Skip to content

Commit 7e70dc7

Browse files
Updated Cloudtrail module
1 parent 9945837 commit 7e70dc7

File tree

7 files changed

+166
-80
lines changed

7 files changed

+166
-80
lines changed

aws/cloudtrail/README.md

Lines changed: 49 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -12,43 +12,67 @@ This module is used to create AWS and Sumo Logic resource to collect CloudTrail
1212

1313
| Name | Version |
1414
|------|---------|
15-
| terraform | >= 0.13.0 |
16-
| aws | >= 3.42.0 |
17-
| random | >=3.1.0 |
18-
| sumologic | >= 2.9.0 |
19-
| time | >=0.7.1 |
15+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
16+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.16.2, < 6.0.0 |
17+
| <a name="requirement_random"></a> [random](#requirement\_random) | >=3.1.0 |
18+
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.28.3, < 3.0.0 |
19+
| <a name="requirement_time"></a> [time](#requirement\_time) | >=0.7.1 |
2020

2121
## Providers
2222

2323
| Name | Version |
2424
|------|---------|
25-
| aws | >= 3.42.0 |
26-
| random | >=3.1.0 |
27-
| sumologic | >= 2.9.0 |
28-
| time | >=0.7.1 |
25+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.16.2, < 6.0.0 |
26+
| <a name="provider_random"></a> [random](#provider\_random) | >=3.1.0 |
27+
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.28.3, < 3.0.0 |
28+
| <a name="provider_time"></a> [time](#provider\_time) | >=0.7.1 |
29+
30+
## Modules
31+
32+
No modules.
33+
34+
## Resources
35+
36+
| Name | Type |
37+
|------|------|
38+
| [aws_cloudtrail.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail) | resource |
39+
| [aws_iam_policy.iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
40+
| [aws_iam_role.source_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
41+
| [aws_s3_bucket.s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
42+
| [aws_s3_bucket_notification.bucket_notification](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |
43+
| [aws_s3_bucket_policy.s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
44+
| [aws_sns_topic.sns_topic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
45+
| [aws_sns_topic_subscription.subscription](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
46+
| [random_string.aws_random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
47+
| [sumologic_cloudtrail_source.source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudtrail_source) | resource |
48+
| [sumologic_collector.collector](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/collector) | resource |
49+
| [time_sleep.wait_for_seconds](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
50+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
51+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
52+
| [sumologic_caller_identity.current](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/caller_identity) | data source |
2953

3054
## Inputs
3155

3256
| Name | Description | Type | Default | Required |
3357
|------|-------------|------|---------|:--------:|
34-
| cloudtrail\_details | Provide details for the AWS CloudTrail. If not provided, then defaults will be used. | <pre>object({<br> name = string<br> is_multi_region_trail = bool<br> is_organization_trail = bool<br> include_global_service_events = bool<br> })</pre> | <pre>{<br> "include_global_service_events": false,<br> "is_multi_region_trail": false,<br> "is_organization_trail": false,<br> "name": "SumoLogic-Terraform-CloudTrail-random-id"<br>}</pre> | no |
35-
| collector\_details | Provide details for the Sumo Logic collector. If not provided, then defaults will be used. | <pre>object({<br> collector_name = string<br> description = string<br> fields = map(string)<br> })</pre> | <pre>{<br> "collector_name": "SumoLogic CloudTrail Collector <Random ID>",<br> "description": "This collector is created using Sumo Logic terraform AWS cloudtrail module to collect AWS cloudtrail logs.",<br> "fields": {}<br>}</pre> | no |
36-
| create\_collector | Provide "true" if you would like to create the Sumo Logic Collector. | `bool` | n/a | yes |
37-
| create\_trail | Provide "true" if you would like to create the AWS CloudTrail. If the bucket is created by the module, module by default creates the AWS cloudtrail. | `bool` | n/a | yes |
38-
| source\_details | Provide details for the Sumo Logic CloudTrail source. If not provided, then defaults will be used. | <pre>object({<br> source_name = string<br> source_category = string<br> collector_id = string<br> description = string<br> bucket_details = object({<br> create_bucket = bool<br> bucket_name = string<br> path_expression = string<br> force_destroy_bucket = bool<br> })<br> paused = bool<br> scan_interval = string<br> sumo_account_id = number<br> cutoff_relative_time = string<br> fields = map(string)<br> iam_details = object({<br> create_iam_role = bool<br> iam_role_arn = string<br> })<br> sns_topic_details = object({<br> create_sns_topic = bool<br> sns_topic_arn = string<br> })<br> })</pre> | <pre>{<br> "bucket_details": {<br> "bucket_name": "cloudtrail-logs-random-id",<br> "create_bucket": true,<br> "force_destroy_bucket": true,<br> "path_expression": "AWSLogs/<ACCOUNT-ID>/CloudTrail/<REGION-NAME>/*"<br> },<br> "collector_id": "",<br> "cutoff_relative_time": "-1d",<br> "description": "This source is created using Sumo Logic terraform AWS cloudtrail module to collect AWS cloudtrail logs.",<br> "fields": {},<br> "iam_details": {<br> "create_iam_role": true,<br> "iam_role_arn": null<br> },<br> "paused": false,<br> "scan_interval": 300000,<br> "sns_topic_details": {<br> "create_sns_topic": true,<br> "sns_topic_arn": null<br> },<br> "source_category": "Labs/aws/cloudtrail",<br> "source_name": "CloudTrail Source",<br> "sumo_account_id": 926226587429<br>}</pre> | no |
39-
| sumologic\_organization\_id | Appears on the Account Overview page that displays information about your Sumo Logic organization. Used for IAM Role in Sumo Logic AWS Sources. | `string` | n/a | yes |
40-
| wait\_for\_seconds | wait\_for\_seconds is used to delay sumo logic source creation. This helps persisting IAM role in AWS system.<br> Default value is 180 seconds.<br> If the AWS IAM role is created outside the module, the value can be decreased to 1 second. | `number` | `180` | no |
58+
| <a name="input_cloudtrail_details"></a> [cloudtrail\_details](#input\_cloudtrail\_details) | Provide details for the AWS CloudTrail. If not provided, then defaults will be used. | <pre>object({<br> name = string<br> is_multi_region_trail = bool<br> is_organization_trail = bool<br> include_global_service_events = bool<br> })</pre> | <pre>{<br> "include_global_service_events": false,<br> "is_multi_region_trail": false,<br> "is_organization_trail": false,<br> "name": "SumoLogic-Terraform-CloudTrail-random-id"<br>}</pre> | no |
59+
| <a name="input_collector_details"></a> [collector\_details](#input\_collector\_details) | Provide details for the Sumo Logic collector. If not provided, then defaults will be used. | <pre>object({<br> collector_name = string<br> description = string<br> fields = map(string)<br> })</pre> | <pre>{<br> "collector_name": "SumoLogic CloudTrail Collector <Random ID>",<br> "description": "This collector is created using Sumo Logic terraform AWS cloudtrail module to collect AWS cloudtrail logs.",<br> "fields": {}<br>}</pre> | no |
60+
| <a name="input_create_collector"></a> [create\_collector](#input\_create\_collector) | Provide "true" if you would like to create the Sumo Logic Collector. | `bool` | n/a | yes |
61+
| <a name="input_create_trail"></a> [create\_trail](#input\_create\_trail) | Provide "true" if you would like to create the AWS CloudTrail. If the bucket is created by the module, module by default creates the AWS cloudtrail. | `bool` | n/a | yes |
62+
| <a name="input_source_details"></a> [source\_details](#input\_source\_details) | Provide details for the Sumo Logic CloudTrail source. If not provided, then defaults will be used. | <pre>object({<br> source_name = string<br> source_category = string<br> collector_id = string<br> description = string<br> bucket_details = object({<br> create_bucket = bool<br> bucket_name = string<br> path_expression = string<br> force_destroy_bucket = bool<br> })<br> paused = bool<br> scan_interval = string<br> sumo_account_id = number<br> cutoff_relative_time = string<br> fields = map(string)<br> iam_details = object({<br> create_iam_role = bool<br> iam_role_arn = string<br> })<br> sns_topic_details = object({<br> create_sns_topic = bool<br> sns_topic_arn = string<br> })<br> })</pre> | <pre>{<br> "bucket_details": {<br> "bucket_name": "cloudtrail-logs-random-id",<br> "create_bucket": true,<br> "force_destroy_bucket": true,<br> "path_expression": "AWSLogs/<ACCOUNT-ID>/CloudTrail/<REGION-NAME>/*"<br> },<br> "collector_id": "",<br> "cutoff_relative_time": "-1d",<br> "description": "This source is created using Sumo Logic terraform AWS cloudtrail module to collect AWS cloudtrail logs.",<br> "fields": {},<br> "iam_details": {<br> "create_iam_role": true,<br> "iam_role_arn": null<br> },<br> "paused": false,<br> "scan_interval": 300000,<br> "sns_topic_details": {<br> "create_sns_topic": true,<br> "sns_topic_arn": null<br> },<br> "source_category": "Labs/aws/cloudtrail",<br> "source_name": "CloudTrail Source",<br> "sumo_account_id": 926226587429<br>}</pre> | no |
63+
| <a name="input_sumologic_organization_id"></a> [sumologic\_organization\_id](#input\_sumologic\_organization\_id) | Appears on the Account Overview page that displays information about your Sumo Logic organization. Used for IAM Role in Sumo Logic AWS Sources. | `string` | n/a | yes |
64+
| <a name="input_wait_for_seconds"></a> [wait\_for\_seconds](#input\_wait\_for\_seconds) | wait\_for\_seconds is used to delay sumo logic source creation. This helps persisting IAM role in AWS system.<br> Default value is 180 seconds.<br> If the AWS IAM role is created outside the module, the value can be decreased to 1 second. | `number` | `180` | no |
4165

4266
## Outputs
4367

4468
| Name | Description |
4569
|------|-------------|
46-
| aws\_cloudtrail | AWS Trail created to send CloudTrail logs to AWS S3 bucket. |
47-
| aws\_iam\_role | AWS IAM role with permission to allow Sumo Logic to read logs from S3 Bucket. |
48-
| aws\_s3\_bucket | AWS S3 Bucket name created to Store the CloudTrail logs. |
49-
| aws\_s3\_bucket\_notification | AWS S3 Bucket Notification attached to the AWS S3 Bucket |
50-
| aws\_sns\_subscription | AWS SNS subscription to Sumo Logic AWS CloudTrail source. |
51-
| aws\_sns\_topic | AWS SNS topic attached to the AWS S3 bucket. |
52-
| random\_string | Random String value created. |
53-
| sumologic\_collector | Sumo Logic hosted collector. |
54-
| sumologic\_source | Sumo Logic AWS CloudTrail source. |
70+
| <a name="output_aws_cloudtrail"></a> [aws\_cloudtrail](#output\_aws\_cloudtrail) | AWS Trail created to send CloudTrail logs to AWS S3 bucket. |
71+
| <a name="output_aws_iam_role"></a> [aws\_iam\_role](#output\_aws\_iam\_role) | AWS IAM role with permission to allow Sumo Logic to read logs from S3 Bucket. |
72+
| <a name="output_aws_s3_bucket"></a> [aws\_s3\_bucket](#output\_aws\_s3\_bucket) | AWS S3 Bucket name created to Store the CloudTrail logs. |
73+
| <a name="output_aws_s3_bucket_notification"></a> [aws\_s3\_bucket\_notification](#output\_aws\_s3\_bucket\_notification) | AWS S3 Bucket Notification attached to the AWS S3 Bucket |
74+
| <a name="output_aws_sns_subscription"></a> [aws\_sns\_subscription](#output\_aws\_sns\_subscription) | AWS SNS subscription to Sumo Logic AWS CloudTrail source. |
75+
| <a name="output_aws_sns_topic"></a> [aws\_sns\_topic](#output\_aws\_sns\_topic) | AWS SNS topic attached to the AWS S3 bucket. |
76+
| <a name="output_random_string"></a> [random\_string](#output\_random\_string) | Random String value created. |
77+
| <a name="output_sumologic_collector"></a> [sumologic\_collector](#output\_sumologic\_collector) | Sumo Logic hosted collector. |
78+
| <a name="output_sumologic_source"></a> [sumologic\_source](#output\_sumologic\_source) | Sumo Logic AWS CloudTrail source. |
Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
## Requirements
2+
3+
| Name | Version |
4+
|------|---------|
5+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
6+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.43.0 |
7+
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.28.3, < 3.0.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.43.0 |
14+
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | 2.28.3 |
15+
16+
## Modules
17+
18+
| Name | Source | Version |
19+
|------|--------|---------|
20+
| <a name="module_cloudtrail_module"></a> [cloudtrail\_module](#module\_cloudtrail\_module) | ../../../cloudtrail | n/a |
21+
22+
## Resources
23+
24+
| Name | Type |
25+
|------|------|
26+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
27+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
28+
| [sumologic_caller_identity.current](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/caller_identity) | data source |
29+
30+
## Inputs
31+
32+
| Name | Description | Type | Default | Required |
33+
|------|-------------|------|---------|:--------:|
34+
| <a name="input_sumo_aws_account_id"></a> [sumo\_aws\_account\_id](#input\_sumo\_aws\_account\_id) | Please provide Sumo's AWS account ID | `string` | n/a | yes |
35+
| <a name="input_sumologic_access_id"></a> [sumologic\_access\_id](#input\_sumologic\_access\_id) | Please provide access ID for your Sumo Account | `string` | n/a | yes |
36+
| <a name="input_sumologic_access_key"></a> [sumologic\_access\_key](#input\_sumologic\_access\_key) | Please provide access key for your Sumo Account | `string` | n/a | yes |
37+
| <a name="input_sumologic_collector_id"></a> [sumologic\_collector\_id](#input\_sumologic\_collector\_id) | Please provide Sumo Collector ID | `string` | n/a | yes |
38+
| <a name="input_sumologic_environment"></a> [sumologic\_environment](#input\_sumologic\_environment) | Please provide SumoLogic deployment environment | `string` | n/a | yes |
39+
| <a name="input_sumologic_organization_id"></a> [sumologic\_organization\_id](#input\_sumologic\_organization\_id) | Appears on the Account Overview page that displays information about your Sumo Logic organization. Used for IAM Role in Sumo Logic AWS Sources. | `string` | n/a | yes |
40+
41+
## Outputs
42+
43+
| Name | Description |
44+
|------|-------------|
45+
| <a name="output_aws_account_id"></a> [aws\_account\_id](#output\_aws\_account\_id) | n/a |
46+
| <a name="output_aws_region_data"></a> [aws\_region\_data](#output\_aws\_region\_data) | n/a |
47+
| <a name="output_sumologic_env"></a> [sumologic\_env](#output\_sumologic\_env) | n/a |

aws/cloudtrail/examples/default/local.tf

Lines changed: 0 additions & 35 deletions
This file was deleted.
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
locals {
2+
# AWS account details
3+
aws_account_id = data.aws_caller_identity.current.account_id
4+
aws_region = data.aws_region.current.name
5+
6+
# CloudTrail inputs
7+
bucket_name = "aws-observability-random-${var.sumologic_collector_id}"
8+
path_expression = "AWSLogs/${local.aws_account_id}/CloudTrail/${local.aws_region}/*"
9+
cloudtrail_fields = { account = local.aws_account_id }
10+
cloudtrail_source_bucket_name = "akhil_${local.aws_region}_${var.sumologic_organization_id}"
11+
}

aws/cloudtrail/examples/default/main.auto.tfvars

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@
22
sumologic_environment = "<YOUR SUMO DEPLOYMENT>" # Please replace <YOUR SUMO DEPLOYMENT> (including brackets) with au, ca, de, eu, jp, us2, in, fed or us1.
33
sumologic_organization_id = "<YOUR SUMO ORG ID>" # Please replace <YOUR SUMO ORG ID> (including brackets) with your Sumo Logic Organization ID.
44
sumologic_access_id = "<YOUR SUMO ACCESS ID>" # Please replace <YOUR SUMO ACCESS ID> (including brackets) with your Sumo Logic Access ID.
5-
sumologic_access_key = "<YOUR SUMO ACCESS KEY>" # Please replace <YOUR SUMO ACCESS KEY> (including brackets) with your Sumo Logic Access KEY.
5+
sumologic_access_key = "<YOUR SUMO ACCESS KEY>" # Please replace <YOUR SUMO ACCESS KEY> (including brackets) with your Sumo Logic Access KEY.
6+
sumologic_collector_id = "<YOUR SUMO COLLECTOR ID>" # Please replace <YOUR SUMO COLLECTOR ID> (including brackets) with your Sumo Logic collector ID.
7+
sumo_aws_account_id = "<SUMO'S AWS ACCOUNT ID>" # Please replace <UMO'S AWS ACCOUNT ID> (including brackets) with Sumo Logic's aws account ID.

0 commit comments

Comments
 (0)