lambda duration alarm "period" threshold to 600 to avoid creation errors
* Fixed Nucleus ECR Policies
* Other minor changes and fixes
## Breaking Changes
* **⚠️ \[improvement] Dynamic Argo RBAC definition**
* **⚠️ \[improvement] Use AWS Config service linked role**
# Version 1.2.1
**This update adds support for using static secrets across clusters, flexible security group selection for Karpenter node pools, and automation to block specific session tokens via SCP. Alerting and cluster configuration have been enhanced with clearer messaging and improved outputs. IRSA role naming is now more migration-friendly, and several key alarms and configuration issues have been fixed**
## Features
* **Added the possibility of using static secrets instead of creating different secrets for each new cluster**
* Added the possibility of selecting security groups by ID or tags for Karpenter Nodepools
* Added automation to block a specific session token using SCP
## Improvements
* **Improved alerting for Karpenter**
* Improved message in alerts: Added cluster name to the title
* Improved output from cluster permissions with application details, simplifying application configuration
* Improved naming convention for IRSA roles, making migrations easier by automatically generating role names for service accounts
## Fixes
* **Fixed Load Balancer Alarms**
* **Fixed EC2 Status Check alarm with disabled action**
* Added flags for resources that should be conditionally created
* Fixed Nucleus Welcome image port and healthcheck path configuration
* Other minor changes and fixes
## Breaking Changes
* **⚠️ \[improvement] Optionally add an rds security group for nodes connected to DB**
* **⚠️ \[feature] Additional NLB feature**
* **⚠️ \[fix] 1.2.1 general findings**
* **⚠️ \[improvement] Nucleus v1.1.0 compatibility**
# Version 1.2.0
**This release upgrades EKS clusters to version 1.31 as well as all tooling to the latest available version and introduces blue/green canary deployment support for safer rollouts. A shared external ALB is now available across clusters, along with improvements like antiaffinity rules for better app distribution and tagging support for secrets. Enhancements include disaster recovery tools for OpenSearch and proactive event handling with Karpenter via SQS. Several minor fixes and configuration adjustments are also included**
## Features
* **⭐ Upgraded EKS cluster version to 1.31, and tooling version to the latest available version**
* **💎 Added capability for implementing blue/green canary deployments for upgraded clusters**
* **Added external ALB common to all clusters**, as opposed to the current strategy of one ALB per cluster
* **Added capability for adding antiaffinity rules**, to maximize application spread in the assigned nodes
* **Added possibility of adding tags to secrets**, for attribute based access control
* Added possibility of adding additional access entries for applications or human users to interact with EKS cluster
* Added capability for adding additional secrets to a pod using the "standard application" helm templates
## Improvements
* **Added automatic snapshot techniques for OpenSearch, and recovery scripts for quickly reacting to disaster scenarios**
* Added SQS for Karpenter to know beforehand about some critical AWS events, like Spot Interruption, Instance Terminating, etc
## Fixes
* Fixed s3 logging buckets outputs
* Fixed deploy key parameter name
* Other minor changes and fixes
## Breaking Changes
* **⚠️ \[improvement] ingress and vpn-ingress tool modules are deprecated for ingressroutes and vpn-ingressroutes**
* Updating module nlb-vpn:
* Target group and listener are defined different. This will require moving terraform resources with moved block for 3 resources, these 2 and the target group attachment. This last resource will be recreated due to port addition, it has NO downtime on terraform apply
* Security group for NLB cannot be attached once the NLB is created, for legacy behavior set create\_security\_group = false. Also add this rule for ALB security group (to allow traffic from connector):
```
{
allow_vpn_connector_vpc = {
from_port = 443
to_port = 443
ip_protocol = "tcp"
description = "rule added for legacy. VPN NLB does not have SG"
cidr_ipv4 = data.terraform_remote_state.networking-vpn[0].outputs.vpc_vpn_cidr
}
}
```
* **⚠️ \[improvement] local.resources\_per\_cluster.secret replaced with local.resources\_per\_cluster.secret\_name because it causes conflict with new definition**
* **⚠️ \[improvement] Traefik IngressRoute apiVersion traefik.containo.us/v1alpha1 deprecated. Replaced by traefik.io/v1alpha1**
* **⚠️ \[improvement] Karpenter CRDs apiVersion changed from karpenter.k8s.aws/v1beta1 to karpenter.k8s.aws/v1 and requiere additional configurations:**
* EC2NodeClass:
* spec.amiSelectorTerms instead of amiFamily
* NodePool:
* spec.template.spec.nodeClassRef.group instead of apiVersion
* spec.disruption.consolidationPolicy allowed values changed
* spec.disruption.consolidateAfter required
## Tooling
| Area | Tool | Current (Chart/App) | Previous | |
| :-------------- | :---------------------------------------------------------------------- | :----------------------- | :----------------------- | - |
| FastFoundation | Nucleus | 1.1.0 | 1.0.0 | |
| | /modules/access\_groups | 1.0.0 | | |
| | /modules/group\_and\_permissions | 1.0.0 | | |
| Monitoring | Prometheus Stack | 65.3.1 / v0.77.1 | 58.2.\* / v0.73.2 | |
| | Metrics Server | 3.12.1 / 0.7.1 | 3.12.\* / 0.7.\* | |
| | FluentBit | 0.47.10 / 3.1.9 | 0.46.\* / 3.0.\* | |
| Networking | LinkerD Control Plane | 2024.10.4 / edge-24.10.4 | | |
| | LinkerD CRDS | 2024.10.4 | 1.16.11 / stable-2.14.10 | |
| | LinkerD Viz | 2024.10.4 / edge-24.10.4 | 1.8.0 | |
| | cert-manager | v1.16.1 / v1.16.1 | v1.14.15 / v1.14.15 | |
| | Traefik | 32.1.1 / v3.1.6 | 27.0.\* / v2.11.\* | |
| Cost Management | Kubecost | 2.4.2 / 2.4.2 | 2.2.3 / 2.2.3 | |
| Tooling | CSI Secret Store Driver | 1.4.6 / 1.4.6 | 1.4.2 / 1.4.2 | |
| | CSI Secrets Store Provider AWS Secrets | 0.3.9 | 0.3.8 | |
| | EBS CSI Controller | v1.36.0-eksbuild.1 | v1.30.0-eksbuild.1 | |
| | EFS CSI Driver | 3.0.8 / 2.0.7 | 3.0.\* / 2.0.\* | |
| | AWS LB Controller | 1.11.0 / v2.11.0 | 1.7.\* / v2.7.\* | |
| Autoscaling | Karpenter | 1.0.6 | 0.36.1 | |
| CD | Argo | 7.6.12 / v2.12.6 | 6.7.8 / v2.10.5 | |
| EKS | Kubernetes | 1.31 | | |
| | KubeProxy | v1.31.0-eksbuild.2 | v1.29.1-eksbuild.2 | |
| | CoreDNS | v1.11.3-eksbuild.1 | v1.11.1-eksbuild.6 | |
| | awsnode | v1.18.3-eksbuild.2 | v1.18.1-eksbuild.1 | |
| AWS | OpenSearch | \* | OpenSearch\_2.13 | |
| terraform | terraform-aws-modules/alb/aws | 9.11.0 | | |
| | terraform-aws-modules/cloudfront/aws | 3.4.0 | | |
| | terraform-aws-modules/cloudwatch/aws | 5.5.0 | | |
| | terraform-aws-modules/ecr/aws | 2.2.1 | | |
| | terraform-aws-modules/eks/aws | 20.24.0 | | |
| | terraform-aws-modules/eks/aws/modules/eks-managed-node-group | 20.24.0 | | |
| | terraform-aws-modules/iam/aws | 5.44.0 | \~> 5.0 | |
| | terraform-aws-modules/iam/aws/modules/assumable-role-with-oidc | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/iam-github-oidc-provider | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/iam-github-oidc-role | 5.44.0 | | |
| | terraform-aws-modules/iam/aws/modules/iam-role-for-service-accounts-eks | 5.48.0 | 5.44.0 | |
| | terraform-aws-modules/kms/aws | 3.1.0 | | |
| | terraform-aws-modules/notify-slack/aws | 6.4.0 | | |
| | terraform-aws-modules/rds/aws | 6.9.0 | | |
| | terraform-aws-modules/s3-bucket/aws | 4.1.2 | | |
| | terraform-aws-modules/s3-bucket/aws/modules/notification | 4.1.2 | | |
| | terraform-aws-modules/sns/aws | 6.1.0 | | |
| | terraform-aws-modules/vpc/aws | 5.13.0 | | |
## Providers
| Provider | Version | Previous |
| :------------------ | :------ | :------- |
| hashicorp/aws | 5.67.0 | 5.63.1 |
| gavinbunney/kubectl | 1.14.0 | |
| hashicorp/helm | 2.15.0 | |
# Version 1.1.1
**This update introduces support for custom transformation functions on EventBridge events, enabling more flexible alarm definitions. EKS logs can now be dynamically managed via infrastructure parameters, and a welcome image is automatically deployed for new applications while using Nucleus. CloudFront resources have been streamlined using a dedicated module, and numerous fixes improve regional compatibility, alarm accuracy, and naming consistency. Additional enhancements include improved cross-account access for Kubecost and extended certificate validity for Linkerd**
## Features
* **Added transformation functions.** Custom transformation functions can be added to extract and modify information from Eventbridge events. The output can then be used in the alarm’s definition
* **EKS logs can be dynamically managed from the infrastructure’s parameter**
* Deployed nucleus welcome image for new applications to use. Updates CICD to include a welcome image when a new app is deployed
## Improvements
* **Replaced Cloudfront resources with cloudfront module**
## Fixes
* Added "region != us-east-1" to resources that should not be created if region is us-east-1
* Added us-east-1 slack arn topic to lambdas
* ALB alarms now use complete id instead of ARN
* Cloudfront alarms are created now in us-east-1, as metrics are not accessible from other regions
* Added missing bucket for permissions states
* Changed folder name under organization management from infrastructure to management account
* Fixed Minor Naming issues
* Bucket name for networking state files now includes environment
* Kubecost role now allows cross-account access to CUR reports in S3
* Added conditions for Alarms lambda resources
* Extended Linkerd’s webhook certificate authority public certificate validity
## Breaking Changes
* **⚠️ `eks.argo.git_webhook_secret` changed** - In Infrastructure`/Workloads/workload-{environment}/secrets.dynamic.json, the field `eks.argo.git\_webhook\_secret\` was changed for eks.argo.githubSecret and eks.argo.gitlabSecret. Replace accordingly.
# Version 1.1.0
**This release introduces a powerful Smart Alarms module for centralized, consistent alarm management, and adds automated DataDog Agent deployment with the EKS module. It now supports multiple environments within the same cluster, dynamic pod-to-nodegroup assignments, and organization-wide infrastructure-as-code for core security services. Enhancements include better logging organization with cluster tagging, improved OpenSearch and Prometheus integrations, and stricter naming conventions for IAM roles. Numerous fixes address compatibility, dynamic provisioning, Karpenter configuration, and general stability improvements**
## Features
* **💎 Smart Alarms Module**. This new module allows for a centralized alarm management configuration system, ensuring that resource alarms are kept consistent when resources are created/updated/deleted, no matter who or what is performing the change
* **Added the capability to deploy DataDog Agent with the EKS module automatically**
* **Added capability for hosting more than one environment in the same cluster**
* **Added nodePool parameter in helm charts to dynamically assign pods to specific nodegroups**
* **Security Module now deploys all services as code across all accounts in the organization**, including AWS Config, AWS Security Hub, AWS Cloudtrail, and Fast Foundation Smart Alarms Module
* **Started using Priority Class labels for node-critical applications**, preventing rollouts of new applications from freezing due to critical pods being unable to be deployed because nodes were full
* Template for CronJobs to be automatically deployed into the cluster
* Added Datadog charts for automatic deployment when using Datadog
## Improvements
* **Improved organization of Logging Indexes**. Optimized Application and Ingress views in OpenSearch. Enabled Traefik JSON logging. Improved tagging strategy for Fluentbit-Kubernetes filters
* **Enabled Traefik JSON logs**
* **Added Argo Service Monitor to Prometheus Stack**
* Logs now include a tag with the cluster name for scenarios where more than one cluster is deployed in the same environment
* Established naming conventions for IAM Roles for service accounts. Fixed length and cyphertext strings to avoid collision and character limitations
* Karpenter nodepool's CPU limits are now fixable using an infrastructure parameter
* Fixed dependency versions for their latest versions
* General improvements to file structure
* Updated Tooling/Provider versions (see table below)
## Fixes
* Fixed EFS driver dynamic provisioning and job-application
* Logging now uses the environment as a prefix instead of the cluster name
* Added options for backward compatibility with previous versions
* Added capability to set Argo's target revision branch
* Added conditionals for optional resources like Kubecost and Nucleus
* Truncated port names to avoid character limit errors
* Subnets for ALBs and NLBs are now dynamically chosen depending on how many availability zones the region has
* Added some mandatory roles for Karpenter to work correctly with Spot and Spot fleets
* Fixed Karpenter alarm descriptions
* Removed roles that were no longer in use
* Other minor name and typo fixes
## Tooling
| Area | Tool | Current (Chart/App) | Previous |
| :-------------- | :---------------------------------------------------------------------- | :------------------------ | :--------- |
| FastFoundation | Nucleus | 1.0.0 | |
| | /modules/access\_groups | 1.0.0 | |
| | /modules/group\_and\_permissions | 1.0.0 | |
| Monitoring | Prometheus Stack | 58.2.\* / v0.73.2 | |
| | Metrics Server | 3.12.\* / 0.7.\* | |
| | FluentBit | 0.46.\* / 3.0.\* | |
| Networking | LinkerD Destination | 1.16.11 / stable-2.14.10 | |
| | LinkerD CRDS | 1.8.0 | |
| | LinkerD Viz | 30.12.11 / stable-2.14.10 | |
| | cert-manager | v1.14.15 / v1.14.15 | |
| | Traefik | 27.0.\* / v2.11.\* | |
| Cost Management | Kubecost | 2.2.3 / 2.2.3 | |
| Tooling | CSI Secret Store Driver | 1.4.2 / 1.4.2 | |
| | CSI Secrets Store Provider AWS Secrets | 0.3.8 / 0.3.8 | |
| | EBS CSI Controller | v1.30.0-eksbuild.1 | |
| | EBS CSI Node | v1.30.0-eksbuild.1 | |
| | EFS CSI Driver | 3.0.\* / 2.0.\* | |
| | AWS LB Controller | 1.7.\* / v2.7.\* | |
| Autoscaling | Karpenter | 0.36.1 / 0.36.1 | |
| CD | Argo | 6.7.8 / v2.10.5 | |
| EKS | Kubernetes | 1.29 | |
| | KubeProxy | v1.29.1-eksbuild.2 | |
| | CoreDNS | v1.11.1-eksbuild.6 | |
| | awsnode | v1.18.1-eksbuild.1 | |
| AWS | OpenSearch | OpenSearch\_2.13 | |
| terraform | terraform-aws-modules/alb/aws | 9.11.0 | \~> 8.7.0 |
| | terraform-aws-modules/cloudfront/aws | 3.4.0 | \~> 3.2.1 |
| | terraform-aws-modules/cloudwatch/aws | 5.5.0 | \~> 4.3.0 |
| | terraform-aws-modules/cloudwatch/aws/modules/metric-alarm | 5.5.0 | \~> 4.3.0 |
| | terraform-aws-modules/ecr/aws | 2.2.1 | \~> 1.6.0 |
| | terraform-aws-modules/eks/aws | 20.24.0 | \~> 20.0 |
| | terraform-aws-modules/eks/aws/modules/eks-managed-node-group | 20.24.0 | \~> 19.0 |
| | terraform-aws-modules/iam/aws | 5.44.0 | \~> 5.0 |
| | terraform-aws-modules/iam/aws/modules/assumable-role-with-oidc | 5.44.0 | \~> 5.0 |
| | terraform-aws-modules/iam/aws/modules/iam-github-oidc-provider | 5.44.0 | \~> 5.0 |
| | terraform-aws-modules/iam/aws/modules/iam-github-oidc-role | 5.44.0 | \~> 5.0 |
| | terraform-aws-modules/iam/aws/modules/iam-role-for-service-accounts-eks | 5.44.0 | \~> 5.0 |
| | terraform-aws-modules/kms/aws | 3.1.0 | \~> 2.1.0 |
| | terraform-aws-modules/notify-slack/aws | 6.4.0 | \~> 6.0.0 |
| | terraform-aws-modules/rds/aws | 6.9.0 | \~> 6.1.1 |
| | terraform-aws-modules/s3-bucket/aws | 4.1.2 | \~> 3.15.1 |
| | terraform-aws-modules/s3-bucket/aws/modules/notification | 4.1.2 | \~> 3.15.1 |
| | terraform-aws-modules/sns/aws | 6.1.0 | \~> 6.0.0 |
| | terraform-aws-modules/vpc/aws | 5.13.0 | \~> 5.2 |
## Providers
| Provider | Version | Previous |
| :------------------ | :------ | :------- |
| hashicorp/aws | 5.63.1 | \~> 5.0 |
| hashicorp/random | 3.6.2 | 3.5.1 |
| gavinbunney/kubectl | 1.14.0 | >= 1.0 |
| hashicorp/helm | 2.15.0 | \~> 2.0 |
# Fast Foundation for AWS is out!
**[Nimble.la](https://www.nimble.la) is thrilled to announce the initial release of Fast Foundation for AWS—The ultimate infrastructure blueprint for modern cloud-native teams. Fast Foundation combines industry-leading open source tooling and AWS best practices to deliver a secure, reliable, and compliant platform out-of-the-box. Built from the ground up for SOC2 and HIPAA compliance, Fast Foundation empowers you to go live in weeks, not months, with a fully codified, scalable, and cost-optimized AWS environment. Unlock rapid innovation and take full ownership of your cloud infrastructure from day one!**
## Tooling
| Area | Tool | Current (Chart/App) |
| :-------------- | :----------------------------------------------------------------------- | :------------------------ |
| FastFoundation | Nucleus | 1.0.0 |
| | /modules/access\_groups | 1.0.0 |
| | /modules/group\_and\_permissions | 1.0.0 |
| Monitoring | Prometheus Stack | 58.2.\* / v0.73.2 |
| | Metrics Server | 3.12.\* / 0.7.\* |
| | FluentBit | 0.46.\* / 3.0.\* |
| Networking | LinkerD Destination | 1.16.11 / stable-2.14.10 |
| | LinkerD CRDS | 1.8.0 |
| | LinkerD Viz | 30.12.11 / stable-2.14.10 |
| | cert-manager | v1.14.15 / v1.14.15 |
| | Traefik | 27.0.\* / v2.11.\* |
| Cost Management | Kubecost | 2.2.3 / 2.2.3 |
| Tooling | CSI Secret Store Driver | 1.4.2 / 1.4.2 |
| | CSI Secrets Store Provider AWS Secrets | 0.3.8 / 0.3.8 |
| | EBS CSI Controller | v1.30.0-eksbuild.1 |
| | EBS CSI Node | v1.30.0-eksbuild.1 |
| | EFS CSI Driver | 3.0.\* / 2.0.\* |
| | AWS LB Controller | 1.7.\* / v2.7.\* |
| Autoscaling | Karpenter | 0.36.1 / 0.36.1 |
| CD | Argo | 6.7.8 / v2.10.5 |
| EKS | Kubernetes | 1.29 |
| | KubeProxy | v1.29.1-eksbuild.2 |
| | CoreDNS | v1.11.1-eksbuild.6 |
| | awsnode | v1.18.1-eksbuild.1 |
| AWS | OpenSearch | OpenSearch\_2.13 |
| terraform | terraform-aws-modules/alb/aws | \~> 8.7.0 |
| | terraform-aws-modules/cloudfront/aws | \~> 3.2.1 |
| | terraform-aws-modules/cloudwatch/aws//modules/metric-alarm | \~> 4.3.0 |
| | terraform-aws-modules/ecr/aws | \~> 1.6.0 |
| | terraform-aws-modules/eks/aws | \~> 20.0 |
| | terraform-aws-modules/eks/aws//modules/eks-managed-node-group | \~> 19.0 |
| | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | \~> 5.0 |
| | terraform-aws-modules/iam/aws//modules/iam-github-oidc-provider | \~> 5.0 |
| | terraform-aws-modules/iam/aws//modules/iam-github-oidc-role | \~> 5.0 |
| | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | \~> 5.0 |
| | terraform-aws-modules/kms/aws | \~> 2.1.0 |
| | terraform-aws-modules/notify-slack/aws | \~> 6.0.0 |
| | terraform-aws-modules/rds/aws | \~> 6.1.1 |
| | terraform-aws-modules/s3-bucket/aws | \~> 3.15.1 |
| | terraform-aws-modules/s3-bucket/aws//modules/notification | \~> 3.15.1 |
| | terraform-aws-modules/sns/aws | \~> 6.0.0 |
| | terraform-aws-modules/vpc/aws | \~> 5.2 |
# Providers
| Provider | Version |
| :------------------ | :------ |
| hashicorp/aws | \~> 5.0 |
| hashicorp/random | 3.5.1 |
| gavinbunney/kubectl | >= 1.0 |
| hashicorp/helm | \~> 2.0 |