Skip to content

Commit f165245

Browse files
gambol99gambol99
committed
chore: seperating out the code to make it easier to consume, and fixing inspector
1 parent 621840d commit f165245

File tree

10 files changed

+228
-217
lines changed

10 files changed

+228
-217
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,7 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
4747

4848
| Name | Description |
4949
|------|-------------|
50+
| <a name="output_inspector_resource_types"></a> [inspector\_resource\_types](#output\_inspector\_resource\_types) | A list of resources type to enable for inspector |
51+
| <a name="output_securityhub_policy_associations"></a> [securityhub\_policy\_associations](#output\_securityhub\_policy\_associations) | A map of policy associations by policy name |
5052
| <a name="output_securityhub_policy_configurations"></a> [securityhub\_policy\_configurations](#output\_securityhub\_policy\_configurations) | A map of all the policies to the central configuration arns |
5153
<!-- END_TF_DOCS -->

‎access_analyzer.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
locals {
3+
## Determine if the macie service is managed by the landing zone
4+
analyzer_enabled = var.access_analyzer != null
5+
}
6+
7+
## Provision the unused access analyzer
8+
resource "aws_accessanalyzer_analyzer" "unused_access" {
9+
count = local.analyzer_enabled && try(var.access_analyzer.enable_unused_analyzer, false) ? 1 : 0
10+
11+
analyzer_name = var.access_analyzer.unused_analyzer_name
12+
type = "ORGANIZATION_UNUSED_ACCESS"
13+
configuration {
14+
unused_access {
15+
unused_access_age = var.access_analyzer.unused_access_age
16+
}
17+
}
18+
}
19+

‎config.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
2+
## Provision and distribute the stacksets to the appropriate accounts for aws config rules.
3+
module "config_rule_groups" {
4+
for_each = var.config.rule_groups
5+
source = "appvia/stackset/aws"
6+
version = "0.1.10"
7+
8+
name = format("%s%s", var.config.stackset_name_prefix, lower(each.key))
9+
description = format("Used to configure and distribute the AWS Config rules for %s", each.key)
10+
call_as = "DELEGATED_ADMIN"
11+
enabled_regions = try(each.value.enabled_regions, null)
12+
exclude_accounts = each.value.exclude_accounts
13+
organizational_units = each.value.associations
14+
permission_model = "SERVICE_MANAGED"
15+
tags = local.tags
16+
17+
template = templatefile("${path.module}/assets/cloudformation/config.yaml", {
18+
"description" = each.value.description
19+
"rule_group_name" = each.key
20+
"rules" = each.value.rules
21+
})
22+
}
23+

‎inspector.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
2+
locals {
3+
## A list of resources type to enable for inspector
4+
inspector_resources_types = compact([
5+
var.inspector.enable_ec2_scan ? "EC2" : null,
6+
var.inspector.enable_ecr_scan ? "ECR" : null,
7+
var.inspector.enable_lambda_code_scan ? "LAMBDA_CODE" : null,
8+
var.inspector.enable_lambda_scan ? "LAMBDA" : null,
9+
])
10+
}
11+
12+
resource "aws_inspector2_enabler" "inspector" {
13+
count = var.inspector.enable ? 1 : 0
14+
15+
account_ids = [var.inspector.account_id]
16+
resource_types = local.inspector_resources_types
17+
}
18+
19+
## All new accounts will have inspector enabled for the following resource types, any
20+
## existing accounts will need to be enabled manually via the aws_inspector2_member_association
21+
resource "aws_inspector2_organization_configuration" "auto_enable_inspector_new_accounts" {
22+
auto_enable {
23+
ec2 = var.inspector.enable_ec2_scan
24+
ecr = var.inspector.enable_ecr_scan
25+
lambda = var.inspector.enable_lambda_scan
26+
lambda_code = var.inspector.enable_lambda_code_scan
27+
}
28+
}
29+

‎locals.tf‎

Lines changed: 0 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -4,73 +4,4 @@ locals {
44
region = data.aws_region.current.name
55
## Tag applied to all resources
66
tags = merge(var.tags, {})
7-
8-
## Determine if the macie service is managed by the landing zone
9-
analyzer_enabled = var.access_analyzer != null
10-
## Determine if the macie service is managed by the landing zone
11-
macie_enabled = var.macie != null
12-
13-
## The subscription for the standards
14-
standards_subscription = {
15-
aws_foundational_best_practices = "arn:aws:securityhub:${local.region}::standards/aws-foundational-security-best-practices/v/1.0.0"
16-
cis_v120 = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
17-
cis_v140 = "arn:aws:securityhub:${local.region}::standards/cis-aws-foundations-benchmark/v/1.4.0"
18-
nist_sp_800_53_rev5 = "arn:aws:securityhub:${local.region}::standards/nist-800-53/v/5.0.0"
19-
pci_dss = "arn:aws:securityhub:${local.region}::standards/pci-dss/v/3.2.1"
20-
}
21-
22-
## A list of resources type to enable for inspector
23-
inspector_resources_types = [
24-
var.inspector.enable_ec2_scan ? "EC2" : null,
25-
var.inspector.enable_ecr_scan ? "ECR" : null,
26-
var.inspector.enable_lambda_code_scan ? "LAMBDA_CODE" : null,
27-
var.inspector.enable_lambda_scan ? "LAMBDA" : null,
28-
]
29-
30-
## A lost of policy associations
31-
policy_associations_all = flatten([
32-
for policy_name, policy in var.securityhub.policies : [
33-
for association in policy.associations : {
34-
key = format("%s-%s", policy_name, coalesce(association.account_id, association.organization_unit))
35-
policy = policy_name
36-
target_id = coalesce(association.account_id, association.organization_unit)
37-
}
38-
] if length(policy.associations) > 0
39-
])
40-
41-
## A map of policy associations by policy name
42-
policy_associations_by_policy = {
43-
for association in local.policy_associations_all : association.key => {
44-
policy = association.policy
45-
target_id = association.target_id
46-
}
47-
}
48-
49-
## A map of all the policies to the central configuration arns
50-
policy_standards = {
51-
for policy in aws_securityhub_configuration_policy.current : policy.name => policy.id
52-
}
53-
54-
#
55-
## Notifications related
56-
57-
## Indicates if the notifications for slack are enabled
58-
enable_slack_notifications = var.notifications.slack != null
59-
## Indicates if the notifications for teams are enabled
60-
enable_teams_notifications = var.notifications.teams != null
61-
62-
## The configuration for the slack notification
63-
slack = local.enable_slack_notifications ? {
64-
lambda_name = try(var.notifications.slack.lambda_name, null)
65-
webhook_url = try(var.notifications.slack.webhook_url, null)
66-
} : null
67-
68-
teams = local.enable_teams_notifications ? {
69-
lambda_name = try(var.notifications.teams.lambda_name, null)
70-
webhook_url = try(var.notifications.teams.webhook_url, null)
71-
} : null
72-
73-
email = {
74-
addresses = try(var.notifications.email.addresses, [])
75-
}
767
}

‎macie.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
2+
locals {
3+
## Determine if the macie service is managed by the landing zone
4+
macie_enabled = var.macie != null
5+
}
6+
7+
## Provision the stackset to enable the macie service across all the accounts
8+
module "macie" {
9+
count = local.macie_enabled ? 1 : 0
10+
source = "appvia/stackset/aws"
11+
version = "0.1.10"
12+
13+
name = try(var.macie.stackset_name, null)
14+
description = "Configuration for the AWS macie service, configured by the landing zone"
15+
exclude_accounts = try(var.macie.exclude_accounts, null)
16+
region = var.region
17+
tags = local.tags
18+
19+
template = templatefile("${path.module}/assets/cloudformation/macie.yaml", {
20+
frequency = var.macie.frequency
21+
status = var.macie.enable ? "ENABLED" : "DISABLED"
22+
})
23+
}

‎main.tf‎

Lines changed: 0 additions & 148 deletions
Original file line numberDiff line numberDiff line change
@@ -1,148 +0,0 @@
1-
## AWS Config
2-
3-
## Provision and distribute the stacksets to the appropriate accounts for aws config rules.
4-
module "config_rule_groups" {
5-
for_each = var.config.rule_groups
6-
source = "appvia/stackset/aws"
7-
version = "0.1.10"
8-
9-
name = format("%s%s", var.config.stackset_name_prefix, lower(each.key))
10-
description = format("Used to configure and distribute the AWS Config rules for %s", each.key)
11-
call_as = "DELEGATED_ADMIN"
12-
enabled_regions = try(each.value.enabled_regions, null)
13-
exclude_accounts = each.value.exclude_accounts
14-
organizational_units = each.value.associations
15-
permission_model = "SERVICE_MANAGED"
16-
tags = local.tags
17-
18-
template = templatefile("${path.module}/assets/cloudformation/config.yaml", {
19-
"description" = each.value.description
20-
"rule_group_name" = each.key
21-
"rules" = each.value.rules
22-
})
23-
}
24-
25-
## AWS Inspector
26-
27-
28-
resource "aws_inspector2_enabler" "inspector" {
29-
count = var.inspector.enable ? 1 : 0
30-
31-
account_ids = [var.inspector.account_id]
32-
resource_types = local.inspector_resources_types
33-
}
34-
35-
## All new accounts will have inspector enabled for the following resource types, any
36-
## existing accounts will need to be enabled manually via the aws_inspector2_member_association
37-
resource "aws_inspector2_organization_configuration" "auto_enable_inspector_new_accounts" {
38-
auto_enable {
39-
ec2 = var.inspector.enable_ec2_scan
40-
ecr = var.inspector.enable_ecr_scan
41-
lambda = var.inspector.enable_lambda_scan
42-
lambda_code = var.inspector.enable_lambda_code_scan
43-
}
44-
}
45-
46-
## AWS Macie
47-
48-
## Provision the stackset to enable the macie service across all the accounts
49-
module "macie" {
50-
count = local.macie_enabled ? 1 : 0
51-
source = "appvia/stackset/aws"
52-
version = "0.1.10"
53-
54-
name = try(var.macie.stackset_name, null)
55-
description = "Configuration for the AWS macie service, configured by the landing zone"
56-
exclude_accounts = try(var.macie.exclude_accounts, null)
57-
region = var.region
58-
tags = local.tags
59-
60-
template = templatefile("${path.module}/assets/cloudformation/macie.yaml", {
61-
frequency = var.macie.frequency
62-
status = var.macie.enable ? "ENABLED" : "DISABLED"
63-
})
64-
}
65-
66-
## AWS Access Analyzer
67-
68-
## Provision the unused access analyzer
69-
resource "aws_accessanalyzer_analyzer" "unused_access" {
70-
count = local.analyzer_enabled && try(var.access_analyzer.enable_unused_analyzer, false) ? 1 : 0
71-
72-
analyzer_name = var.access_analyzer.unused_analyzer_name
73-
type = "ORGANIZATION_UNUSED_ACCESS"
74-
configuration {
75-
unused_access {
76-
unused_access_age = var.access_analyzer.unused_access_age
77-
}
78-
}
79-
}
80-
81-
## AWS Security Hub
82-
83-
## Provision a securityhub aggregator in the account
84-
resource "aws_securityhub_finding_aggregator" "current" {
85-
count = var.securityhub.aggregator.create ? 1 : 0
86-
87-
linking_mode = var.securityhub.aggregator.linking_mode
88-
specified_regions = var.securityhub.aggregator.specified_regions
89-
}
90-
91-
## Provision the organization configuration
92-
resource "aws_securityhub_organization_configuration" "current" {
93-
auto_enable = var.securityhub.configuration.auto_enable
94-
auto_enable_standards = var.securityhub.configuration.auto_enable_standards
95-
96-
organization_configuration {
97-
configuration_type = var.securityhub.configuration.organization_configuration.configuration_type
98-
}
99-
100-
depends_on = [
101-
aws_securityhub_finding_aggregator.current,
102-
]
103-
}
104-
105-
## Provision one or more configuration policies for the security hub
106-
resource "aws_securityhub_configuration_policy" "current" {
107-
for_each = var.securityhub.policies
108-
109-
name = each.key
110-
description = each.value.description
111-
112-
configuration_policy {
113-
service_enabled = each.value.enable
114-
115-
enabled_standard_arns = [
116-
for standard in each.value.policy.standard_arns : local.standards_subscription[standard]
117-
]
118-
119-
security_controls_configuration {
120-
disabled_control_identifiers = each.value.policy.controls.disabled
121-
122-
dynamic "security_control_custom_parameter" {
123-
for_each = each.value.policy.controls.custom_parameter != null ? each.value.policy.controls.custom_parameter : []
124-
125-
content {
126-
security_control_id = security_control_custom_parameter.value.security_control_id
127-
128-
parameter {
129-
name = security_control_custom_parameter.value.parameter.name
130-
value_type = security_control_custom_parameter.value.parameter.value_type
131-
}
132-
}
133-
}
134-
}
135-
}
136-
137-
depends_on = [aws_securityhub_organization_configuration.current]
138-
}
139-
140-
## Associate a security hub policy with an account or organizational unit
141-
resource "aws_securityhub_configuration_policy_association" "current" {
142-
for_each = local.policy_associations_by_policy
143-
144-
policy_id = aws_securityhub_configuration_policy.current[each.value.policy].id
145-
target_id = each.value.target_id
146-
147-
depends_on = [aws_securityhub_configuration_policy.current]
148-
}

‎notifications.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,26 @@ locals {
2121
detail-type = ["Security Hub Findings - Imported"],
2222
source = ["aws.securityhub"]
2323
})
24+
25+
## Indicates if the notifications for slack are enabled
26+
enable_slack_notifications = var.notifications.slack != null
27+
## Indicates if the notifications for teams are enabled
28+
enable_teams_notifications = var.notifications.teams != null
29+
30+
## The configuration for the slack notification
31+
slack = local.enable_slack_notifications ? {
32+
lambda_name = try(var.notifications.slack.lambda_name, null)
33+
webhook_url = try(var.notifications.slack.webhook_url, null)
34+
} : null
35+
36+
teams = local.enable_teams_notifications ? {
37+
lambda_name = try(var.notifications.teams.lambda_name, null)
38+
webhook_url = try(var.notifications.teams.webhook_url, null)
39+
} : null
40+
41+
email = {
42+
addresses = try(var.notifications.email.addresses, [])
43+
}
2444
}
2545

2646
## Provision the notifications to forward the security hub findings to the messaging channel

‎outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,13 @@ output "securityhub_policy_configurations" {
33
description = "A map of all the policies to the central configuration arns"
44
value = local.policy_standards
55
}
6+
7+
output "securityhub_policy_associations" {
8+
description = "A map of policy associations by policy name"
9+
value = local.policy_associations_by_policy
10+
}
11+
12+
output "inspector_resource_types" {
13+
description = "A list of resources type to enable for inspector"
14+
value = try(local.inspector_resources_types, [])
15+
}

0 commit comments

Comments
 (0)