Skip to content

Latest commit

 

History

History
122 lines (102 loc) · 11.3 KB

README.md

File metadata and controls

122 lines (102 loc) · 11.3 KB

terraform-aws-eks-audit-log

GitHub release Codefresh build status

A Terraform Module to integrate Amazon Elastic Kubernetes Service (EKS) with Lacework.

Pre-requisite

Audit logging must be enabled on the cluster(s) which you wish to integrate. This can be done via the AWS CLI using the following command:

aws eks --region <region> update-cluster-config --name <cluster_name> \
--logging '{"clusterLogging":[{"types":["audit"],"enabled":true}]}'

Resources created

  • SNS topic
  • Topic policy
  • S3 bucket
  • S3 bucket notification
  • Firehose
  • Firehose IAM role & policy
  • Cross account IAM role & policy
  • Cloudwatch IAM role & policy
  • Cloudwatch subscription filter

Requirements

Name Version
terraform >= 0.15
aws ~> 4.0
lacework ~> 0.17
random >= 2.1
time ~> 0.6

Providers

Name Version
aws ~> 4.0
lacework ~> 0.17
random >= 2.1
time ~> 0.6

Modules

Name Source Version
lacework_eks_audit_iam_role lacework/iam-role/aws ~> 0.1

Resources

Name Type
aws_cloudwatch_log_subscription_filter.lacework_eks_cw_subscription_filter resource
aws_iam_policy.eks_cross_account_policy resource
aws_iam_policy.eks_cw_iam_policy resource
aws_iam_policy.firehose_iam_policy resource
aws_iam_role.eks_cw_iam_role resource
aws_iam_role.firehose_iam_role resource
aws_iam_role_policy_attachment.eks_cross_account_role_policy resource
aws_iam_role_policy_attachment.eks_cw_iam_role_policy resource
aws_iam_role_policy_attachment.firehose_iam_role_policy resource
aws_kinesis_firehose_delivery_stream.extended_s3_stream resource
aws_s3_bucket.eks_audit_log_bucket resource
aws_s3_bucket_lifecycle_configuration.eks_audit_log_bucket_lifecycle_config resource
aws_s3_bucket_notification.bucket_notification resource
aws_s3_bucket_versioning.export_versioning resource
aws_sns_topic.eks_sns_topic resource
aws_sns_topic_policy.eks_sns_topic_policy resource
lacework_integration_aws_eks_audit_log.data_export resource
random_id.uniq resource
time_sleep.wait_time_cw resource
aws_caller_identity.current data source
aws_iam_policy_document.eks_cross_account_policy data source
aws_iam_policy_document.eks_cw_assume_role_policy data source
aws_iam_policy_document.eks_cw_iam_role_policy data source
aws_iam_policy_document.eks_sns_topic_policy data source
aws_iam_policy_document.firehose_iam_assume_role_policy data source
aws_iam_policy_document.firehose_iam_role_policy data source

Inputs

Name Description Type Default Required
bucket_enable_mfa_delete Set this to true to require MFA for object deletion (Requires versioning) bool false no
bucket_force_destroy Force destroy bucket (Required when bucket not empty) bool false no
bucket_lifecycle_expiration_days The lifetime, in days, of the bucket objects. The value must be a non-zero positive integer. number 180 no
bucket_versioning_enabled Set this to true to enable access versioning on a created S3 bucket bool true no
cloudwatch_regions A set of regions, to allow Cloudwatch Logs to be streamed from list(string) n/a yes
cluster_names A set of cluster names, to integrate with. Defaults to [] if no_cw_subscription_filter is set to true set(string) [] no
external_id_length The length of the external ID to generate. Max length is 1224. Ignored when use_existing_iam_role is set to true number 16 no
filter_pattern The Cloudwatch Log Subscription Filter pattern string "{ $.stage = \"ResponseComplete\" && $.requestURI != \"/version\" && $.requestURI != \"/version?*\" && $.requestURI != \"/metrics\" && $.requestURI != \"/metrics?*\" && $.requestURI != \"/logs\" && $.requestURI != \"/logs?*\" && $.requestURI != \"/swagger*\" && $.requestURI != \"/livez*\" && $.requestURI != \"/readyz*\" && $.requestURI != \"/healthz*\" }" no
integration_name The name of the AWS EKS Audit Log integration in Lacework. string "TF AWS EKS Audit Log" no
lacework_aws_account_id The Lacework AWS account that the IAM role will grant access string "434813966438" no
no_cw_subscription_filter Set to true to create an integration with no Cloudwatch Subscription filter for your cluster(s) bool false no
prefix The prefix that will be use at the beginning of every generated resource string "lw-eks-al" no
tags A map/dictionary of Tags to be assigned to created resources map(string) {} no
wait_time Amount of time between setting up AWS resources, and creating the Lacework integration. string "10s" no

Outputs

Name Description
bucket_arn Lacework AWS EKS Audit Log S3 Bucket ARN
bucket_name Lacework AWS EKS Audit Log S3 Bucket name
cloudwatch_iam_role_arn The Cloudwatch IAM Role ARN
cloudwatch_iam_role_name The Cloudwatch IAM Role name
cross_account_iam_role_arn The Cross Account IAM Role ARN
cross_account_iam_role_name The Cross Account IAM Role name
external_id The External ID configured into the IAM role
filter_pattern The Cloudwatch Log Subscription Filter pattern
filter_prefix The Cloudwatch Log Subscription filter prefix
firehose_arn The Firehose IAM Role ARN
firehose_iam_role_name The Firehose IAM Role name
sns_arn SNS Topic ARN
sns_name SNS Topic name