forked from cloudposse/terraform-aws-config
-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
244 lines (196 loc) · 8.7 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
# ----------------------------------------------------------------------------------------------------------------------
# Enable and configure AWS Config
# ----------------------------------------------------------------------------------------------------------------------
module "aws_config_label" {
source = "cloudposse/label/null"
version = "0.25.0"
attributes = ["config"]
context = module.this.context
}
resource "aws_config_configuration_recorder" "recorder" {
count = module.this.enabled ? 1 : 0
name = module.aws_config_label.id
role_arn = local.create_iam_role ? module.iam_role[0].arn : var.iam_role_arn
recording_group {
all_supported = (length(var.recorded_resource_types) == 0) ? true : false
include_global_resource_types = (length(var.recorded_resource_types) == 0) ? local.is_global_recorder_region : null
resource_types = var.recorded_resource_types
}
}
resource "aws_config_delivery_channel" "channel" {
count = module.this.enabled ? 1 : 0
name = module.aws_config_label.id
s3_bucket_name = var.s3_bucket_id
s3_key_prefix = var.s3_key_prefix
sns_topic_arn = local.findings_notification_arn
depends_on = [
aws_config_configuration_recorder.recorder,
module.iam_role,
]
}
resource "aws_config_configuration_recorder_status" "recorder_status" {
count = module.this.enabled ? 1 : 0
name = aws_config_configuration_recorder.recorder[0].name
is_enabled = true
depends_on = [aws_config_delivery_channel.channel]
}
resource "aws_config_config_rule" "rules" {
for_each = module.this.enabled ? var.managed_rules : {}
depends_on = [aws_config_configuration_recorder_status.recorder_status]
name = each.key
description = each.value.description
source {
owner = "AWS"
source_identifier = each.value.identifier
}
input_parameters = length(each.value.input_parameters) > 0 ? jsonencode(each.value.input_parameters) : null
tags = merge(module.this.tags, each.value.tags)
}
#-----------------------------------------------------------------------------------------------------------------------
# Optionally create an SNS topic and subscriptions
#-----------------------------------------------------------------------------------------------------------------------
module "sns_topic" {
source = "cloudposse/sns-topic/aws"
version = "0.20.1"
count = module.this.enabled && local.create_sns_topic ? 1 : 0
attributes = concat(module.this.attributes, ["config"])
subscribers = {
for subscriber in var.subscribers : subscriber => {
protocol = lookup(subscriber, "protocol")
endpoint = lookup(subscriber, "endpoint")
endpoint_auto_confirms = lookup(subscriber, "endpoint_auto_confirms", false)
raw_message_delivery = lookup(subscriber, "raw_message_delivery", false)
}
}
sqs_dlq_enabled = false
kms_master_key_id = var.sns_encryption_key_id
sqs_queue_kms_master_key_id = var.sqs_queue_kms_master_key_id
allowed_aws_services_for_sns_published = var.allowed_aws_services_for_sns_published
allowed_iam_arns_for_sns_publish = var.allowed_iam_arns_for_sns_publish
tags = module.this.tags
context = module.this.context
}
module "aws_config_findings_label" {
source = "cloudposse/label/null"
version = "0.25.0"
attributes = ["config", "findings"]
context = module.this.context
}
#-----------------------------------------------------------------------------------------------------------------------
# Optionally create an IAM Role
#-----------------------------------------------------------------------------------------------------------------------
module "iam_role" {
count = module.this.enabled && local.create_iam_role ? 1 : 0
source = "cloudposse/iam-role/aws"
version = "0.15.0"
principals = {
"Service" = ["config.amazonaws.com"]
}
use_fullname = true
policy_documents = var.create_sns_topic ? [
data.aws_iam_policy_document.config_s3_policy[0].json,
data.aws_iam_policy_document.config_sns_policy[0].json
] : [
data.aws_iam_policy_document.config_s3_policy[0].json
]
policy_document_count = var.create_sns_topic ? 2 : 1
policy_description = "AWS Config IAM policy"
role_description = "AWS Config IAM role"
attributes = ["config"]
context = module.this.context
}
resource "aws_iam_role_policy_attachment" "config_policy_attachment" {
count = module.this.enabled && local.create_iam_role ? 1 : 0
role = module.iam_role[0].name
policy_arn = data.aws_iam_policy.aws_config_built_in_role.arn
}
data "aws_iam_policy" "aws_config_built_in_role" {
arn = "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole"
}
data "aws_iam_policy_document" "config_s3_policy" {
count = local.create_iam_role ? 1 : 0
statement {
sid = "ConfigS3"
effect = "Allow"
resources = [
"${var.s3_bucket_arn}/*",
var.s3_bucket_arn
]
actions = [
"s3:PutObject",
"s3:GetBucketAcl"
]
condition {
test = "StringLike"
variable = "s3:x-amz-acl"
values = ["bucket-owner-full-control"]
}
}
}
data "aws_iam_policy_document" "config_sns_policy" {
count = local.create_iam_role && local.create_sns_topic ? 1 : 0
statement {
sid = "ConfigSNS"
effect = "Allow"
resources = [local.findings_notification_arn]
actions = [
"sns:Publish"
]
}
}
#-----------------------------------------------------------------------------------------------------------------------
# CONFIG AGGREGATION
#-----------------------------------------------------------------------------------------------------------------------
module "aws_config_aggregator_label" {
source = "cloudposse/label/null"
version = "0.25.0"
attributes = ["config", "aggregator"]
context = module.this.context
}
resource "aws_config_configuration_aggregator" "this" {
# Create the aggregator in the global recorder region of the central AWS Config account. This is usually the
# "security" account
count = local.enabled && local.is_central_account && local.is_global_recorder_region ? 1 : 0
name = module.aws_config_aggregator_label.id
account_aggregation_source {
account_ids = local.child_resource_collector_accounts
all_regions = true
}
tags = module.this.tags
}
resource "aws_config_aggregate_authorization" "child" {
# The following only occurs when Multi-Account Multi-Region Data Aggregation is enabled by supplying
# `var.central_resource_collector_account` with an AWS Account ID:
#
# Authorize each region in a child account to send its data to the global_resource_collector_region of the
# central_resource_collector_account
count = local.enabled && var.central_resource_collector_account != null ? 1 : 0
account_id = var.central_resource_collector_account
region = var.global_resource_collector_region
tags = module.this.tags
}
resource "aws_config_aggregate_authorization" "central" {
# The following only occurs when `var.central_resource_collector_account` is omitted, thus disabling
# Multi-Account Multi-Region Data Aggregation and only enabling Multi-Region aggregation within the same account:
#
# Authorize each region to send its data to the global_resource_collector_region
count = local.enabled && var.central_resource_collector_account == null ? 1 : 0
account_id = data.aws_caller_identity.this.account_id
region = var.global_resource_collector_region
tags = module.this.tags
}
#-----------------------------------------------------------------------------------------------------------------------
# LOCALS AND DATA SOURCES
#-----------------------------------------------------------------------------------------------------------------------
data "aws_region" "this" {}
data "aws_caller_identity" "this" {}
locals {
enabled = module.this.enabled && !contains(var.disabled_aggregation_regions, data.aws_region.this.name)
is_central_account = var.central_resource_collector_account == data.aws_caller_identity.this.account_id
is_global_recorder_region = var.global_resource_collector_region == data.aws_region.this.name
child_resource_collector_accounts = var.child_resource_collector_accounts != null ? var.child_resource_collector_accounts : []
enable_notifications = module.this.enabled && (var.create_sns_topic || var.findings_notification_arn != null)
create_sns_topic = module.this.enabled && var.create_sns_topic
findings_notification_arn = local.enable_notifications ? (var.findings_notification_arn != null ? var.findings_notification_arn : module.sns_topic[0].sns_topic.arn) : null
create_iam_role = module.this.enabled && var.create_iam_role
}