terraform-aws-eks-audit-log

A Terraform Module to integrate Amazon Elastic Kubernetes Service (EKS) with Lacework.

Pre-requisite

Audit logging must be enabled on the cluster(s) which you wish to integrate. This can be done via the AWS CLI using the following command:

aws eks --region <region> update-cluster-config --name <cluster_name> \
--logging '{"clusterLogging":[{"types":["audit"],"enabled":true}]}'

Resources created

• SNS topic
• Topic policy
• S3 bucket
• S3 bucket notification
• Firehose
• Firehose IAM role & policy
• Cross account IAM role & policy
• Cloudwatch IAM role & policy
• Cloudwatch subscription filter

Requirements

Name	Version
terraform	>= 0.15
aws	~> 4.0
lacework	~> 0.17
random	>= 2.1
time	~> 0.6

Providers

Name	Version
aws	~> 4.0
lacework	~> 0.17
random	>= 2.1
time	~> 0.6

Modules

Name	Source	Version
lacework_eks_audit_iam_role	lacework/iam-role/aws	~> 0.1

Resources

Name	Type
aws_cloudwatch_log_subscription_filter.lacework_eks_cw_subscription_filter	resource
aws_iam_policy.eks_cross_account_policy	resource
aws_iam_policy.eks_cw_iam_policy	resource
aws_iam_policy.firehose_iam_policy	resource
aws_iam_role.eks_cw_iam_role	resource
aws_iam_role.firehose_iam_role	resource
aws_iam_role_policy_attachment.eks_cross_account_role_policy	resource
aws_iam_role_policy_attachment.eks_cw_iam_role_policy	resource
aws_iam_role_policy_attachment.firehose_iam_role_policy	resource
aws_kinesis_firehose_delivery_stream.extended_s3_stream	resource
aws_s3_bucket.eks_audit_log_bucket	resource
aws_s3_bucket_lifecycle_configuration.eks_audit_log_bucket_lifecycle_config	resource
aws_s3_bucket_notification.bucket_notification	resource
aws_s3_bucket_versioning.export_versioning	resource
aws_sns_topic.eks_sns_topic	resource
aws_sns_topic_policy.eks_sns_topic_policy	resource
lacework_integration_aws_eks_audit_log.data_export	resource
random_id.uniq	resource
time_sleep.wait_time_cw	resource
aws_caller_identity.current	data source
aws_iam_policy_document.eks_cross_account_policy	data source
aws_iam_policy_document.eks_cw_assume_role_policy	data source
aws_iam_policy_document.eks_cw_iam_role_policy	data source
aws_iam_policy_document.eks_sns_topic_policy	data source
aws_iam_policy_document.firehose_iam_assume_role_policy	data source
aws_iam_policy_document.firehose_iam_role_policy	data source

Inputs

Name	Description	Type	Default	Required
bucket_enable_mfa_delete	Set this to true to require MFA for object deletion (Requires versioning)	bool	false	no
bucket_force_destroy	Force destroy bucket (Required when bucket not empty)	bool	false	no
bucket_lifecycle_expiration_days	The lifetime, in days, of the bucket objects. The value must be a non-zero positive integer.	number	180	no
bucket_versioning_enabled	Set this to true to enable access versioning on a created S3 bucket	bool	true	no
cloudwatch_regions	A set of regions, to allow Cloudwatch Logs to be streamed from	list(string)	n/a	yes
cluster_names	A set of cluster names, to integrate with. Defaults to [] if no_cw_subscription_filter is set to true	set(string)	[]	no
external_id_length	The length of the external ID to generate. Max length is 1224. Ignored when use_existing_iam_role is set to true	number	16	no
filter_pattern	The Cloudwatch Log Subscription Filter pattern	string	"{ $.stage = \"ResponseComplete\" && $.requestURI != \"/version\" && $.requestURI != \"/version?*\" && $.requestURI != \"/metrics\" && $.requestURI != \"/metrics?*\" && $.requestURI != \"/logs\" && $.requestURI != \"/logs?*\" && $.requestURI != \"/swagger*\" && $.requestURI != \"/livez*\" && $.requestURI != \"/readyz*\" && $.requestURI != \"/healthz*\" }"	no
integration_name	The name of the AWS EKS Audit Log integration in Lacework.	string	"TF AWS EKS Audit Log"	no
lacework_aws_account_id	The Lacework AWS account that the IAM role will grant access	string	"434813966438"	no
no_cw_subscription_filter	Set to true to create an integration with no Cloudwatch Subscription filter for your cluster(s)	bool	false	no
prefix	The prefix that will be use at the beginning of every generated resource	string	"lw-eks-al"	no
tags	A map/dictionary of Tags to be assigned to created resources	map(string)	{}	no
wait_time	Amount of time between setting up AWS resources, and creating the Lacework integration.	string	"10s"	no

Outputs

Name	Description
bucket_arn	Lacework AWS EKS Audit Log S3 Bucket ARN
bucket_name	Lacework AWS EKS Audit Log S3 Bucket name
cloudwatch_iam_role_arn	The Cloudwatch IAM Role ARN
cloudwatch_iam_role_name	The Cloudwatch IAM Role name
cross_account_iam_role_arn	The Cross Account IAM Role ARN
cross_account_iam_role_name	The Cross Account IAM Role name
external_id	The External ID configured into the IAM role
filter_pattern	The Cloudwatch Log Subscription Filter pattern
filter_prefix	The Cloudwatch Log Subscription filter prefix
firehose_arn	The Firehose IAM Role ARN
firehose_iam_role_name	The Firehose IAM Role name
sns_arn	SNS Topic ARN
sns_name	SNS Topic name