NEW: cloudtrail and cwl
This commit is contained in:
commit
d8b9390928
GPG Key ID:
CD4FF6793F09AB86
5
.gitignore
vendored
Normal file
5
.gitignore
vendored
Normal file
@ -0,0 +1,5 @@
|
||||
*.tfstate.backup
|
||||
*.tfstate.lock
|
||||
.terraform/
|
||||
.DS_Store
|
||||
*.iml
|
||||
3
.idea/.gitignore
vendored
Normal file
3
.idea/.gitignore
vendored
Normal file
@ -0,0 +1,3 @@
|
||||
# Default ignored files
|
||||
/shelf/
|
||||
/workspace.xml
|
||||
@ -0,0 +1,11 @@
|
||||
data aws_caller_identity this {}
|
||||
|
||||
module cloudtrail-cwl {
|
||||
source = "../../../modules/security_identity_compliance/cloudtrail_cwlogs"
|
||||
application = var.application
|
||||
environment = var.environment
|
||||
customer-name = var.customer-name
|
||||
project = var.project
|
||||
aws-region-short = var.aws-region-short
|
||||
default-tags = local.default-tags
|
||||
}
|
||||
@ -0,0 +1,12 @@
|
||||
provider "aws" {
|
||||
region = var.aws-region
|
||||
}
|
||||
|
||||
terraform {
|
||||
required_version = "> 0.12, < 0.13"
|
||||
required_providers {
|
||||
aws = "~> 3.6.0"
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_availability_zones" "current" {}
|
||||
@ -0,0 +1,298 @@
|
||||
{
|
||||
"version": 4,
|
||||
"terraform_version": "0.12.29",
|
||||
"serial": 85,
|
||||
"lineage": "26e4bec8-8ad6-a262-52c6-fbcad6b7a499",
|
||||
"outputs": {},
|
||||
"resources": [
|
||||
{
|
||||
"module": "module.cloudtrail-cwl",
|
||||
"mode": "data",
|
||||
"type": "aws_caller_identity",
|
||||
"name": "this",
|
||||
"provider": "provider.aws",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"account_id": "573340405480",
|
||||
"arn": "arn:aws:sts::573340405480:assumed-role/Rackspace/racker-ken2-eade1d93",
|
||||
"id": "2021-01-26 13:37:52.170204471 +0000 UTC",
|
||||
"user_id": "AROAYK7OAJ3UH36WGNMWD:racker-ken2-eade1d93"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"module": "module.cloudtrail-cwl",
|
||||
"mode": "data",
|
||||
"type": "aws_iam_policy_document",
|
||||
"name": "cloudtrail_bucket_policy",
|
||||
"provider": "provider.aws",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"id": "995859125",
|
||||
"json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AWSCloudTrailAclCheck\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:GetBucketAcl\",\n \"Resource\": \"arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480\",\n \"Principal\": {\n \"Service\": \"cloudtrail.amazonaws.com\"\n }\n },\n {\n \"Sid\": \"AWSCloudTrailWrite\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:PutObject\",\n \"Resource\": \"arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480/*\",\n \"Principal\": {\n \"Service\": [\n \"config.amazonaws.com\",\n \"cloudtrail.amazonaws.com\"\n ]\n }\n }\n ]\n}",
|
||||
"override_json": null,
|
||||
"policy_id": null,
|
||||
"source_json": null,
|
||||
"statement": [
|
||||
{
|
||||
"actions": [
|
||||
"s3:GetBucketAcl"
|
||||
],
|
||||
"condition": [],
|
||||
"effect": "Allow",
|
||||
"not_actions": [],
|
||||
"not_principals": [],
|
||||
"not_resources": [],
|
||||
"principals": [
|
||||
{
|
||||
"identifiers": [
|
||||
"cloudtrail.amazonaws.com"
|
||||
],
|
||||
"type": "Service"
|
||||
}
|
||||
],
|
||||
"resources": [
|
||||
"arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480"
|
||||
],
|
||||
"sid": "AWSCloudTrailAclCheck"
|
||||
},
|
||||
{
|
||||
"actions": [
|
||||
"s3:PutObject"
|
||||
],
|
||||
"condition": [],
|
||||
"effect": "Allow",
|
||||
"not_actions": [],
|
||||
"not_principals": [],
|
||||
"not_resources": [],
|
||||
"principals": [
|
||||
{
|
||||
"identifiers": [
|
||||
"cloudtrail.amazonaws.com",
|
||||
"config.amazonaws.com"
|
||||
],
|
||||
"type": "Service"
|
||||
}
|
||||
],
|
||||
"resources": [
|
||||
"arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480/*"
|
||||
],
|
||||
"sid": "AWSCloudTrailWrite"
|
||||
}
|
||||
],
|
||||
"version": "2012-10-17"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"module": "module.cloudtrail-cwl",
|
||||
"mode": "data",
|
||||
"type": "aws_iam_policy_document",
|
||||
"name": "key-policy",
|
||||
"provider": "provider.aws",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"id": "3662241047",
|
||||
"json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"Key usage by aws services\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:Encrypt\",\n \"kms:DescribeKey\",\n \"kms:Decrypt\"\n ],\n \"Resource\": \"*\",\n \"Principal\": {\n \"Service\": [\n \"sqs.amazonaws.com\",\n \"sns.amazonaws.com\",\n \"s3.amazonaws.com\",\n \"logs.amazonaws.com\",\n \"lambda.amazonaws.com\",\n \"guardduty.amazonaws.com\",\n \"events.amazonaws.com\",\n \"eks.amazonaws.com\",\n \"eks-nodegroup.amazonaws.com\",\n \"delivery.logs.amazonaws.com\",\n \"cloudwatch.amazonaws.com\",\n \"cloudtrail.amazonaws.com\",\n \"backup.amazonaws.com\",\n \"autoscaling.amazonaws.com\"\n ]\n }\n },\n {\n \"Sid\": \"Key administrator\",\n \"Effect\": \"Allow\",\n \"Action\": \"kms:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"573340405480\"\n }\n }\n ]\n}",
|
||||
"override_json": null,
|
||||
"policy_id": null,
|
||||
"source_json": null,
|
||||
"statement": [
|
||||
{
|
||||
"actions": [
|
||||
"kms:Decrypt",
|
||||
"kms:DescribeKey",
|
||||
"kms:Encrypt",
|
||||
"kms:GenerateDataKey*",
|
||||
"kms:ReEncrypt*"
|
||||
],
|
||||
"condition": [],
|
||||
"effect": "Allow",
|
||||
"not_actions": [],
|
||||
"not_principals": [],
|
||||
"not_resources": [],
|
||||
"principals": [
|
||||
{
|
||||
"identifiers": [
|
||||
"autoscaling.amazonaws.com",
|
||||
"backup.amazonaws.com",
|
||||
"cloudtrail.amazonaws.com",
|
||||
"cloudwatch.amazonaws.com",
|
||||
"delivery.logs.amazonaws.com",
|
||||
"eks-nodegroup.amazonaws.com",
|
||||
"eks.amazonaws.com",
|
||||
"events.amazonaws.com",
|
||||
"guardduty.amazonaws.com",
|
||||
"lambda.amazonaws.com",
|
||||
"logs.amazonaws.com",
|
||||
"s3.amazonaws.com",
|
||||
"sns.amazonaws.com",
|
||||
"sqs.amazonaws.com"
|
||||
],
|
||||
"type": "Service"
|
||||
}
|
||||
],
|
||||
"resources": [
|
||||
"*"
|
||||
],
|
||||
"sid": "Key usage by aws services"
|
||||
},
|
||||
{
|
||||
"actions": [
|
||||
"kms:*"
|
||||
],
|
||||
"condition": [],
|
||||
"effect": "Allow",
|
||||
"not_actions": [],
|
||||
"not_principals": [],
|
||||
"not_resources": [],
|
||||
"principals": [
|
||||
{
|
||||
"identifiers": [
|
||||
"573340405480"
|
||||
],
|
||||
"type": "AWS"
|
||||
}
|
||||
],
|
||||
"resources": [
|
||||
"*"
|
||||
],
|
||||
"sid": "Key administrator"
|
||||
}
|
||||
],
|
||||
"version": "2012-10-17"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"module": "module.cloudtrail-cwl",
|
||||
"mode": "managed",
|
||||
"type": "aws_kms_key",
|
||||
"name": "ctbucket-key",
|
||||
"provider": "provider.aws",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"arn": "arn:aws:kms:ap-northeast-1:573340405480:key/ba826c02-4153-4056-ad75-2614912c6274",
|
||||
"customer_master_key_spec": "SYMMETRIC_DEFAULT",
|
||||
"deletion_window_in_days": 7,
|
||||
"description": "",
|
||||
"enable_key_rotation": false,
|
||||
"id": "ba826c02-4153-4056-ad75-2614912c6274",
|
||||
"is_enabled": true,
|
||||
"key_id": "ba826c02-4153-4056-ad75-2614912c6274",
|
||||
"key_usage": "ENCRYPT_DECRYPT",
|
||||
"policy": "{\"Statement\":[{\"Action\":[\"kms:ReEncrypt*\",\"kms:GenerateDataKey*\",\"kms:Encrypt\",\"kms:DescribeKey\",\"kms:Decrypt\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"eks-nodegroup.amazonaws.com\",\"delivery.logs.amazonaws.com\",\"eks.amazonaws.com\",\"events.amazonaws.com\",\"autoscaling.amazonaws.com\",\"logs.amazonaws.com\",\"sqs.amazonaws.com\",\"backup.amazonaws.com\",\"guardduty.amazonaws.com\",\"cloudtrail.amazonaws.com\",\"lambda.amazonaws.com\",\"cloudwatch.amazonaws.com\",\"sns.amazonaws.com\",\"s3.amazonaws.com\"]},\"Resource\":\"*\",\"Sid\":\"Key usage by aws services\"},{\"Action\":\"kms:*\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::573340405480:root\"},\"Resource\":\"*\",\"Sid\":\"Key administrator\"}],\"Version\":\"2012-10-17\"}",
|
||||
"tags": {
|
||||
"Application": "infra",
|
||||
"BuildDate": "20210126",
|
||||
"Environment": "lab",
|
||||
"Project": "lime",
|
||||
"ServiceProvider": "Rackspace",
|
||||
"TerraformMode": "managed"
|
||||
}
|
||||
},
|
||||
"private": "bnVsbA=="
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"module": "module.cloudtrail-cwl",
|
||||
"mode": "managed",
|
||||
"type": "aws_s3_bucket",
|
||||
"name": "ct-bucket",
|
||||
"provider": "provider.aws",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"acceleration_status": "",
|
||||
"acl": "private",
|
||||
"arn": "arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480",
|
||||
"bucket": "lab-apne1-kf-lime-ctbucket-573340405480",
|
||||
"bucket_domain_name": "lab-apne1-kf-lime-ctbucket-573340405480.s3.amazonaws.com",
|
||||
"bucket_prefix": null,
|
||||
"bucket_regional_domain_name": "lab-apne1-kf-lime-ctbucket-573340405480.s3.ap-northeast-1.amazonaws.com",
|
||||
"cors_rule": [],
|
||||
"force_destroy": false,
|
||||
"grant": [],
|
||||
"hosted_zone_id": "Z2M4EHUR26P7ZW",
|
||||
"id": "lab-apne1-kf-lime-ctbucket-573340405480",
|
||||
"lifecycle_rule": [
|
||||
{
|
||||
"abort_incomplete_multipart_upload_days": 0,
|
||||
"enabled": false,
|
||||
"expiration": [
|
||||
{
|
||||
"date": "",
|
||||
"days": 90,
|
||||
"expired_object_delete_marker": false
|
||||
}
|
||||
],
|
||||
"id": "tf-s3-lifecycle-20210126114512193400000001",
|
||||
"noncurrent_version_expiration": [],
|
||||
"noncurrent_version_transition": [],
|
||||
"prefix": "",
|
||||
"tags": {},
|
||||
"transition": [
|
||||
{
|
||||
"date": "",
|
||||
"days": 30,
|
||||
"storage_class": "INTELLIGENT_TIERING"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"logging": [],
|
||||
"object_lock_configuration": [],
|
||||
"policy": "{\"Statement\":[{\"Action\":\"s3:GetBucketAcl\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Resource\":\"arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480\",\"Sid\":\"AWSCloudTrailAclCheck\"},{\"Action\":\"s3:PutObject\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"config.amazonaws.com\",\"cloudtrail.amazonaws.com\"]},\"Resource\":\"arn:aws:s3:::lab-apne1-kf-lime-ctbucket-573340405480/*\",\"Sid\":\"AWSCloudTrailWrite\"}],\"Version\":\"2012-10-17\"}",
|
||||
"region": "ap-northeast-1",
|
||||
"replication_configuration": [],
|
||||
"request_payer": "BucketOwner",
|
||||
"server_side_encryption_configuration": [
|
||||
{
|
||||
"rule": [
|
||||
{
|
||||
"apply_server_side_encryption_by_default": [
|
||||
{
|
||||
"kms_master_key_id": "arn:aws:kms:ap-northeast-1:573340405480:key/ba826c02-4153-4056-ad75-2614912c6274",
|
||||
"sse_algorithm": "aws:kms"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"tags": {
|
||||
"Application": "infra",
|
||||
"BuildDate": "20210126",
|
||||
"Environment": "lab",
|
||||
"Project": "lime",
|
||||
"ServiceProvider": "Rackspace",
|
||||
"TerraformMode": "managed"
|
||||
},
|
||||
"versioning": [
|
||||
{
|
||||
"enabled": false,
|
||||
"mfa_delete": false
|
||||
}
|
||||
],
|
||||
"website": [],
|
||||
"website_domain": null,
|
||||
"website_endpoint": null
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -0,0 +1,6 @@
|
||||
aws-region = "ap-northeast-1"
|
||||
aws-region-short = "apne1"
|
||||
customer-name = "kf"
|
||||
environment = "lab"
|
||||
project = "lime"
|
||||
application = "infra"
|
||||
@ -0,0 +1,20 @@
|
||||
variable "aws-region" {}
|
||||
variable "aws-region-short" {}
|
||||
variable "customer-name" {}
|
||||
variable "environment" {}
|
||||
variable "project" {}
|
||||
variable "application" {}
|
||||
|
||||
locals {
|
||||
default-tags = {
|
||||
ServiceProvider = "Rackspace"
|
||||
Environment = var.environment
|
||||
Project = var.project
|
||||
Application = var.application
|
||||
TerraformMode = "managed"
|
||||
BuildDate = formatdate("YYYYMMDD", timestamp())
|
||||
}
|
||||
ct-bucket-name = "${var.environment}-${var.aws-region-short}-${var.customer-name}-${var.project}-ctbucket-${data.aws_caller_identity.this.account_id}"
|
||||
resource-prefix = "${var.environment}-${var.aws-region-short}-${var.customer-name}-${var.project}"
|
||||
}
|
||||
|
||||
27
modules/global-variables/README.md
Normal file
27
modules/global-variables/README.md
Normal file
@ -0,0 +1,27 @@
|
||||
# global-variables module
|
||||
This module provides global variables that can be used in all layers
|
||||
|
||||
|
||||
## Basic Usage
|
||||
Variables are stored in a map in outputs.tf
|
||||
|
||||
```hcl
|
||||
module "global-variables" {
|
||||
source = "../../../../../../../../../terraform_modules_shared/global-variables"
|
||||
}
|
||||
|
||||
// then retrieve global variable from the module. for example:
|
||||
sys-sec-account = module.global-variables.vars.prod.sys-sec-acc
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|:----:|:-----:|:-----:|
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| vars | map of variables |
|
||||
|
||||
18
modules/global-variables/outputs.tf
Normal file
18
modules/global-variables/outputs.tf
Normal file
@ -0,0 +1,18 @@
|
||||
output vars {
|
||||
value = {
|
||||
"prod" = {
|
||||
sys-log-acc = "174677273835"
|
||||
sys-ss-acc = "827262612707"
|
||||
stm-acc = "205233139210"
|
||||
sys-sec-acc = "033205333431"
|
||||
mp-acc = "616302076454"
|
||||
}
|
||||
"plike" = {
|
||||
sys-log-acc = "870377016556"
|
||||
sys-ss-acc = "022321612404"
|
||||
stm-acc = "313794563353"
|
||||
sys-sec-acc = "240016403383"
|
||||
mp-acc = "684740086263"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,80 @@
|
||||
resource "aws_iam_role" "iam_cloudtrial_cloudwatch_role" {
|
||||
name = "${local.resource-prefix}-cwl-role"
|
||||
assume_role_policy = data.aws_iam_policy_document.ct-role-assumerole-policy.json
|
||||
description = "Enables AWS CloudTrail to deliver log to CloudWatch log"
|
||||
tags = var.default-tags
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "iam_cloudtrial_cloudwatach_role_policy" {
|
||||
name = "${local.resource-prefix}-cwl-role-policy"
|
||||
role = aws_iam_role.iam_cloudtrial_cloudwatch_role.id
|
||||
policy = data.aws_iam_policy_document.ct-role-pdoc.json
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "ct-role-assumerole-policy" {
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = ["sts:AssumeRole"]
|
||||
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["cloudtrail.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "ct-role-pdoc" {
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = ["logs:CreateLogStream"]
|
||||
|
||||
resources = [
|
||||
"${aws_cloudwatch_log_group.ct-cwl.arn}:log-stream:*",
|
||||
]
|
||||
}
|
||||
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = ["logs:PutLogEvents"]
|
||||
|
||||
resources = [
|
||||
"${aws_cloudwatch_log_group.ct-cwl.arn}:log-stream:*",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "aws_cloudtrail" "default" {
|
||||
name = "${local.resource-prefix}-trail-001"
|
||||
enable_logging = true
|
||||
s3_bucket_name = local.ct-bucket-name
|
||||
enable_log_file_validation = true
|
||||
is_multi_region_trail = true
|
||||
include_global_service_events = true
|
||||
cloud_watch_logs_role_arn = aws_iam_role.iam_cloudtrial_cloudwatch_role.arn
|
||||
cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.ct-cwl.arn}:*"
|
||||
tags = var.default-tags
|
||||
kms_key_id = aws_kms_key.ctbucket-key.arn
|
||||
is_organization_trail = false
|
||||
|
||||
event_selector {
|
||||
read_write_type = "All"
|
||||
include_management_events = true
|
||||
|
||||
data_resource {
|
||||
type = "AWS::S3::Object"
|
||||
values = ["arn:aws:s3:::"]
|
||||
}
|
||||
|
||||
data_resource {
|
||||
type = "AWS::Lambda::Function"
|
||||
values = ["arn:aws:lambda"]
|
||||
}
|
||||
}
|
||||
|
||||
#insight_selector {
|
||||
# insight_type = "ApiCallRateInsight"
|
||||
#}
|
||||
}
|
||||
|
||||
@ -0,0 +1,68 @@
|
||||
resource "aws_kms_key" "ctbucket-key" {
|
||||
deletion_window_in_days = 7
|
||||
tags = var.default-tags
|
||||
policy = data.aws_iam_policy_document.key-policy.json
|
||||
}
|
||||
|
||||
resource "aws_kms_alias" ctbucket-key-aliaas {
|
||||
name = "alias/${local.resource-prefix}-ctkey-alias"
|
||||
target_key_id = aws_kms_key.ctbucket-key.key_id
|
||||
}
|
||||
|
||||
# https://gist.github.com/shortjared/4c1e3fe52bdfa47522cfe5b41e5d6f22
|
||||
data "aws_iam_policy_document" "key-policy" {
|
||||
statement {
|
||||
sid = "Key usage by aws services"
|
||||
principals {
|
||||
identifiers = [
|
||||
"autoscaling.amazonaws.com",
|
||||
"cloudtrail.amazonaws.com",
|
||||
"eks.amazonaws.com",
|
||||
"eks-nodegroup.amazonaws.com",
|
||||
"guardduty.amazonaws.com",
|
||||
"delivery.logs.amazonaws.com",
|
||||
"sns.amazonaws.com",
|
||||
"sqs.amazonaws.com",
|
||||
"lambda.amazonaws.com",
|
||||
"backup.amazonaws.com",
|
||||
"events.amazonaws.com",
|
||||
"cloudwatch.amazonaws.com",
|
||||
"s3.amazonaws.com",
|
||||
"logs.amazonaws.com"
|
||||
]
|
||||
type = "Service"
|
||||
}
|
||||
|
||||
actions = [
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt",
|
||||
"kms:ReEncrypt*",
|
||||
"kms:GenerateDataKey*",
|
||||
"kms:DescribeKey"
|
||||
]
|
||||
|
||||
resources = [
|
||||
"*"
|
||||
]
|
||||
|
||||
effect = "Allow"
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "Key administrator"
|
||||
actions = [
|
||||
"kms:*"
|
||||
]
|
||||
|
||||
resources = [
|
||||
"*"
|
||||
]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = [data.aws_caller_identity.this.account_id]
|
||||
}
|
||||
|
||||
effect = "Allow"
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,76 @@
|
||||
|
||||
|
||||
data "aws_iam_policy_document" "cloudtrail_bucket_policy" {
|
||||
statement {
|
||||
sid = "AWSCloudTrailAclCheck"
|
||||
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["cloudtrail.amazonaws.com"]
|
||||
}
|
||||
|
||||
actions = [
|
||||
"s3:GetBucketAcl",
|
||||
]
|
||||
|
||||
resources = [
|
||||
"arn:aws:s3:::${local.ct-bucket-name}",
|
||||
]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AWSCloudTrailWrite"
|
||||
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["config.amazonaws.com", "cloudtrail.amazonaws.com"]
|
||||
}
|
||||
|
||||
actions = [
|
||||
"s3:PutObject",
|
||||
]
|
||||
|
||||
resources = [
|
||||
"arn:aws:s3:::${local.ct-bucket-name}/*",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "aws_s3_bucket" "ct-bucket" {
|
||||
bucket = local.ct-bucket-name
|
||||
policy = join("", data.aws_iam_policy_document.cloudtrail_bucket_policy.*.json)
|
||||
versioning {
|
||||
enabled = false
|
||||
}
|
||||
server_side_encryption_configuration {
|
||||
rule {
|
||||
apply_server_side_encryption_by_default {
|
||||
kms_master_key_id = aws_kms_key.ctbucket-key.arn
|
||||
sse_algorithm = "aws:kms"
|
||||
}
|
||||
}
|
||||
}
|
||||
tags = var.default-tags
|
||||
|
||||
lifecycle_rule {
|
||||
enabled = false
|
||||
transition {
|
||||
days = 30
|
||||
storage_class = "INTELLIGENT_TIERING"
|
||||
}
|
||||
expiration {
|
||||
days = 90
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "aws_s3_bucket_public_access_block" "s3-public-access-settings" {
|
||||
bucket = aws_s3_bucket.ct-bucket.id
|
||||
|
||||
block_public_acls = true
|
||||
block_public_policy = true
|
||||
ignore_public_acls = true
|
||||
restrict_public_buckets = true
|
||||
}
|
||||
@ -0,0 +1,35 @@
|
||||
resource "aws_cloudwatch_log_group" "ct-cwl" {
|
||||
name = "${local.resource-prefix}-cwl-001"
|
||||
retention_in_days = 90
|
||||
kms_key_id = aws_kms_key.ctbucket-key.arn
|
||||
tags = var.default-tags
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_log_metric_filter" "cwl-metric-filter-cis11" {
|
||||
name = "cis11-rootaccess-filter"
|
||||
pattern = <<EOT
|
||||
{$.userIdentity.type="Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType !="AwsServiceEvent"}
|
||||
EOT
|
||||
log_group_name = aws_cloudwatch_log_group.ct-cwl.name
|
||||
|
||||
metric_transformation {
|
||||
name = "cis11-rootaccess-metric"
|
||||
namespace = "LogMetrics"
|
||||
value = "1"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_metric_alarm" "cis11-rootaccess-alarm" {
|
||||
alarm_name = "cis11-rootaccess-alarm"
|
||||
comparison_operator = "GreaterThanOrEqualToThreshold"
|
||||
evaluation_periods = "1"
|
||||
metric_name = "cis11-rootaccess-metric"
|
||||
namespace = "LogMetrics"
|
||||
period = "300"
|
||||
statistic = "Average"
|
||||
threshold = "1"
|
||||
alarm_description = "Root access is detected from cloudtrail"
|
||||
treat_missing_data = "notBreaching"
|
||||
|
||||
// alarm_actions = []
|
||||
}
|
||||
@ -0,0 +1 @@
|
||||
data "aws_caller_identity" "this" {}
|
||||
@ -0,0 +1,11 @@
|
||||
variable "customer-name" {}
|
||||
variable "environment" {}
|
||||
variable "project" {}
|
||||
variable "application" {}
|
||||
variable "aws-region-short" {}
|
||||
variable "default-tags" {}
|
||||
locals {
|
||||
ct-bucket-name = "${var.environment}-${var.aws-region-short}-${var.customer-name}-${var.project}-ctbucket-${data.aws_caller_identity.this.account_id}"
|
||||
resource-prefix = "${var.environment}-${var.aws-region-short}-${var.customer-name}-${var.project}"
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user