Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add s3_key_prefix variable #48

Merged
merged 4 commits into from
Nov 29, 2021
Merged

add s3_key_prefix variable #48

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a371fe9
add s3_key_prefix variable
niraj8 Mar 31, 2021
6d39381
Auto Format
cloudpossebot Mar 31, 2021
fede373
Merge remote-tracking branch 'upstream/master'
niraj8 Nov 26, 2021
8284892
Auto Format
cloudpossebot Nov 26, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.<br>Characters matching the regex will be removed from the ID elements.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
| <a name="input_s3_bucket_name"></a> [s3\_bucket\_name](#input\_s3\_bucket\_name) | S3 bucket name for CloudTrail logs | `string` | n/a | yes |
| <a name="input_s3_key_prefix"></a> [s3\_key\_prefix](#input\_s3\_key\_prefix) | Prefix for S3 bucket used by Cloudtrail to store logs | `string` | `null` | no |
| <a name="input_sns_topic_name"></a> [sns\_topic\_name](#input\_sns\_topic\_name) | Specifies the name of the Amazon SNS topic defined for notification of log file delivery | `string` | `null` | no |
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
Expand Down
2 changes: 1 addition & 1 deletion main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ resource "aws_cloudtrail" "default" {
tags = module.this.tags
kms_key_id = var.kms_key_arn
is_organization_trail = var.is_organization_trail

s3_key_prefix = var.s3_key_prefix
Copy link

@bridgecrew bridgecrew bot Nov 26, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure CloudTrail trail is integrated with CloudWatch Log
    Resource: aws_cloudtrail.default | ID: BC_AWS_LOGGING_27

How to Fix

resource "aws_cloudtrail" "aws_cloudtrail_ok" {
  name                          = "tf-trail-foobar"
  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.example.arn}:*"
}

Description

AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch logs log group. It is recommended that CloudTrail logs be sent to CloudWatch logs.

Copy link

@bridgecrew bridgecrew bot Nov 26, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure AWS CloudTrail logs are encrypted using CMKs
    Resource: aws_cloudtrail.default | ID: BC_AWS_LOGGING_7
Error in referred variable: variable "kms_key_arn"

How to Fix

Resources:
	myTrail: 
  	Type: AWS::CloudTrail::Trail
		Properties: 
			...
+			KMSKeyId: alias/MyAliasName

Description

AWS CloudTrail is a web service that records AWS API calls for an account, and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data. It uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server-side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs.

We recommend that CloudTrail logs are configured to use SSE-KMS, providing additional confidentiality controls on log data. A given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.

Benchmarks

  • SOC2 CC6.3.3
  • PCI-DSS V3.2 3, 10
  • HIPAA 164.312(D) Person or entity authentication
  • NIST-800-53 AC-17
  • ISO27001 A.12.4.2
  • CIS AWS V1.2 2.7
  • PCI-DSS V3.2.1 10.5.1
  • FEDRAMP (MODERATE) AU-9, SC-28
  • CIS AWS V1.3 3.7

Copy link

@bridgecrew bridgecrew bot Nov 26, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure AWS CloudTrail logs are encrypted using CMKs
    Resource: aws_cloudtrail.default | ID: BC_AWS_LOGGING_7
Error in referred variable: variable "kms_key_arn"

How to Fix

Resources:
	myTrail: 
  	Type: AWS::CloudTrail::Trail
		Properties: 
			...
+			KMSKeyId: alias/MyAliasName

Description

AWS CloudTrail is a web service that records AWS API calls for an account, and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data. It uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server-side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs.

We recommend that CloudTrail logs are configured to use SSE-KMS, providing additional confidentiality controls on log data. A given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.

Benchmarks

  • SOC2 CC6.3.3
  • PCI-DSS V3.2 3, 10
  • HIPAA 164.312(D) Person or entity authentication
  • NIST-800-53 AC-17
  • ISO27001 A.12.4.2
  • CIS AWS V1.2 2.7
  • PCI-DSS V3.2.1 10.5.1
  • FEDRAMP (MODERATE) AU-9, SC-28
  • CIS AWS V1.3 3.7

Copy link

@bridgecrew bridgecrew bot Nov 26, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure CloudTrail trail is integrated with CloudWatch Log
    Resource: aws_cloudtrail.default | ID: BC_AWS_LOGGING_27

How to Fix

resource "aws_cloudtrail" "aws_cloudtrail_ok" {
  name                          = "tf-trail-foobar"
  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.example.arn}:*"
}

Description

AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch logs log group. It is recommended that CloudTrail logs be sent to CloudWatch logs.

dynamic "event_selector" {
for_each = var.event_selector
content {
Expand Down
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,3 +71,9 @@ variable "sns_topic_name" {
description = "Specifies the name of the Amazon SNS topic defined for notification of log file delivery"
default = null
}

variable "s3_key_prefix" {
type = string
description = "Prefix for S3 bucket used by Cloudtrail to store logs"
default = null
}