Skip to content

Commit 1a31192

Browse files
cdanilukcdaniluk
committed
initial commit
0 parents  commit 1a31192

File tree

10 files changed

+319
-0
lines changed

10 files changed

+319
-0
lines changed

‎.github/workflows/check.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: check
2+
on: [push, pull_request]
3+
4+
jobs:
5+
build:
6+
runs-on: macOS-latest
7+
steps:
8+
- uses: actions/checkout@v1
9+
10+
- name: Install prereq
11+
run: |
12+
brew install docker tfenv tflint
13+
tfenv install
14+
15+
- name: tf fmt
16+
run: |
17+
terraform fmt
18+
- name: tflint
19+
run: |
20+
tflint

‎.gitignore‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
11+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
12+
# .tfvars files are managed as part of configuration and so should be included in
13+
# version control.
14+
#
15+
# example.tfvars
16+
17+
# Ignore override files as they are usually used to override resources locally and so
18+
# are not checked in
19+
override.tf
20+
override.tf.json
21+
*_override.tf
22+
*_override.tf.json
23+
24+
# Include override files you do wish to add to version control using negated pattern
25+
#
26+
# !example_override.tf
27+
28+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
29+
# example: *tfplan*

‎.pre-commit-config.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
repos:
3+
- repo: git://github.com/antonbabenko/pre-commit-terraform
4+
rev: v1.24.0
5+
hooks:
6+
- id: terraform_fmt
7+
- id: terraform_docs
8+
- repo: https://github.com/pre-commit/pre-commit-hooks
9+
rev: v2.4.0
10+
hooks:
11+
- id: end-of-file-fixer
12+
- id: trailing-whitespace
13+
# - id: no-commit-to-branch

‎.terraform-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0.12.13

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2020 Rhythmic Technologies, Inc.
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# terraform-aws-vpcflowlog-bucket
2+
3+
[![](https://github.com/rhythmictech/terraform-aws-vpcflowlog-bucket/workflows/check/badge.svg)](https://github.com/rhythmictech/terraform-aws-vpcflowlog-bucket/actions)
4+
5+
Creates an S3 bucket suitable for receiving VPC flow logs from one or more AWS account. Uses a KMS CMK, which is necessary for CIS compliance. Requires an external bucket to route S3 access logs to (also for CIS compliance).
6+
7+
Example:
8+
9+
10+
```
11+
module "vpcflowlog-bucket" {
12+
source = "git::https://github.com/rhythmictech/terraform-aws-vpcflowlogs.git"
13+
allowed_account_ids = ["123456789012", "123456789013"]
14+
logging_bucket = "example-s3-access-logs-bucket"
15+
region = "us-east-1"
16+
}
17+
```
18+
19+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
20+
## Inputs
21+
22+
| Name | Description | Type | Default | Required |
23+
|------|-------------|:----:|:-----:|:-----:|
24+
| allowed\_account\_ids | Optional list of AWS Account IDs that are permitted to write to the bucket | list(string) | `[]` | no |
25+
| logging\_bucket | S3 bucket to send request logs to the VPC flow log bucket to | string | n/a | yes |
26+
| region | Region VPC flow logs will be sent to | string | n/a | yes |
27+
| tags | Tags to include on resources that support it | map(string) | `{}` | no |
28+
29+
## Outputs
30+
31+
| Name | Description |
32+
|------|-------------|
33+
| kms\_key\_id | KMS key |
34+
| s3\_bucket\_arn | The ARN of the bucket |
35+
| s3\_bucket\_name | The name of the bucket |
36+
37+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
38+
39+
## Related Projects
40+
* [VPC Flow Logs](https://github.com/rhythmictech/terraform-aws-vpc-flowlogs)

‎kms.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
data "aws_iam_policy_document" "key" {
2+
3+
statement {
4+
effect = "Allow"
5+
actions = ["kms:*"]
6+
resources = ["*"]
7+
principals {
8+
type = "AWS"
9+
identifiers = ["arn:aws:iam::${local.account_id}:root"]
10+
}
11+
}
12+
13+
statement {
14+
effect = "Allow"
15+
actions = [
16+
"kms:Encrypt",
17+
"kms:Decrypt",
18+
"kms:ReEncrypt*",
19+
"kms:GenerateDataKey*",
20+
"kms:DescribeKey",
21+
]
22+
resources = ["*"]
23+
24+
principals {
25+
type = "Service"
26+
identifiers = ["delivery.logs.amazonaws.com"]
27+
}
28+
}
29+
30+
statement {
31+
effect = "Allow"
32+
actions = [
33+
"kms:Encrypt",
34+
"kms:Decrypt",
35+
"kms:ReEncrypt*",
36+
"kms:GenerateDataKey*",
37+
"kms:DescribeKey",
38+
]
39+
resources = ["*"]
40+
41+
principals {
42+
type = "Service"
43+
identifiers = ["logs.${var.region}.amazonaws.com"]
44+
}
45+
}
46+
}
47+
48+
resource "aws_kms_key" "this" {
49+
deletion_window_in_days = 7
50+
description = "VPC Flow Log Encryption Key"
51+
enable_key_rotation = true
52+
policy = data.aws_iam_policy_document.key.json
53+
tags = merge(
54+
{
55+
"Name" = "vpcflowlog-key"
56+
},
57+
var.tags
58+
)
59+
}
60+
61+
resource "aws_kms_alias" "this" {
62+
name = "alias/vpcflowlog_key"
63+
target_key_id = aws_kms_key.this.id
64+
}

‎main.tf‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
data "aws_caller_identity" "current" {
2+
}
3+
4+
locals {
5+
account_id = data.aws_caller_identity.current.account_id
6+
7+
# Account IDs that will have access to stream CloudTrail logs
8+
account_ids = concat([local.account_id], var.allowed_account_ids)
9+
10+
# Format account IDs into necessary resource lists.
11+
bucket_policy_put_resources = formatlist("${aws_s3_bucket.this.arn}/AWSLogs/%s/*", local.account_ids)
12+
kms_key_encrypt_resources = formatlist("arn:aws:cloudtrail:*:%s:trail/*", local.account_ids)
13+
}
14+
15+
resource "aws_s3_bucket" "this" {
16+
bucket = "${local.account_id}-${var.region}-vpcflowlog"
17+
acl = "private"
18+
tags = var.tags
19+
20+
lifecycle_rule {
21+
enabled = true
22+
23+
transition {
24+
days = 30
25+
storage_class = "STANDARD_IA"
26+
}
27+
28+
}
29+
30+
logging {
31+
target_bucket = var.logging_bucket
32+
target_prefix = "${local.account_id}-${var.region}-vpcflowlog/"
33+
}
34+
35+
server_side_encryption_configuration {
36+
rule {
37+
apply_server_side_encryption_by_default {
38+
sse_algorithm = "aws:kms"
39+
kms_master_key_id = aws_kms_key.this.arn
40+
}
41+
}
42+
43+
}
44+
45+
versioning {
46+
enabled = true
47+
}
48+
49+
lifecycle {
50+
prevent_destroy = true
51+
}
52+
}
53+
54+
resource "aws_s3_bucket_public_access_block" "this" {
55+
bucket = aws_s3_bucket.this.id
56+
block_public_acls = true
57+
block_public_policy = true
58+
ignore_public_acls = true
59+
restrict_public_buckets = true
60+
}
61+
62+
data "aws_iam_policy_document" "this" {
63+
statement {
64+
actions = ["s3:GetBucketAcl"]
65+
effect = "Allow"
66+
resources = [aws_s3_bucket.this.arn]
67+
68+
principals {
69+
type = "Service"
70+
identifiers = ["delivery.logs.amazonaws.com"]
71+
}
72+
}
73+
74+
statement {
75+
actions = ["s3:PutObject"]
76+
effect = "Allow"
77+
resources = local.bucket_policy_put_resources
78+
79+
condition {
80+
test = "StringEquals"
81+
variable = "s3:x-amz-acl"
82+
values = ["bucket-owner-full-control"]
83+
}
84+
85+
principals {
86+
type = "Service"
87+
identifiers = ["delivery.logs.amazonaws.com"]
88+
}
89+
}
90+
91+
}
92+
93+
resource "aws_s3_bucket_policy" "this" {
94+
bucket = aws_s3_bucket.this.id
95+
policy = data.aws_iam_policy_document.this.json
96+
}

‎outputs.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
output "kms_key_id" {
2+
description = "KMS key"
3+
value = aws_kms_key.this.arn
4+
}
5+
6+
output "s3_bucket_arn" {
7+
description = "The ARN of the bucket"
8+
value = aws_s3_bucket.this.arn
9+
}
10+
11+
output "s3_bucket_name" {
12+
description = "The name of the bucket"
13+
value = aws_s3_bucket.this.bucket
14+
}

‎variables.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
variable "allowed_account_ids" {
2+
default = []
3+
description = "Optional list of AWS Account IDs that are permitted to write to the bucket"
4+
type = list(string)
5+
}
6+
7+
variable "logging_bucket" {
8+
description = "S3 bucket to send request logs to the VPC flow log bucket to"
9+
type = string
10+
}
11+
12+
variable "region" {
13+
description = "Region VPC flow logs will be sent to"
14+
type = string
15+
}
16+
17+
variable "tags" {
18+
default = {}
19+
description = "Tags to include on resources that support it"
20+
type = map(string)
21+
}

0 commit comments

Comments
 (0)