feat: Cloudtrail logging for s3 events

main.tf

@@ -43,6 +43,22 @@ locals {
   main_bucket_name  = var.bucket_name != "" ? var.bucket_name : module.file_storage.bucket_name
 }
 
+module "cloudtrail" {
+  source = "./modules/cloudtrail"
+
+  # Required Variables
+  namespace              = var.namespace
+  cloudtrail_bucket_name = var.cloudtrail_bucket_name
+  force_destroy          = var.force_destroy
+  log_lifecycle          = var.log_lifecycle
+
+  # Optional Variables with Defaults
+  include_global_service_events = var.include_global_service_events
+  multi_region_trail            = var.multi_region_trail
+  enable_log_file_validation    = var.enable_log_file_validation
+  tags                          = var.tags
+}
+
 module "networking" {
   source               = "./modules/networking"
   namespace            = var.namespace

modules/cloudtrail/variables.tf

@@ -20,7 +20,7 @@ variable "log_lifecycle" {
 variable "include_global_service_events" {
   description = "Whether to include global service events in the CloudTrail"
   type        = bool
-  default     = true
+  default     = false
 }
 
 variable "multi_region_trail" {

variables.tf

@@ -578,3 +578,50 @@ variable "kubernetes_cluster_oidc_issuer_url" {
   description = "OIDC issuer URL for the Kubernetes cluster. Can be determined using `kubectl get --raw /.well-known/openid-configuration`"
   default     = ""
 }
+
+##########################################
+# Cloudtrail                             #
+##########################################
+
+variable "cloudtrail_bucket_name" {
+  description = "Name of the S3 bucket storing CloudTrail logs"
+  type        = string
+}
+
+variable "force_destroy" {
+  description = "Determines if the bucket should be forcefully deleted"
+  type        = bool
+  default     = false
+}
+
+variable "log_lifecycle" {
+  description = "Object containing transition and expiration days for logs"
+  type = object({
+    transition_days = number
+    expiration_days = number
+  })
+}
+
+variable "include_global_service_events" {
+  description = "Enable logging of global AWS service events"
+  type        = bool
+  default     = true
+}
+
+variable "multi_region_trail" {
+  description = "Enable CloudTrail across multiple regions"
+  type        = bool
+  default     = true
+}
+
+variable "enable_log_file_validation" {
+  description = "Enable CloudTrail log file validation"
+  type        = bool
+  default     = true
+}
+
+variable "tags" {
+  description = "Tags for CloudTrail resources"
+  type        = map(string)
+  default     = {}
+}