{"id":31955801,"url":"https://github.com/cisagov/bod-18-01-cloudwatch-users","last_synced_at":"2026-03-15T18:47:00.493Z","repository":{"id":42009298,"uuid":"180850195","full_name":"cisagov/bod-18-01-cloudwatch-users","owner":"cisagov","description":"Create AWS users that only have permission to view CloudWatch logs related to BOD 18-01 scanning","archived":false,"fork":false,"pushed_at":"2025-10-08T02:15:27.000Z","size":930,"stargazers_count":2,"open_issues_count":1,"forks_count":2,"subscribers_count":3,"default_branch":"develop","last_synced_at":"2025-10-08T04:13:04.702Z","etag":null,"topics":["aws","cloudwatch","iam","users"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cisagov.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-04-11T18:03:31.000Z","updated_at":"2025-09-02T16:29:13.000Z","dependencies_parsed_at":"2025-10-08T04:07:34.654Z","dependency_job_id":"ce360d20-2c15-4379-b75a-495731929d45","html_url":"https://github.com/cisagov/bod-18-01-cloudwatch-users","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/cisagov/bod-18-01-cloudwatch-users","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisagov%2Fbod-18-01-cloudwatch-users","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisagov%2Fbod-18-01-cloudwatch-users/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisagov%2Fbod-18-01-cloudwatch-users/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisagov%2Fbod-18-01-cloudwatch-users/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cisagov","download_url":"https://codeload.github.com/cisagov/bod-18-01-cloudwatch-users/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cisagov%2Fbod-18-01-cloudwatch-users/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279019119,"owners_count":26086680,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cloudwatch","iam","users"],"created_at":"2025-10-14T14:29:27.487Z","updated_at":"2026-03-15T18:47:00.485Z","avatar_url":"https://github.com/cisagov.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# bod-18-01-cloudwatch-users #\n\n[![GitHub Build Status](https://github.com/cisagov/bod-18-01-cloudwatch-users/workflows/build/badge.svg)](https://github.com/cisagov/bod-18-01-cloudwatch-users/actions)\n[![License](https://img.shields.io/github/license/cisagov/bod-18-01-cloudwatch-users)](https://spdx.org/licenses/)\n[![CodeQL](https://github.com/cisagov/bod-18-01-cloudwatch-users/workflows/CodeQL/badge.svg)](https://github.com/cisagov/bod-18-01-cloudwatch-users/actions/workflows/codeql-analysis.yml)\n\nThis is a Terraform project for creating AWS users that only have\npermission to view CloudWatch logs related to BOD 18-01 scanning.\n\n## Pre-requisites ##\n\n- [Terraform](https://www.terraform.io/) installed on your system.\n- AWS CLI access\n  [configured](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html)\n  for the appropriate account on your system.\n- An accessible AWS S3 bucket to store Terraform state\n  (specified in [`backend.tf`](backend.tf)).\n- An accessible AWS DynamoDB database to store the Terraform state lock\n  (specified in [`backend.tf`](backend.tf)).\n- User accounts for all users must have been created previously. We recommend\n  using the\n  [`cisagov/cyhy-users-non-admin`](https://github.com/cisagov/cyhy-users-non-admin)\n  repository to create users.\n\n## Customizing Your Environment ##\n\nCreate a terraform variables file to be used for your environment (e.g.\n  `production.tfvars`), based on the variables listed in [Inputs](#inputs)\n  below. Here is a sample of what that file might look like:\n\n```hcl\naws_region = \"us-east-2\"\n\nusernames = [\"firstname1.lastname1\", \"firstname2.lastname2\"]\n\nscan_types = [\"pshtt\", \"trustymail\"]\nlambda_function_names = {\n  \"pshtt\"      = \"task_pshtt\",\n  \"trustymail\" = \"task_trustymail\"\n}\n\ntags = {\n  Team        = \"CISA Development Team\"\n  Application = \"BOD 18-01 Scanning\"\n  Workspace   = \"production\"\n}\n```\n\n## Building the Terraform-based infrastructure ##\n\n1. Create a Terraform workspace (if you haven't already done so) by running:\n\n   ```console\n   terraform workspace new \u003cworkspace_name\u003e`\n   ```\n\n1. Create a `\u003cworkspace_name\u003e.tfvars` file with all of the required\n   variables and any optional variables desired (see [Inputs](#inputs) below\n   for details).\n1. Run the command `terraform init`.\n1. Create the Terraform infrastructure by running the command:\n\n   ```console\n   terraform apply -var-file=\u003cworkspace_name\u003e.tfvars\n   ```\n\n## Tearing down the Terraform-based infrastructure ##\n\n1. Select the appropriate Terraform workspace by running\n   `terraform workspace select \u003cworkspace_name\u003e`.\n1. Destroy the Terraform infrastructure in that workspace by running\n   `terraform destroy -var-file=\u003cworkspace_name\u003e.tfvars`.\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements ##\n\n| Name | Version |\n|------|---------|\n| terraform | ~\u003e 1.1 |\n| aws | ~\u003e 4.9 |\n\n## Providers ##\n\n| Name | Version |\n|------|---------|\n| aws | ~\u003e 4.9 |\n\n## Modules ##\n\nNo modules.\n\n## Resources ##\n\n| Name | Type |\n|------|------|\n| [aws_iam_group.bod_log_watchers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group) | resource |\n| [aws_iam_group_policy_attachment.bodlambdalogreadaccess_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group_policy_attachment) | resource |\n| [aws_iam_policy.bodlambdalogreadaccess_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_user_group_membership.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_cloudwatch_log_group.bod_lambda_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudwatch_log_group) | data source |\n| [aws_iam_policy_document.bodlambdalogreadaccess_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_user.users](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_user) | data source |\n\n## Inputs ##\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| aws\\_availability\\_zone | The AWS availability zone to deploy into (e.g. a, b, c, etc.). | `string` | `\"a\"` | no |\n| aws\\_region | The AWS region to deploy into (e.g. us-east-1). | `string` | `\"us-east-1\"` | no |\n| bod\\_lambdas | A map whose keys are the names of the BOD scan types and whose values are the names of the corresponding AWS Lambdas. Example: { \"pshtt\" = \"task\\_pshtt\" } | `map(string)` | n/a | yes |\n| bod\\_log\\_watchers\\_group\\_name | The base name of the group to be created for BOD 18-01 Lambda log access users. Note that in production workspaces, '-production' is automatically appended this group name.  In non-production workspaces, '-\u003cworkspace\\_name\u003e' is automatically appended to this group name. | `string` | `\"bod_log_watchers\"` | no |\n| bodlambdalogreadaccess\\_policy\\_description | The description to associate with the IAM policy that allows read access to the BOD 18-01 Lambda logs. | `string` | `\"Allows read access to the BOD 18-01 Lambda logs.\"` | no |\n| bodlambdalogreadaccess\\_policy\\_name | The base name to associate with the IAM policy that allows read access to the BOD 18-01 Lambda logs. Note that in production workspaces, '-production' is automatically appended this policy name.  In non-production workspaces, '-\u003cworkspace\\_name\u003e' is automatically appended to this policy name. | `string` | `\"BODLambdaLogReadAccess\"` | no |\n| tags | Tags to apply to all AWS resources created. | `map(string)` | `{}` | no |\n| users | A list of the usernames for the users that should be given access to the BOD 18-01 CloudWatch logs. Example: [\"firstname1.lastname1\", \"firstname2.lastname2\"] | `list(string)` | n/a | yes |\n\n## Outputs ##\n\nNo outputs.\n\u003c!-- END_TF_DOCS --\u003e\n\n## Notes ##\n\nRunning `pre-commit` requires running `terraform init` in every directory that\ncontains Terraform code. In this repository, this is only the main directory.\n\n## Contributing ##\n\nWe welcome contributions!  Please see [`CONTRIBUTING.md`](CONTRIBUTING.md) for\ndetails.\n\n## License ##\n\nThis project is in the worldwide [public domain](LICENSE).\n\nThis project is in the public domain within the United States, and\ncopyright and related rights in the work worldwide are waived through\nthe [CC0 1.0 Universal public domain\ndedication](https://creativecommons.org/publicdomain/zero/1.0/).\n\nAll contributions to this project will be released under the CC0\ndedication. By submitting a pull request, you are agreeing to comply\nwith this waiver of copyright interest.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcisagov%2Fbod-18-01-cloudwatch-users","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcisagov%2Fbod-18-01-cloudwatch-users","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcisagov%2Fbod-18-01-cloudwatch-users/lists"}