Skip to content

Commit 6a9e6c3

Browse files
helderklemphelderklemp
authored
Add aws config (#1)
* add aws config baseline * add missing IAM * removing iam variable * add conditional for sns topics * add conditional for iam roles * add provider * add provider * remove extra provider * removing config submodule, adding as a separate file
1 parent 90e27fc commit 6a9e6c3

File tree

5 files changed

+127
-3
lines changed

5 files changed

+127
-3
lines changed

‎README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ Terraform module to set up AWS account with the secure baseline configuration ba
1010

1111
## Providers
1212

13-
No provider.
13+
| Name | Version |
14+
|------|---------|
15+
| aws | n/a |
1416

1517
## Inputs
1618

@@ -19,8 +21,12 @@ No provider.
1921
| alarm\_namespace | The namespace in which all alarms are set up. | `string` | `"CISBenchmark"` | no |
2022
| alarm\_sns\_topic\_name | The name of the SNS Topic which will be notified when any alarm is performed. | `string` | `"CISAlarm"` | no |
2123
| cloudtrail\_log\_group\_name | The name of Cloudtrail log group. | `string` | `"bubbletea-cloudtrail"` | no |
24+
| config\_delivery\_frequency | The frequency which AWS Config sends a snapshot into the S3 bucket. | `string` | `"One_Hour"` | no |
25+
| config\_include\_global\_resource\_types | Specifies whether AWS Config includes all supported types of global resources with the resources that it records. | `bool` | `true` | no |
26+
| config\_s3\_bucket\_name | The name of the S3 bucket which will store configuration snapshots. | `any` | n/a | yes |
2227
| enable\_alarm\_baseline | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `string` | `"false"` | no |
2328
| enable\_chatbot\_slack | If true, will create aws chatboot and integrate to slack | `string` | `"false"` | no |
29+
| enable\_config\_baseline | If true, will create aws config | `string` | `"false"` | no |
2430
| org\_name | Name for this organization | `any` | n/a | yes |
2531
| slack\_channel\_id | Sclack channel id to send budget notfication using AWS Chatbot | `string` | `""` | no |
2632
| slack\_workspace\_id | Sclack workspace id to send budget notfication using AWS Chatbot | `string` | `""` | no |

‎_providers.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
provider "aws" {}

‎_variables.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,22 @@ variable "slack_workspace_id" {
4444
description = "Sclack workspace id to send budget notfication using AWS Chatbot"
4545
default = ""
4646
}
47+
48+
# --------------------------------------------------------------------------------------------------
49+
# Variables for alarm-baseline module.
50+
# --------------------------------------------------------------------------------------------------
51+
variable "enable_config_baseline" {
52+
description = "If true, will create aws config"
53+
default = "false"
54+
}
55+
variable "config_s3_bucket_name" {
56+
description = "The name of the S3 bucket which will store configuration snapshots."
57+
}
58+
variable "config_delivery_frequency" {
59+
description = "The frequency which AWS Config sends a snapshot into the S3 bucket."
60+
default = "One_Hour"
61+
}
62+
variable "config_include_global_resource_types" {
63+
description = "Specifies whether AWS Config includes all supported types of global resources with the resources that it records."
64+
default = true
65+
}

‎aws_config.tf‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# This file was created instead a sub module since we found an issue passing the provider to child submodules
2+
# AWS Config should be enabled into all accounts (master and sub accounts)
3+
resource "aws_sns_topic" "config" {
4+
count = var.enable_config_baseline ? 1 : 0
5+
6+
name = "ConfigChanges"
7+
tags = var.tags
8+
}
9+
resource "aws_iam_role_policy_attachment" "config" {
10+
count = var.enable_config_baseline ? 1 : 0
11+
role = aws_iam_role.config_role[0].name
12+
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
13+
}
14+
15+
resource "aws_iam_role" "config_role" {
16+
count = var.enable_config_baseline ? 1 : 0
17+
name = "awsconfig-role"
18+
19+
assume_role_policy = <<POLICY
20+
{
21+
"Version": "2012-10-17",
22+
"Statement": [
23+
{
24+
"Action": "sts:AssumeRole",
25+
"Principal": {
26+
"Service": "config.amazonaws.com"
27+
},
28+
"Effect": "Allow",
29+
"Sid": ""
30+
}
31+
]
32+
}
33+
POLICY
34+
}
35+
resource "aws_config_configuration_recorder" "recorder" {
36+
count = var.enable_config_baseline ? 1 : 0
37+
38+
name = "default"
39+
40+
role_arn = aws_iam_role.config_role[0].arn
41+
42+
recording_group {
43+
all_supported = true
44+
include_global_resource_types = var.config_include_global_resource_types
45+
}
46+
}
47+
48+
resource "aws_config_delivery_channel" "bucket" {
49+
count = var.enable_config_baseline ? 1 : 0
50+
51+
name = "default"
52+
53+
s3_bucket_name = var.config_s3_bucket_name
54+
s3_key_prefix = ""
55+
sns_topic_arn = aws_sns_topic.config[0].arn
56+
57+
snapshot_delivery_properties {
58+
delivery_frequency = var.config_delivery_frequency
59+
}
60+
61+
depends_on = [aws_config_configuration_recorder.recorder[0]]
62+
}
63+
64+
resource "aws_config_configuration_recorder_status" "recorder" {
65+
count = var.enable_config_baseline ? 1 : 0
66+
67+
name = aws_config_configuration_recorder.recorder[0].id
68+
69+
is_enabled = true
70+
depends_on = [aws_config_delivery_channel.bucket[0]]
71+
}
72+
73+
# --------------------------------------------------------------------------------------------------
74+
# A config rule to monitor open known ports.
75+
# --------------------------------------------------------------------------------------------------
76+
77+
resource "aws_config_config_rule" "restricted_ports" {
78+
count = var.enable_config_baseline ? 1 : 0
79+
80+
name = "RestrictedIncomingTraffic"
81+
82+
source {
83+
owner = "AWS"
84+
source_identifier = "RESTRICTED_INCOMING_TRAFFIC"
85+
}
86+
87+
input_parameters = <<JSON
88+
{
89+
"blockedPort1": "22",
90+
"blockedPort2": "3389"
91+
}
92+
JSON
93+
94+
tags = var.tags
95+
96+
depends_on = [aws_config_configuration_recorder.recorder[0]]
97+
}

‎main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,15 @@ module "alarm_baseline" {
1616
# --------------------------------------------------------------------------------------------------
1717
# Chatbot Notifications
1818
# --------------------------------------------------------------------------------------------------
19-
module "chatbot" {
19+
module "chatbot_alarms" {
2020
source = "git::https://github.com/DNXLabs/terraform-aws-chatbot?ref=0.1.1"
2121

2222
enabled = var.enable_chatbot_slack
2323
org_name = var.org_name
2424
workspace_name = var.alarm_namespace
2525
slack_channel_id = var.slack_channel_id
2626
slack_workspace_id = var.slack_workspace_id
27-
alarm_sns_topic_arn = module.alarm_baseline.alarm_sns_topic.*.arn[0]
27+
alarm_sns_topic_arn = (var.enable_chatbot_slack && var.enable_alarm_baseline) ? module.alarm_baseline.alarm_sns_topic.*.arn[0] : null
2828
tags = var.tags
2929
}
30+

0 commit comments

Comments
 (0)