Skip to content

Commit 22f99af

Browse files
anmolnagpalanmolnagpal
authored
Merge pull request #15 from clouddrove/CD-307
fix module for multi AWS account
2 parents d7d86f7 + 6916353 commit 22f99af

File tree

6 files changed

+71
-77
lines changed

6 files changed

+71
-77
lines changed

‎README.md

+21-18
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
<p align="center">
1515

1616
<a href="https://www.terraform.io">
17-
<img src="https://img.shields.io/badge/Terraform-v0.12-green" alt="Terraform">
17+
<img src="https://img.shields.io/badge/Terraform-v0.14-green" alt="Terraform">
1818
</a>
1919
<a href="LICENSE.md">
2020
<img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="Licence">
@@ -51,7 +51,7 @@ We have [*fifty plus terraform modules*][terraform_modules]. A few of them are c
5151

5252
This module has a few dependencies:
5353

54-
- [Terraform 0.13](https://learn.hashicorp.com/terraform/getting-started/install.html)
54+
- [Terraform 0.14](https://learn.hashicorp.com/terraform/getting-started/install.html)
5555
- [Go](https://golang.org/doc/install)
5656
- [github.com/stretchr/testify/assert](https://github.com/stretchr/testify)
5757
- [github.com/gruntwork-io/terratest/modules/terraform](https://github.com/gruntwork-io/terratest)
@@ -73,7 +73,7 @@ Here are some examples of how you can use this module in your inventory structur
7373
### Individual Account
7474
```hcl
7575
module "cloudtrail" {
76-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.12.12"
76+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.14.0"
7777
name = "trails"
7878
application = "clouddrove"
7979
environment = "test"
@@ -100,49 +100,52 @@ Here are some examples of how you can use this module in your inventory structur
100100
#### Master Account
101101
```hcl
102102
module "cloudtrail" {
103-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.12.12"
103+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.14.0"
104104
name = "trails"
105-
application = "clouddrove"
106105
environment = "test"
107-
label_order = ["environment", "application", "name"]
106+
label_order = ["environment", "name"]
108107
enabled = true
109108
iam_role_name = "CloudTrail-CloudWatch-Delivery-Role"
110109
iam_role_policy_name = "CloudTrail-CloudWatch-Delivery-Policy"
111110
account_type = "master"
112111
key_deletion_window_in_days = 10
113112
cloudwatch_logs_retention_in_days = 365
114113
cloudwatch_logs_group_name = "cloudtrail-log-group"
115-
s3_bucket_name = "logs-bucket-clouddrove"
116-
slack_webhook = "https://hooks.slack.com/services/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Jr46llqX"
117-
slack_channel = "testing"
118114
EVENT_IGNORE_LIST = jsonencode(["^Describe*", "^Assume*", "^List*", "^Get*", "^Decrypt*", "^Lookup*", "^BatchGet*", "^CreateLogStream$", "^RenewRole$", "^REST.GET.OBJECT_LOCK_CONFIGURATION$", "TestEventPattern", "TestScheduleExpression", "CreateNetworkInterface", "ValidateTemplate"])
119115
EVENT_ALERT_LIST = jsonencode(["DetachRolePolicy", "ConsoleLogin"])
120116
USER_IGNORE_LIST = jsonencode(["^awslambda_*", "^aws-batch$", "^bamboo*", "^i-*", "^[0-9]*$", "^ecs-service-scheduler$", "^AutoScaling$", "^AWSCloudFormation$", "^CloudTrailBot$", "^SLRManagement$"])
121117
SOURCE_LIST = jsonencode(["aws-sdk-go"])
122-
additional_member_root_arn = ["arn:aws:iam::xxxxxxxxxxx:root"]
123-
additional_member_trail = ["arn:aws:cloudtrail:*:xxxxxxxxxxx:trail/*"]
124-
additional_member_account_id = ["xxxxxxxxxxx"]
125-
additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxxx/*"]
118+
s3_bucket_name = "logs-bucket-cd"
119+
secure_s3_enabled = false
120+
s3_log_bucket_name = "logs-bucket-cd-logs"
121+
sse_algorithm = "aws:kms"
122+
slack_webhook = "https://hooks.slack.com/services/TEE0GHDK0F0QZ/B015frHRDBEUFHEVEG/dfdrfrefrwewqe"
123+
slack_channel = "testing"
124+
additional_member_root_arn = ["arn:aws:iam::xxxxxxxxxxxx:root"]
125+
additional_member_trail = ["arn:aws:cloudtrail:*:xxxxxxxxxxxx:trail/*"]
126+
additional_member_account_id = ["xxxxxxxxxxxx"]
127+
additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxxxx/*"]
128+
s3_policy = data.aws_iam_policy_document.default.json
126129
}
127130
```
128131

129132
#### Member Account
130133
```hcl
131134
module "cloudtrail" {
132-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.12.12"
135+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.14.0"
133136
name = "trails"
134-
application = "clouddrove"
135137
environment = "test"
136-
label_order = ["environment", "application", "name"]
138+
label_order = ["environment", "name"]
137139
enabled = true
138140
iam_role_name = "CloudTrail-cd-Delivery-Role"
139141
iam_role_policy_name = "CloudTrail-cd-Delivery-Policy"
140142
account_type = "member"
141143
key_deletion_window_in_days = 10
142144
cloudwatch_logs_retention_in_days = 365
143145
cloudwatch_logs_group_name = "cloudtrail-log-group"
144-
key_arn = "arn:aws:kms:eu-west-1:xxxxxxxxxxx:key/66cc5610-3b90-460b-a177-af89e119fdaa"
145-
s3_bucket_name = "logs-bucket-clouddrove"
146+
key_arn = "arn:aws:kms:eu-west-1:xxxxxxxxxxx:key/9f3b66a0-3a38-4ed3-ab34-5e47c7e3604b"
147+
s3_bucket_name = "logs-bucket-cd"
148+
s3_log_bucket_name = "logs-bucket-cd-logs"
146149
}
147150
```
148151

‎README.yaml

+21-19
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,15 @@ github_repo: clouddrove/terraform-aws-cloudtrail-baseline
1616
# Badges to display
1717
badges:
1818
- name: "Terraform"
19-
image: "https://img.shields.io/badge/Terraform-v0.12-green"
19+
image: "https://img.shields.io/badge/Terraform-v0.14-green"
2020
url: "https://www.terraform.io"
2121
- name: "Licence"
2222
image: "https://img.shields.io/badge/License-MIT-blue.svg"
2323
url: "LICENSE.md"
2424

2525
# description of this project
2626
description: |-
27-
Terraform module to create an cloudtrail resource on AWS with S3 encryption with KMS key.
27+
Terraform module to create an cloudtrail resource on AWS with S3 and KMS key.
2828
2929
# extra content
3030
include:
@@ -37,9 +37,8 @@ usage : |-
3737
### Individual Account
3838
```hcl
3939
module "cloudtrail" {
40-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.12.12"
40+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.14.0"
4141
name = "trails"
42-
application = "clouddrove"
4342
environment = "test"
4443
label_order = ["environment", "application", "name"]
4544
enabled = true
@@ -64,48 +63,51 @@ usage : |-
6463
#### Master Account
6564
```hcl
6665
module "cloudtrail" {
67-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.12.12"
66+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.14.0"
6867
name = "trails"
69-
application = "clouddrove"
7068
environment = "test"
71-
label_order = ["environment", "application", "name"]
69+
label_order = ["environment", "name"]
7270
enabled = true
7371
iam_role_name = "CloudTrail-CloudWatch-Delivery-Role"
7472
iam_role_policy_name = "CloudTrail-CloudWatch-Delivery-Policy"
7573
account_type = "master"
7674
key_deletion_window_in_days = 10
7775
cloudwatch_logs_retention_in_days = 365
7876
cloudwatch_logs_group_name = "cloudtrail-log-group"
79-
s3_bucket_name = "logs-bucket-clouddrove"
80-
slack_webhook = "https://hooks.slack.com/services/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Jr46llqX"
81-
slack_channel = "testing"
8277
EVENT_IGNORE_LIST = jsonencode(["^Describe*", "^Assume*", "^List*", "^Get*", "^Decrypt*", "^Lookup*", "^BatchGet*", "^CreateLogStream$", "^RenewRole$", "^REST.GET.OBJECT_LOCK_CONFIGURATION$", "TestEventPattern", "TestScheduleExpression", "CreateNetworkInterface", "ValidateTemplate"])
8378
EVENT_ALERT_LIST = jsonencode(["DetachRolePolicy", "ConsoleLogin"])
8479
USER_IGNORE_LIST = jsonencode(["^awslambda_*", "^aws-batch$", "^bamboo*", "^i-*", "^[0-9]*$", "^ecs-service-scheduler$", "^AutoScaling$", "^AWSCloudFormation$", "^CloudTrailBot$", "^SLRManagement$"])
8580
SOURCE_LIST = jsonencode(["aws-sdk-go"])
86-
additional_member_root_arn = ["arn:aws:iam::xxxxxxxxxxx:root"]
87-
additional_member_trail = ["arn:aws:cloudtrail:*:xxxxxxxxxxx:trail/*"]
88-
additional_member_account_id = ["xxxxxxxxxxx"]
89-
additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxxx/*"]
81+
s3_bucket_name = "logs-bucket-cd"
82+
secure_s3_enabled = false
83+
s3_log_bucket_name = "logs-bucket-cd-logs"
84+
sse_algorithm = "aws:kms"
85+
slack_webhook = "https://hooks.slack.com/services/TEE0GHDK0F0QZ/B015frHRDBEUFHEVEG/dfdrfrefrwewqe"
86+
slack_channel = "testing"
87+
additional_member_root_arn = ["arn:aws:iam::xxxxxxxxxxxx:root"]
88+
additional_member_trail = ["arn:aws:cloudtrail:*:xxxxxxxxxxxx:trail/*"]
89+
additional_member_account_id = ["xxxxxxxxxxxx"]
90+
additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxxxx/*"]
91+
s3_policy = data.aws_iam_policy_document.default.json
9092
}
9193
```
9294
9395
#### Member Account
9496
```hcl
9597
module "cloudtrail" {
96-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.12.12"
98+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-baseline.git?ref=tags/0.14.0"
9799
name = "trails"
98-
application = "clouddrove"
99100
environment = "test"
100-
label_order = ["environment", "application", "name"]
101+
label_order = ["environment", "name"]
101102
enabled = true
102103
iam_role_name = "CloudTrail-cd-Delivery-Role"
103104
iam_role_policy_name = "CloudTrail-cd-Delivery-Policy"
104105
account_type = "member"
105106
key_deletion_window_in_days = 10
106107
cloudwatch_logs_retention_in_days = 365
107108
cloudwatch_logs_group_name = "cloudtrail-log-group"
108-
key_arn = "arn:aws:kms:eu-west-1:xxxxxxxxxxx:key/66cc5610-3b90-460b-a177-af89e119fdaa"
109-
s3_bucket_name = "logs-bucket-clouddrove"
109+
key_arn = "arn:aws:kms:eu-west-1:xxxxxxxxxxx:key/9f3b66a0-3a38-4ed3-ab34-5e47c7e3604b"
110+
s3_bucket_name = "logs-bucket-cd"
111+
s3_log_bucket_name = "logs-bucket-cd-logs"
110112
}
111113
```

‎_example/master/example.tf

+15-13
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,8 @@ module "cloudtrail" {
99
source = "./../../"
1010

1111
name = "trails"
12-
application = "clouddrove"
1312
environment = "test"
14-
label_order = ["environment", "application", "name"]
13+
label_order = ["environment", "name"]
1514

1615
enabled = true
1716
iam_role_name = "CloudTrail-CloudWatch-Delivery-Role"
@@ -25,13 +24,16 @@ module "cloudtrail" {
2524
USER_IGNORE_LIST = jsonencode(["^awslambda_*", "^aws-batch$", "^bamboo*", "^i-*", "^[0-9]*$", "^ecs-service-scheduler$", "^AutoScaling$", "^AWSCloudFormation$", "^CloudTrailBot$", "^SLRManagement$"])
2625
SOURCE_LIST = jsonencode(["aws-sdk-go"])
2726

28-
s3_bucket_name = "logs-bucket-clouddrove"
29-
slack_webhook = "https://hooks.slack.com/services/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46llqX"
27+
s3_bucket_name = "logs-bucket-cd"
28+
secure_s3_enabled = false
29+
s3_log_bucket_name = "logs-bucket-cd-logs"
30+
sse_algorithm = "aws:kms"
31+
slack_webhook = "https://hooks.slack.com/services/TEE0GHDK0F0QZ/B015frHRDBEUFHEVEG/dfdrfrefrwewqe"
3032
slack_channel = "testing"
31-
additional_member_root_arn = ["arn:aws:iam::xxxxxxxxxx:root"]
32-
additional_member_trail = ["arn:aws:cloudtrail:*:xxxxxxxxxx:trail/*"]
33-
additional_member_account_id = ["xxxxxxxxxx"]
34-
additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxx/*"]
33+
additional_member_root_arn = ["arn:aws:iam::xxxxxxxxxxxx:root"]
34+
additional_member_trail = ["arn:aws:cloudtrail:*:xxxxxxxxxxxx:trail/*"]
35+
additional_member_account_id = ["xxxxxxxxxxxx"]
36+
additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxxxx/*"]
3537
s3_policy = data.aws_iam_policy_document.default.json
3638
}
3739

@@ -45,10 +47,10 @@ data "aws_iam_policy_document" "default" {
4547
}
4648

4749
actions = [
48-
"s3:GetBucketAcl",
50+
"s3:GetBucketAcl"
4951
]
5052

51-
resources = ["arn:aws:s3:::logs-bucket-clouddrove"]
53+
resources = ["arn:aws:s3:::logs-bucket-cd"]
5254
}
5355

5456
statement {
@@ -60,12 +62,12 @@ data "aws_iam_policy_document" "default" {
6062
}
6163

6264
actions = [
63-
"s3:PutObject",
65+
"s3:PutObject"
6466
]
6567

6668
resources = compact(
6769
concat(
68-
[format("arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/%s/*", data.aws_caller_identity.current.account_id)]
70+
[format("arn:aws:s3:::logs-bucket-cd/AWSLogs/%s/*", data.aws_caller_identity.current.account_id), "arn:aws:s3:::logs-bucket-cd/AWSLogs/xxxxxxxxxxxx/*"]
6971
)
7072
)
7173

@@ -74,7 +76,7 @@ data "aws_iam_policy_document" "default" {
7476
variable = "s3:x-amz-acl"
7577

7678
values = [
77-
"bucket-owner-full-control",
79+
"bucket-owner-full-control"
7880
]
7981
}
8082
}

‎_example/member/example.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,8 @@ module "cloudtrail" {
77
source = "./../../"
88

99
name = "trails"
10-
application = "clouddrove"
1110
environment = "test"
12-
label_order = ["environment", "application", "name"]
11+
label_order = ["environment", "name"]
1312

1413
enabled = true
1514
iam_role_name = "CloudTrail-cd-Delivery-Role"
@@ -18,7 +17,8 @@ module "cloudtrail" {
1817
key_deletion_window_in_days = 10
1918
cloudwatch_logs_retention_in_days = 365
2019
cloudwatch_logs_group_name = "cloudtrail-log-group"
21-
key_arn = "arn:aws:kms:eu-west-1:xxxxxxxxxx:key/341af1b8-d181-4dd1-8d7b-638dec0d925e"
20+
key_arn = "arn:aws:kms:eu-west-1:xxxxxxxxxxx:key/9f3b66a0-3a38-4ed3-ab34-5e47c7e3604b"
2221

23-
s3_bucket_name = "logs-bucket-clouddrove"
22+
s3_bucket_name = "logs-bucket-cd"
23+
s3_log_bucket_name = "logs-bucket-cd-logs"
2424
}

‎main.tf

+9-16
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,9 @@ data "aws_region" "current" {}
1010
# tags for resources. You can use terraform-labels to implement a strict
1111
# naming convention
1212
module "labels" {
13-
source = "git::https://github.com/clouddrove/terraform-labels.git?ref=tags/0.12.0"
13+
source = "git::https://github.com/clouddrove/terraform-labels.git?ref=tags/0.14.0"
1414

1515
name = var.name
16-
application = var.application
1716
environment = var.environment
1817
label_order = var.label_order
1918
managedby = var.managedby
@@ -26,10 +25,9 @@ module "labels" {
2625
# type specific features.
2726

2827
module "s3_log_bucket" {
29-
source = "git::https://github.com/clouddrove/terraform-aws-s3.git?ref=tags/0.12.8"
28+
source = "git::https://github.com/clouddrove/terraform-aws-s3.git?ref=tags/0.14.0"
3029

3130
name = var.s3_log_bucket_name
32-
application = var.application
3331
environment = var.environment
3432
label_order = ["name"]
3533
managedby = var.managedby
@@ -40,10 +38,9 @@ module "s3_log_bucket" {
4038
}
4139

4240
module "s3_bucket" {
43-
source = "git::https://github.com/clouddrove/terraform-aws-s3.git?ref=tags/0.12.8"
41+
source = "git::https://github.com/clouddrove/terraform-aws-s3.git?ref=tags/0.14.0"
4442

4543
name = var.s3_bucket_name
46-
application = var.application
4744
environment = var.environment
4845
label_order = ["name"]
4946
managedby = var.managedby
@@ -60,10 +57,9 @@ module "s3_bucket" {
6057
}
6158

6259
module "secure_s3_bucket" {
63-
source = "git::https://github.com/clouddrove/terraform-aws-s3.git?ref=tags/0.12.8"
60+
source = "git::https://github.com/clouddrove/terraform-aws-s3.git?ref=tags/0.14.0"
6461

6562
name = var.s3_bucket_name
66-
application = var.application
6763
environment = var.environment
6864
label_order = ["name"]
6965
managedby = var.managedby
@@ -76,7 +72,7 @@ module "secure_s3_bucket" {
7672
force_destroy = true
7773
sse_algorithm = var.sse_algorithm
7874
kms_master_key_id = var.key_arn == "" ? module.kms_key.key_arn : var.key_arn
79-
target_bucket = "aws:kms"
75+
target_bucket = module.s3_log_bucket.id
8076
target_prefix = "logs"
8177
mfa_delete = var.mfa_delete
8278
}
@@ -134,10 +130,9 @@ data "aws_iam_policy_document" "cloudwatch_delivery_policy" {
134130
}
135131

136132
module "kms_key" {
137-
source = "git::https://github.com/clouddrove/terraform-aws-kms.git?ref=tags/0.12.4"
133+
source = "git::https://github.com/clouddrove/terraform-aws-kms.git?ref=tags/0.14.0"
138134

139135
name = var.name
140-
application = var.application
141136
environment = var.environment
142137
label_order = var.label_order
143138
managedby = var.managedby
@@ -348,12 +343,11 @@ locals {
348343
#Description : Terraform module to provision an AWS CloudTrail with encrypted S3 bucket.
349344
# This bucket is used to store CloudTrail logs.
350345
module "cloudtrail" {
351-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail.git?ref=tags/0.12.5"
346+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail.git?ref=tags/0.14.0"
352347

353348
name = "cloudtrail"
354-
application = var.application
355349
environment = var.environment
356-
label_order = ["name", "application"]
350+
label_order = ["name", "environment"]
357351
managedby = var.managedby
358352
enabled_cloudtrail = var.enabled
359353
s3_bucket_name = format("%s", var.s3_bucket_name)
@@ -368,10 +362,9 @@ module "cloudtrail" {
368362
}
369363

370364
module "cloudtrail-slack-notification" {
371-
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-slack-notification.git?ref=tags/0.12.3"
365+
source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail-slack-notification.git?ref=tags/0.14.0"
372366

373367
name = "cloudtrail-slack-notification"
374-
application = var.application
375368
environment = var.environment
376369
managedby = var.managedby
377370
label_order = var.label_order

0 commit comments

Comments
 (0)