xpk/terraform.aws-baseline-infra
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

UPD: adding securityaudit role

Browse Source
This commit is contained in:
xpk 2021-01-27 16:26:43 +08:00
parent c1d1149d7d
commit 4865fdcba7
Signed by: xpk
GPG Key ID: CD4FF6793F09AB86
3 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
layers/security_identity_compliance/cloudtrail_cloudwatchlogs/variables.tf
View File

@ -7,11 +7,13 @@ variable "application" {}
locals {
default-tags = {
ServiceProvider = "Rackspace"
ServiceProvider = "RackspaceTechnology"
Environment = var.environment
Project = var.project
Application = var.application
TerraformMode = "managed"
TerraformDir = trimprefix(path.cwd, "/my/work/xpk-git/")
CreatedBy = split(":",data.aws_caller_identity.this.user_id)[1]
BuildDate = formatdate("YYYYMMDD", timestamp())
}
ct-bucket-name = "${var.environment}-${var.aws-region-short}-${var.customer-name}-${var.project}-ctbucket-${data.aws_caller_identity.this.account_id}"

4
layers/security_identity_compliance/iam_roles/variables.tf
View File

@ -7,11 +7,13 @@ variable "application" {}
locals {
default-tags = {
ServiceProvider = "Rackspace"
ServiceProvider = "RackspaceTechnology"
Environment = var.environment
Project = var.project
Application = var.application
TerraformMode = "managed"
TerraformDir = trimprefix(path.cwd, "/my/work/xpk-git/")
CreatedBy = split(":",data.aws_caller_identity.this.user_id)[1]
BuildDate = formatdate("YYYYMMDD", timestamp())
}
ct-bucket-name = "${var.environment}-${var.aws-region-short}-${var.customer-name}-${var.project}-ctbucket-${data.aws_caller_identity.this.account_id}"

20
modules/security_identity_compliance/roles_iam_resources/main.tf
View File

@ -26,6 +26,7 @@ data aws_iam_policy_document assume-role-policy {
resource aws_iam_role administrator-role {
name = "${var.environment}-awsadmin"
description = "Provides full access to AWS services and resources."
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"
@ -39,6 +40,7 @@ resource "aws_iam_role_policy_attachment" "administrator-role-policy-attach" {
resource aws_iam_role billing-role {
name = "${var.environment}-billing"
description = "Grants permissions for billing and cost management."
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"
@ -52,6 +54,7 @@ resource "aws_iam_role_policy_attachment" "billing-role-policy-attach" {
resource aws_iam_role dba-role {
name = "${var.environment}-dba"
description = "AWS database admin role"
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"
@ -65,6 +68,7 @@ resource "aws_iam_role_policy_attachment" "dba-role-policy-attach" {
resource aws_iam_role network-admin-role {
name = "${var.environment}-networkadmin"
description = "AWS network admin role"
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"
@ -78,6 +82,7 @@ resource "aws_iam_role_policy_attachment" "network-admin-role-policy-attach" {
resource aws_iam_role developer-role {
name = "${var.environment}-developer"
description = "Provides full access to AWS resources excluding IAM."
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"
@ -89,8 +94,23 @@ resource "aws_iam_role_policy_attachment" "developer-role-policy-attach1" {
policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"
}
resource aws_iam_role securityaudit-role {
name = "${var.environment}-securityaudit"
description = "Role to read security configuration metadata."
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"
max_session_duration = 7200
}
resource "aws_iam_role_policy_attachment" "securityaudit-role-policy-attach1" {
role = aws_iam_role.securityaudit-role.name
policy_arn = "arn:aws:iam::aws:policy/SecurityAudit"
}
resource aws_iam_role support-role {
name = "${var.environment}-support"
description = "Role to troubleshoot and resolve issues in AWS."
tags = var.default-tags
assume_role_policy = data.aws_iam_policy_document.assume-role-policy.json
path = "/${var.customer-name}/"