Merge pull request #16 from clouddrove/feature/updated_cloudtrail

themaniskshah · web-flow · commit a8dc58bb7647 · 2023-05-11T18:28:05.000+05:30
[feature/updated_cloudtrail]Fix : cloudtrail IAM policy and s3 bucket policy, update the variables.
diff --git a/README.yaml b/README.yaml
@@ -71,6 +71,7 @@ usage : |-
       iam_role_name                     = "CloudTrail-CloudWatch-Delivery-Role"
       iam_role_policy_name              = "CloudTrail-CloudWatch-Delivery-Policy"
       account_type                      = "master"
+      is_organization_trail             = true      
       key_deletion_window_in_days       = 10
       cloudwatch_logs_retention_in_days = 365
       cloudwatch_logs_group_name        = "cloudtrail-log-group"
diff --git a/_example/master/example.tf b/_example/master/example.tf
@@ -1,83 +1,122 @@
 provider "aws" {
-  region = "eu-west-1"
+  region = "us-east-1"
 }
 
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
-module "cloudtrail" {
-  source = "./../../"
-
-  name        = "trails"
-  environment = "test"
-  label_order = ["environment", "name"]
-
-  enabled                           = true
-  iam_role_name                     = "CloudTrail-CloudWatch-Delivery-Role"
-  iam_role_policy_name              = "CloudTrail-CloudWatch-Delivery-Policy"
-  account_type                      = "master"
-  key_deletion_window_in_days       = 10
-  cloudwatch_logs_retention_in_days = 365
-  cloudwatch_logs_group_name        = "cloudtrail-log-group"
-  EVENT_IGNORE_LIST                 = jsonencode(["^Describe*", "^Assume*", "^List*", "^Get*", "^Decrypt*", "^Lookup*", "^BatchGet*", "^CreateLogStream$", "^RenewRole$", "^REST.GET.OBJECT_LOCK_CONFIGURATION$", "TestEventPattern", "TestScheduleExpression", "CreateNetworkInterface", "ValidateTemplate"])
-  EVENT_ALERT_LIST                  = jsonencode(["DetachRolePolicy", "ConsoleLogin"])
-  USER_IGNORE_LIST                  = jsonencode(["^awslambda_*", "^aws-batch$", "^bamboo*", "^i-*", "^[0-9]*$", "^ecs-service-scheduler$", "^AutoScaling$", "^AWSCloudFormation$", "^CloudTrailBot$", "^SLRManagement$"])
-  SOURCE_LIST                       = jsonencode(["aws-sdk-go"])
-
-  s3_bucket_name                 = "logs-bucket-cd"
-  secure_s3_enabled              = false
-  s3_log_bucket_name             = "logs-bucket-cd-logs"
-  sse_algorithm                  = "aws:kms"
-  slack_webhook                  = "https://hooks.slack.com/services/TEE0GHDK0F0QZ/B015frHRDBEUFHEVEG/dfdrfrefrwewqe"
-  slack_channel                  = "testing"
-  additional_member_root_arn     = ["arn:aws:iam::xxxxxxxxxxxx:root"]
-  additional_member_trail        = ["arn:aws:cloudtrail:*:xxxxxxxxxxxx:trail/*"]
-  additional_member_account_id   = ["xxxxxxxxxxxx"]
-  additional_s3_account_path_arn = ["arn:aws:s3:::logs-bucket-clouddrove/AWSLogs/xxxxxxxxxxxx/*"]
-  s3_policy                      = data.aws_iam_policy_document.default.json
-}
+  module "cloudtrail" {
+    source = "./../../"
+    name                              = "test-cloudtrail"
+    environment                       = "main"
+    label_order                       = ["environment", "name"]
+    enabled                           = true
+    iam_role_name                     = "CloudTrail-CloudWatch-Delivery-Role"
+    iam_role_policy_name              = "CloudTrail-CloudWatch-Delivery-Policy"
+    account_type                      = "master"
+    key_deletion_window_in_days       = 10
+    cloudwatch_logs_retention_in_days = 365
+    cloudwatch_logs_group_name        = "cloudtrail-log-group"
+    EVENT_IGNORE_LIST                 = jsonencode(["^Describe*", "^Assume*", "^List*", "^Get*", "^Decrypt*", "^Lookup*", "^BatchGet*", "^CreateLogStream$", "^RenewRole$", "^REST.GET.OBJECT_LOCK_CONFIGURATION$", "TestEventPattern", "TestScheduleExpression", "CreateNetworkInterface", "ValidateTemplate"])
+    EVENT_ALERT_LIST                  = jsonencode(["DetachRolePolicy", "ConsoleLogin"])
+    USER_IGNORE_LIST                  = jsonencode(["^awslambda_*", "^aws-batch$", "^bamboo*", "^i-*", "^[0-9]*$", "^ecs-service-scheduler$", "^AutoScaling$", "^AWSCloudFormation$", "^CloudTrailBot$", "^SLRManagement$"])
+    SOURCE_LIST                       = jsonencode(["aws-sdk-go"])
+    s3_bucket_name                    = "test-cloudtrail-bucket"
+    secure_s3_enabled                 = false
+    s3_log_bucket_name                = "test-clouddtrail-logs"
+    sse_algorithm                     = "aws:kms"
+    additional_member_root_arn        = ["arn:aws:iam::xxxxxxxxxxxx:root"]
+    additional_member_trail           = ["arn:aws:cloudtrail:*:xxxxxxxxxxxx:trail/*"]
+    additional_member_account_id      = ["xxxxxxxxxxxx"]
+    additional_s3_account_path_arn    = ["arn:aws:s3:::test-cloudtrail-bucket/AWSLogs/xxxxxxxxxxxx/*"]
+    s3_policy                         = data.aws_iam_policy_document.default.json
+  }
 
-data "aws_iam_policy_document" "default" {
-  statement {
-    sid = "AWSCloudTrailAclCheck"
 
-    principals {
-      type        = "Service"
-      identifiers = ["cloudtrail.amazonaws.com"]
-    }
+  data "aws_iam_policy_document" "default" {
+    statement {
+      sid = "AWSCloudTrailAclCheck20150319"
 
-    actions = [
-      "s3:GetBucketAcl"
-    ]
+      principals {
+        type        = "Service"
+        identifiers = ["cloudtrail.amazonaws.com"]
+      }
 
-    resources = ["arn:aws:s3:::logs-bucket-cd"]
-  }
+      actions = [
+        "s3:GetBucketAcl"
+      ]
 
-  statement {
-    sid = "AWSCloudTrailWrite"
+      resources = ["arn:aws:s3:::test-cloudtrail-bucket"]
+      condition {
+        test     = "StringEquals"
+        variable = "AWS:SourceArn"
 
-    principals {
-      type        = "Service"
-      identifiers = ["cloudtrail.amazonaws.com"]
+        values = [
+          "arn:aws:cloudtrail:us-east-1:xxxxxxxxxxxx:trail/xcheck-trails"
+        ]
+      }  
     }
+    statement {
+      sid = "AWSCloudTrailWrite20150319"
 
-    actions = [
-      "s3:PutObject"
-    ]
+      principals {
+        type        = "Service"
+        identifiers = ["cloudtrail.amazonaws.com"]
+      }
 
-    resources = compact(
-      concat(
-        [format("arn:aws:s3:::logs-bucket-cd/AWSLogs/%s/*", data.aws_caller_identity.current.account_id), "arn:aws:s3:::logs-bucket-cd/AWSLogs/xxxxxxxxxxxx/*"]
-      )
-    )
+      actions = [
+        "s3:PutObject"
+      ]
 
-    condition {
-      test     = "StringEquals"
-      variable = "s3:x-amz-acl"
+      resources =  ["arn:aws:s3:::test-cloudtrail-bucket/AWSLogs/xxxxxxxxxxxx/*"]
 
-      values = [
-        "bucket-owner-full-control"
-      ]
+      condition {
+        test     = "StringEquals"
+        variable = "s3:x-amz-acl"
+
+        values = [
+          "bucket-owner-full-control"
+        ]
+      }
+      condition {
+        test     = "StringEquals"
+        variable = "AWS:SourceArn"
+
+        values = [
+          "arn:aws:cloudtrail:us-east-1:xxxxxxxxxxxx:trail/xcheck-trails"
+        ]
+      }    
     }
+
+    statement {
+      sid = "AWSCloudTrailWrite2015031"
+
+      principals {
+        type        = "Service"
+        identifiers = ["cloudtrail.amazonaws.com"]
+      }
+
+      actions = [
+        "s3:PutObject"
+      ]
+
+      resources =  ["arn:aws:s3:::logs-bucket-cd-test/AWSLogs/<AWS_ORGANIZATION_ID>/*"]
+
+      condition {
+        test     = "StringEquals"
+        variable = "s3:x-amz-acl"
+
+        values = [
+          "bucket-owner-full-control"
+        ]
+      }
+      condition {
+        test     = "StringEquals"
+        variable = "AWS:SourceArn"
+
+        values = [
+          "arn:aws:cloudtrail:us-east-1:xxxxxxxxxxxx:trail/xcheck-trails"
+        ]
+      }    
+    }  
   }
-}
diff --git a/main.tf b/main.tf
@@ -34,7 +34,7 @@ module "s3_log_bucket" {
   create_bucket  = local.is_cloudtrail_enabled
   bucket_enabled = var.enabled
   versioning     = true
-  acl            = "log-delivery-write"
+  acl            = "private"
 }
 
 module "s3_bucket" {
@@ -47,7 +47,7 @@ module "s3_bucket" {
   create_bucket           = local.is_cloudtrail_enabled && var.secure_s3_enabled == false
   bucket_logging_enabled  = var.enabled && var.secure_s3_enabled == false
   versioning              = true
-  acl                     = "log-delivery-write"
+  acl                     = "private"
   bucket_policy           = true
   aws_iam_policy_document = var.s3_policy
   force_destroy           = true
@@ -66,7 +66,7 @@ module "secure_s3_bucket" {
   create_bucket                     = local.is_cloudtrail_enabled && var.secure_s3_enabled
   bucket_logging_encryption_enabled = var.enabled && var.secure_s3_enabled
   versioning                        = true
-  acl                               = "log-delivery-write"
+  acl                               = "private"
   bucket_policy                     = true
   aws_iam_policy_document           = var.s3_policy
   force_destroy                     = true
@@ -141,7 +141,7 @@ module "kms_key" {
   description             = "KMS key for cloudtrail"
   deletion_window_in_days = 7
   enable_key_rotation     = true
-  alias                   = "alias/cloudtrail1"
+  alias                   = "alias/cloudtrail"
   policy                  = data.aws_iam_policy_document.cloudtrail_key_policy.json
 }
 
@@ -177,11 +177,17 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       variable = "kms:EncryptionContext:aws:cloudtrail:arn"
       values = compact(
         concat(
-          [format("arn:aws:cloudtrail:*:%s:trail/*", data.aws_caller_identity.current.account_id)],
-          var.additional_member_trail
+          [format("arn:aws:cloudtrail:*:%s:trail/*", data.aws_caller_identity.current.account_id)]
         )
       )
     }
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceArn"
+      values = [
+        "arn:aws:cloudtrail:us-east-1:156873913342:trail/<trail_Name>"
+      ]
+    }    
   }
 
   statement {
@@ -210,8 +216,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       variable = "kms:CallerAccount"
       values = compact(
         concat(
-          [data.aws_caller_identity.current.account_id],
-          var.additional_member_account_id
+          [data.aws_caller_identity.current.account_id]
         )
       )
     }
@@ -245,8 +250,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       values = compact(
         concat(
           [
-          data.aws_caller_identity.current.account_id],
-          var.additional_member_account_id
+          data.aws_caller_identity.current.account_id]
         )
       )
     }
@@ -267,8 +271,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       variable = "kms:CallerAccount"
       values = compact(
         concat(
-          [data.aws_caller_identity.current.account_id],
-          var.additional_member_account_id
+          [data.aws_caller_identity.current.account_id]
         )
       )
     }
@@ -277,8 +280,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       variable = "kms:EncryptionContext:aws:cloudtrail:arn"
       values = compact(
         concat(
-          [format("arn:aws:cloudtrail:*:%s:trail/*", data.aws_caller_identity.current.account_id)],
-          var.additional_member_trail
+          [format("arn:aws:cloudtrail:*:%s:trail/*", data.aws_caller_identity.current.account_id)]
         )
       )
     }
@@ -290,17 +292,16 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       type = "AWS"
       identifiers = compact(
         concat(
-          [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)],
-          var.additional_member_root_arn
+          [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)]
         )
       )
     }
     actions = [
-      "kms:Encrypt",
-      "kms:Decrypt",
-      "kms:ReEncrypt*",
-      "kms:GenerateDataKey*",
-      "kms:DescribeKey"
+    "kms:ReEncrypt*",
+    "kms:GenerateDataKey*",
+    "kms:Encrypt",
+    "kms:DescribeKey",
+    "kms:Decrypt"
     ]
     resources = ["*"]
   }
@@ -311,8 +312,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
       type = "AWS"
       identifiers = compact(
         concat(
-          [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)],
-          var.additional_member_root_arn
+          [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)]
         )
       )
     }
@@ -345,17 +345,17 @@ locals {
 module "cloudtrail" {
   source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail.git?ref=tags/0.14.0"
 
-  name                          = "cloudtrail"
+  name                          = var.name
   environment                   = var.environment
   label_order                   = ["name", "environment"]
   managedby                     = var.managedby
   enabled_cloudtrail            = var.enabled
   s3_bucket_name                = format("%s", var.s3_bucket_name)
-  enable_logging                = true
-  enable_log_file_validation    = true
-  include_global_service_events = true
-  is_multi_region_trail         = true
-  is_organization_trail         = false
+  enable_logging                = var.enable_logging
+  enable_log_file_validation    = var.enable_log_file_validation
+  include_global_service_events = var.include_global_service_events
+  is_multi_region_trail         = var.is_multi_region_trail
+  is_organization_trail         = var.is_organization_trail
   kms_key_id                    = var.key_arn == "" ? module.kms_key.key_arn : var.key_arn
   cloud_watch_logs_group_arn    = join("", aws_cloudwatch_log_group.cloudtrail_events.*.arn)
   cloud_watch_logs_role_arn     = join("", aws_iam_role.cloudwatch_delivery.*.arn)
diff --git a/variables.tf b/variables.tf
@@ -173,6 +173,30 @@ variable "is_organization_trail" {
   description = "Specifies whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account."
 }
 
+variable "is_multi_region_trail" {
+  type        = bool
+  default     = true
+  description = "Specifies whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account."
+}
+
+variable "include_global_service_events" {
+  type        = bool
+  default     = true
+  description = "Specifies whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account."
+}
+
+variable "enable_log_file_validation" {
+  type        = bool
+  default     = true
+  description = "Specifies whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account."
+}
+
+variable "enable_logging" {
+  type        = bool
+  default     = true
+  description = "Specifies whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account."
+}
+
 variable "account_type" {
   type        = string
   default     = "individual"
diff --git a/versions.tf b/versions.tf
@@ -1,4 +1,11 @@
 # Terraform version
 terraform {
-  required_version = ">= 0.12"
-}
+  required_version = ">= 1.3.6"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.48.0"
+    }
+  }
+}

Original file line number	Diff line number	Diff line change
`@@ -34,7 +34,7 @@ module "s3_log_bucket" {`
`34`	`34`	`create_bucket = local.is_cloudtrail_enabled`
`35`	`35`	`bucket_enabled = var.enabled`
`36`	`36`	`versioning = true`
`37`		`- acl = "log-delivery-write"`
	`37`	`+ acl = "private"`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`module "s3_bucket" {`
`@@ -47,7 +47,7 @@ module "s3_bucket" {`
`47`	`47`	`create_bucket = local.is_cloudtrail_enabled && var.secure_s3_enabled == false`
`48`	`48`	`bucket_logging_enabled = var.enabled && var.secure_s3_enabled == false`
`49`	`49`	`versioning = true`
`50`		`- acl = "log-delivery-write"`
	`50`	`+ acl = "private"`
`51`	`51`	`bucket_policy = true`
`52`	`52`	`aws_iam_policy_document = var.s3_policy`
`53`	`53`	`force_destroy = true`
`@@ -66,7 +66,7 @@ module "secure_s3_bucket" {`
`66`	`66`	`create_bucket = local.is_cloudtrail_enabled && var.secure_s3_enabled`
`67`	`67`	`bucket_logging_encryption_enabled = var.enabled && var.secure_s3_enabled`
`68`	`68`	`versioning = true`
`69`		`- acl = "log-delivery-write"`
	`69`	`+ acl = "private"`
`70`	`70`	`bucket_policy = true`
`71`	`71`	`aws_iam_policy_document = var.s3_policy`
`72`	`72`	`force_destroy = true`
`@@ -141,7 +141,7 @@ module "kms_key" {`
`141`	`141`	`description = "KMS key for cloudtrail"`
`142`	`142`	`deletion_window_in_days = 7`
`143`	`143`	`enable_key_rotation = true`
`144`		`- alias = "alias/cloudtrail1"`
	`144`	`+ alias = "alias/cloudtrail"`
`145`	`145`	`policy = data.aws_iam_policy_document.cloudtrail_key_policy.json`
`146`	`146`	`}`
`147`	`147`
`@@ -177,11 +177,17 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`177`	`177`	`variable = "kms:EncryptionContext:aws:cloudtrail:arn"`
`178`	`178`	`values = compact(`
`179`	`179`	`concat(`
`180`		`- [format("arn:aws:cloudtrail::%s:trail/", data.aws_caller_identity.current.account_id)],`
`181`		`- var.additional_member_trail`
	`180`	`+ [format("arn:aws:cloudtrail::%s:trail/", data.aws_caller_identity.current.account_id)]`
`182`	`181`	`)`
`183`	`182`	`)`
`184`	`183`	`}`
	`184`	`+ condition {`
	`185`	`+ test = "StringEquals"`
	`186`	`+ variable = "AWS:SourceArn"`
	`187`	`+ values = [`
	`188`	`+ "arn:aws:cloudtrail:us-east-1:156873913342:trail/<trail_Name>"`
	`189`	`+ ]`
	`190`	`+ }`
`185`	`191`	`}`
`186`	`192`
`187`	`193`	`statement {`
`@@ -210,8 +216,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`210`	`216`	`variable = "kms:CallerAccount"`
`211`	`217`	`values = compact(`
`212`	`218`	`concat(`
`213`		`- [data.aws_caller_identity.current.account_id],`
`214`		`- var.additional_member_account_id`
	`219`	`+ [data.aws_caller_identity.current.account_id]`
`215`	`220`	`)`
`216`	`221`	`)`
`217`	`222`	`}`
`@@ -245,8 +250,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`245`	`250`	`values = compact(`
`246`	`251`	`concat(`
`247`	`252`	`[`
`248`		`- data.aws_caller_identity.current.account_id],`
`249`		`- var.additional_member_account_id`
	`253`	`+ data.aws_caller_identity.current.account_id]`
`250`	`254`	`)`
`251`	`255`	`)`
`252`	`256`	`}`
`@@ -267,8 +271,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`267`	`271`	`variable = "kms:CallerAccount"`
`268`	`272`	`values = compact(`
`269`	`273`	`concat(`
`270`		`- [data.aws_caller_identity.current.account_id],`
`271`		`- var.additional_member_account_id`
	`274`	`+ [data.aws_caller_identity.current.account_id]`
`272`	`275`	`)`
`273`	`276`	`)`
`274`	`277`	`}`
`@@ -277,8 +280,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`277`	`280`	`variable = "kms:EncryptionContext:aws:cloudtrail:arn"`
`278`	`281`	`values = compact(`
`279`	`282`	`concat(`
`280`		`- [format("arn:aws:cloudtrail::%s:trail/", data.aws_caller_identity.current.account_id)],`
`281`		`- var.additional_member_trail`
	`283`	`+ [format("arn:aws:cloudtrail::%s:trail/", data.aws_caller_identity.current.account_id)]`
`282`	`284`	`)`
`283`	`285`	`)`
`284`	`286`	`}`
`@@ -290,17 +292,16 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`290`	`292`	`type = "AWS"`
`291`	`293`	`identifiers = compact(`
`292`	`294`	`concat(`
`293`		`- [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)],`
`294`		`- var.additional_member_root_arn`
	`295`	`+ [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)]`
`295`	`296`	`)`
`296`	`297`	`)`
`297`	`298`	`}`
`298`	`299`	`actions = [`
`299`		`- "kms:Encrypt",`
`300`		`- "kms:Decrypt",`
`301`		`- "kms:ReEncrypt*",`
`302`		`- "kms:GenerateDataKey*",`
`303`		`- "kms:DescribeKey"`
	`300`	`+ "kms:ReEncrypt*",`
	`301`	`+ "kms:GenerateDataKey*",`
	`302`	`+ "kms:Encrypt",`
	`303`	`+ "kms:DescribeKey",`
	`304`	`+ "kms:Decrypt"`
`304`	`305`	`]`
`305`	`306`	`resources = ["*"]`
`306`	`307`	`}`
`@@ -311,8 +312,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {`
`311`	`312`	`type = "AWS"`
`312`	`313`	`identifiers = compact(`
`313`	`314`	`concat(`
`314`		`- [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)],`
`315`		`- var.additional_member_root_arn`
	`315`	`+ [format("arn:aws:iam::%s:root", data.aws_caller_identity.current.account_id)]`
`316`	`316`	`)`
`317`	`317`	`)`
`318`	`318`	`}`
`@@ -345,17 +345,17 @@ locals {`
`345`	`345`	`module "cloudtrail" {`
`346`	`346`	`source = "git::https://github.com/clouddrove/terraform-aws-cloudtrail.git?ref=tags/0.14.0"`
`347`	`347`
`348`		`- name = "cloudtrail"`
	`348`	`+ name = var.name`
`349`	`349`	`environment = var.environment`
`350`	`350`	`label_order = ["name", "environment"]`
`351`	`351`	`managedby = var.managedby`
`352`	`352`	`enabled_cloudtrail = var.enabled`
`353`	`353`	`s3_bucket_name = format("%s", var.s3_bucket_name)`
`354`		`- enable_logging = true`
`355`		`- enable_log_file_validation = true`
`356`		`- include_global_service_events = true`
`357`		`- is_multi_region_trail = true`
`358`		`- is_organization_trail = false`
	`354`	`+ enable_logging = var.enable_logging`
	`355`	`+ enable_log_file_validation = var.enable_log_file_validation`
	`356`	`+ include_global_service_events = var.include_global_service_events`
	`357`	`+ is_multi_region_trail = var.is_multi_region_trail`
	`358`	`+ is_organization_trail = var.is_organization_trail`
`359`	`359`	`kms_key_id = var.key_arn == "" ? module.kms_key.key_arn : var.key_arn`
`360`	`360`	`cloud_watch_logs_group_arn = join("", aws_cloudwatch_log_group.cloudtrail_events.*.arn)`
`361`	`361`	`cloud_watch_logs_role_arn = join("", aws_iam_role.cloudwatch_delivery.*.arn)`