{"id":14957935,"url":"https://github.com/liatrio/aws-managed-services","last_synced_at":"2025-10-24T12:31:22.844Z","repository":{"id":174767798,"uuid":"651260727","full_name":"liatrio/aws-managed-services","owner":"liatrio","description":"Contains AWS managed services.","archived":true,"fork":false,"pushed_at":"2024-12-18T14:46:54.000Z","size":495,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-01-01T17:42:23.893Z","etag":null,"topics":["aws","terraform","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/liatrio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-08T21:33:39.000Z","updated_at":"2024-12-18T14:49:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"d29d7f60-ff25-42c6-9803-fdf43a394667","html_url":"https://github.com/liatrio/aws-managed-services","commit_stats":{"total_commits":82,"total_committers":12,"mean_commits":6.833333333333333,"dds":0.7317073170731707,"last_synced_commit":"34cdbe543c5d36a300e0955c4197b03bfc667c18"},"previous_names":["liatrio/aws-managed-services"],"tags_count":46,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/liatrio%2Faws-managed-services","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/liatrio%2Faws-managed-services/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/liatrio%2Faws-managed-services/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/liatrio%2Faws-managed-services/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/liatrio","download_url":"https://codeload.github.com/liatrio/aws-managed-services/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237964630,"owners_count":19394431,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","terraform","terraform-modules"],"created_at":"2024-09-24T13:15:51.164Z","updated_at":"2025-10-24T12:31:17.375Z","avatar_url":"https://github.com/liatrio.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-managed-services\nContains AWS managed services.\n\n## AMG Private VPC Connectivity\n\nTo set up AMG to work with a VPC you must provide the `vpc_private_subnets` and `vpc_security_group_ids` inputs. This will set up the outbound VPC connections.\n\nIf you want to restrict traffic to AMG we need to set up Network Access Controls. You **can** provide a prefix list via the `nac_prefix_list_ids` input and you **must** provide the vpc endpoint via the `vpc_endpoint_ids` input. \n\nIf you do not provide the nac_configuration then AMG will be open to the internet and can be publicly accessed through the URL generated by the workspace.\n\nWhen you set up NAC the VPC endpoint URL will not have a route to the public URL that the Grafana workspace provides, so you will need to establish that route yourself in some way. Below are some possible solutions you could implement: \n\n- Add the VPCE IP addresses and public url to your hosts file.\n\n    **Example**: \n    \n    \u003cip address\u003e \u003cworkspace-id\u003e.grafana-workspace.\u003cregion\u003e.amazonaws.com\n    ![](img/hosts_file.png)\n\n    The IP address is the subnet associated with the VPCE. You can find it by navigating to the VPC dashboard, selecting **Endpoints** and opening your VPC endpoint.\n    ![](img/vpc_subnet_ip.png)\n    The URL is the Public URL provided by the Grafana workspace when created. You can find it by navigating to Amazon Managed Grafana, clicking on workspace, and selecting your grafana workspace.\n    ![](img/grafana_public_url.png)\n\n- Implement a reverse proxy inside the VPC that will redirect to the public url.\n\n    **_NOTE:_** This is an assumption as we have not tested it.\n\n- Have DNS infrastructure resolve to the VPCE DNS instead of the public.\n[Route 53 Resolver endpoints and forwarding rule](https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html)\n\n    **_NOTE:_** This is an assumption as we have not tested it.\n\n## Terraform Documentation\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.1.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 5.7.0 |\n| \u003ca name=\"requirement_awscc\"\u003e\u003c/a\u003e [awscc](#requirement\\_awscc) | \u003e= 0.24.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 5.7.0 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_managed_grafana\"\u003e\u003c/a\u003e [managed\\_grafana](#module\\_managed\\_grafana) | github.com/liatrio/terraform-aws-managed-service-grafana.git | n/a |\n| \u003ca name=\"module_managed_prometheus\"\u003e\u003c/a\u003e [managed\\_prometheus](#module\\_managed\\_prometheus) | terraform-aws-modules/managed-service-prometheus/aws | n/a |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_cloudwatch_log_group.amp_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_iam_role.amp_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy.amp_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_iam_role_policy.grafana_xray_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_route53_record.s3_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |\n| [aws_route53_zone.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |\n| [aws_s3_bucket.amg_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |\n| [aws_s3_bucket_public_access_block.amg_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |\n| [aws_s3_bucket_website_configuration.amg_bucket_website](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_website_configuration) | resource |\n| [aws_grafana_workspace.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/grafana_workspace) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_account_access_type\"\u003e\u003c/a\u003e [account\\_access\\_type](#input\\_account\\_access\\_type) | The account access type. | `string` | `\"CURRENT_ACCOUNT\"` | no |\n| \u003ca name=\"input_alert_manager_config\"\u003e\u003c/a\u003e [alert\\_manager\\_config](#input\\_alert\\_manager\\_config) | The contents of the alarm rules file. | `string` | `\"  alertmanager_config: |\\n      route:\\n        receiver: 'default'\\n      receivers:\\n        - name: 'default'\\n\"` | no |\n| \u003ca name=\"input_amg_redirect_hostname\"\u003e\u003c/a\u003e [amg\\_redirect\\_hostname](#input\\_amg\\_redirect\\_hostname) | The hostname to which the S3 bucket will redirect requests | `string` | `\"\"` | no |\n| \u003ca name=\"input_amp_create_workspace\"\u003e\u003c/a\u003e [amp\\_create\\_workspace](#input\\_amp\\_create\\_workspace) | Specifies if the AMP workspace has to be created or not | `bool` | `true` | no |\n| \u003ca name=\"input_amp_workspace_id\"\u003e\u003c/a\u003e [amp\\_workspace\\_id](#input\\_amp\\_workspace\\_id) | If 'amp\\_create\\_workspace' is set to 'false' then a workspace has to be supplied. | `string` | `\"\"` | no |\n| \u003ca name=\"input_amp_ws_alias\"\u003e\u003c/a\u003e [amp\\_ws\\_alias](#input\\_amp\\_ws\\_alias) | The alias of the AMP workspace | `string` | `\"observability-amp-workspace\"` | no |\n| \u003ca name=\"input_authentication_providers\"\u003e\u003c/a\u003e [authentication\\_providers](#input\\_authentication\\_providers) | List containing the methods used to authenticate. | `list(any)` | n/a | yes |\n| \u003ca name=\"input_aws_cloudwatch_log_group_retention_in_days\"\u003e\u003c/a\u003e [aws\\_cloudwatch\\_log\\_group\\_retention\\_in\\_days](#input\\_aws\\_cloudwatch\\_log\\_group\\_retention\\_in\\_days) | The retention period of the CloudWatch log group in days | `number` | `60` | no |\n| \u003ca name=\"input_aws_region\"\u003e\u003c/a\u003e [aws\\_region](#input\\_aws\\_region) | AWS Region | `string` | `\"us-east-1\"` | no |\n| \u003ca name=\"input_aws_route53_zone_tags\"\u003e\u003c/a\u003e [aws\\_route53\\_zone\\_tags](#input\\_aws\\_route53\\_zone\\_tags) | value of the private hosted zone tags | `map(string)` | `{}` | no |\n| \u003ca name=\"input_create\"\u003e\u003c/a\u003e [create](#input\\_create) | Determines whether a resources will be created | `bool` | `true` | no |\n| \u003ca name=\"input_create_amp_iam_role\"\u003e\u003c/a\u003e [create\\_amp\\_iam\\_role](#input\\_create\\_amp\\_iam\\_role) | Whether to create the AMP IAM role or not. 1 per account is needed. | `bool` | `true` | no |\n| \u003ca name=\"input_create_dashboard_folder\"\u003e\u003c/a\u003e [create\\_dashboard\\_folder](#input\\_create\\_dashboard\\_folder) | Boolean flag to enable Amazon Managed Grafana folder and dashboards | `bool` | `true` | no |\n| \u003ca name=\"input_create_iam_role\"\u003e\u003c/a\u003e [create\\_iam\\_role](#input\\_create\\_iam\\_role) | Determines whether a an IAM role is created or to use an existing IAM role | `bool` | `true` | no |\n| \u003ca name=\"input_create_prometheus_data_source\"\u003e\u003c/a\u003e [create\\_prometheus\\_data\\_source](#input\\_create\\_prometheus\\_data\\_source) | Boolean flag to enable Amazon Managed Grafana datasource | `bool` | `true` | no |\n| \u003ca name=\"input_create_redirect\"\u003e\u003c/a\u003e [create\\_redirect](#input\\_create\\_redirect) | Whether to create a redirect from the S3 bucket to the workspace or not | `bool` | `false` | no |\n| \u003ca name=\"input_create_saml_configuration\"\u003e\u003c/a\u003e [create\\_saml\\_configuration](#input\\_create\\_saml\\_configuration) | Flag to indicate whether or not to create a SAML configuratino in Grafana Workspace. | `string` | `false` | no |\n| \u003ca name=\"input_create_workspace\"\u003e\u003c/a\u003e [create\\_workspace](#input\\_create\\_workspace) | Determines whether a workspace will be created or to use an existing workspace | `bool` | `true` | no |\n| \u003ca name=\"input_data_sources\"\u003e\u003c/a\u003e [data\\_sources](#input\\_data\\_sources) | List of data sources to create in the workspace | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"CLOUDWATCH\",\u003cbr/\u003e  \"PROMETHEUS\",\u003cbr/\u003e  \"XRAY\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_enable_alertmanager\"\u003e\u003c/a\u003e [enable\\_alertmanager](#input\\_enable\\_alertmanager) | Creates Amazon Managed Service for Prometheus AlertManager for all workloads | `bool` | `false` | no |\n| \u003ca name=\"input_enable_managed_prometheus\"\u003e\u003c/a\u003e [enable\\_managed\\_prometheus](#input\\_enable\\_managed\\_prometheus) | Creates a new Amazon Managed Service for Prometheus Workspace | `bool` | `true` | no |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Environment name | `string` | n/a | yes |\n| \u003ca name=\"input_generate_metadata_url\"\u003e\u003c/a\u003e [generate\\_metadata\\_url](#input\\_generate\\_metadata\\_url) | Boolean on whether or not to generate the metadata url | `bool` | `false` | no |\n| \u003ca name=\"input_iam_role_arn\"\u003e\u003c/a\u003e [iam\\_role\\_arn](#input\\_iam\\_role\\_arn) | Existing IAM role ARN for the workspace. Required if `create_iam_role` is set to `false` | `string` | `null` | no |\n| \u003ca name=\"input_iam_role_name\"\u003e\u003c/a\u003e [iam\\_role\\_name](#input\\_iam\\_role\\_name) | The name of the IAM Role to create or associate with | `string` | `\"aws-observability-workspace-iam-role\"` | no |\n| \u003ca name=\"input_idp_url_with_postfix\"\u003e\u003c/a\u003e [idp\\_url\\_with\\_postfix](#input\\_idp\\_url\\_with\\_postfix) | The FQDN of the IDP metadata URL with a postfix as needed to generate the metadata IDP url. Works for Ping | `string` | `\"\"` | no |\n| \u003ca name=\"input_logging_configuration\"\u003e\u003c/a\u003e [logging\\_configuration](#input\\_logging\\_configuration) | Map that contains the logging configuration for prometheus. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_managed_grafana_workspace_id\"\u003e\u003c/a\u003e [managed\\_grafana\\_workspace\\_id](#input\\_managed\\_grafana\\_workspace\\_id) | Amazon Managed Grafana Workspace ID | `string` | `\"\"` | no |\n| \u003ca name=\"input_managed_prometheus_workspace_id\"\u003e\u003c/a\u003e [managed\\_prometheus\\_workspace\\_id](#input\\_managed\\_prometheus\\_workspace\\_id) | Amazon Managed Service for Prometheus Workspace ID | `string` | `\"\"` | no |\n| \u003ca name=\"input_managed_prometheus_workspace_region\"\u003e\u003c/a\u003e [managed\\_prometheus\\_workspace\\_region](#input\\_managed\\_prometheus\\_workspace\\_region) | Region where Amazon Managed Service for Prometheus is deployed | `string` | `null` | no |\n| \u003ca name=\"input_nac_configuration\"\u003e\u003c/a\u003e [nac\\_configuration](#input\\_nac\\_configuration) | The configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to | `any` | `{}` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | The name of the deployment | `string` | `\"aws-o11y-managed-services\"` | no |\n| \u003ca name=\"input_route53_hosted_zone_name\"\u003e\u003c/a\u003e [route53\\_hosted\\_zone\\_name](#input\\_route53\\_hosted\\_zone\\_name) | value of the private hosted zone name | `string` | `\"\"` | no |\n| \u003ca name=\"input_s3_website_endpoint_zone_ids\"\u003e\u003c/a\u003e [s3\\_website\\_endpoint\\_zone\\_ids](#input\\_s3\\_website\\_endpoint\\_zone\\_ids) | S3 website endpoint zone IDs by region | `map(string)` | \u003cpre\u003e{\u003cbr/\u003e  \"us-east-1\": \"Z3AQBSTGFYJSTF\",\u003cbr/\u003e  \"us-west-1\": \"Z2F56UZL2M1ACD\",\u003cbr/\u003e  \"us-west-2\": \"Z3BJ6K6RIION7M\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_saml_admin_role_values\"\u003e\u003c/a\u003e [saml\\_admin\\_role\\_values](#input\\_saml\\_admin\\_role\\_values) | Name of the admin role value. | `list(any)` | `[]` | no |\n| \u003ca name=\"input_saml_editor_role_values\"\u003e\u003c/a\u003e [saml\\_editor\\_role\\_values](#input\\_saml\\_editor\\_role\\_values) | Name of the editor role value. | `list(any)` | `[]` | no |\n| \u003ca name=\"input_saml_email_assertion\"\u003e\u003c/a\u003e [saml\\_email\\_assertion](#input\\_saml\\_email\\_assertion) | Name of the saml email used for assertion. | `string` | `\"\"` | no |\n| \u003ca name=\"input_saml_groups_assertion\"\u003e\u003c/a\u003e [saml\\_groups\\_assertion](#input\\_saml\\_groups\\_assertion) | Name of the saml groups used for assertion. | `string` | `\"\"` | no |\n| \u003ca name=\"input_saml_idp_metadata_url\"\u003e\u003c/a\u003e [saml\\_idp\\_metadata\\_url](#input\\_saml\\_idp\\_metadata\\_url) | IDP Meta data url. | `string` | `\"\"` | no |\n| \u003ca name=\"input_saml_login_assertion\"\u003e\u003c/a\u003e [saml\\_login\\_assertion](#input\\_saml\\_login\\_assertion) | Method of login used for assertion. | `string` | `\"\"` | no |\n| \u003ca name=\"input_saml_name_assertion\"\u003e\u003c/a\u003e [saml\\_name\\_assertion](#input\\_saml\\_name\\_assertion) | Display name for SAML. | `string` | `\"\"` | no |\n| \u003ca name=\"input_saml_org_assertion\"\u003e\u003c/a\u003e [saml\\_org\\_assertion](#input\\_saml\\_org\\_assertion) | Name of the org used for assertion. | `string` | `\"\"` | no |\n| \u003ca name=\"input_saml_role_assertion\"\u003e\u003c/a\u003e [saml\\_role\\_assertion](#input\\_saml\\_role\\_assertion) | Name of the role used for assertion. | `string` | `\"\"` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Additional tags (e.g. `map('BusinessUnit`,`XYZ`) | `map(string)` | \u003cpre\u003e{\u003cbr/\u003e  \"GithubOrg\": \"aws-observability\",\u003cbr/\u003e  \"GithubRepo\": \"terraform-aws-observability-accelerator\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_use_iam_role_name_prefix\"\u003e\u003c/a\u003e [use\\_iam\\_role\\_name\\_prefix](#input\\_use\\_iam\\_role\\_name\\_prefix) | Whether or not to use a prefix on the IAM Role name | `bool` | `true` | no |\n| \u003ca name=\"input_vpc_configuration\"\u003e\u003c/a\u003e [vpc\\_configuration](#input\\_vpc\\_configuration) | The configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to | `any` | `{}` | no |\n| \u003ca name=\"input_vpc_ids\"\u003e\u003c/a\u003e [vpc\\_ids](#input\\_vpc\\_ids) | List of VPC IDs | `list(string)` | `[]` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_amg_route53_alias\"\u003e\u003c/a\u003e [amg\\_route53\\_alias](#output\\_amg\\_route53\\_alias) | value for the route53 alias, which contains the bucket name, hosted zone id and amg fqdn |\n| \u003ca name=\"output_aws_region\"\u003e\u003c/a\u003e [aws\\_region](#output\\_aws\\_region) | AWS Region |\n| \u003ca name=\"output_create\"\u003e\u003c/a\u003e [create](#output\\_create) | The creatae flag that gets passed to the module. |\n| \u003ca name=\"output_create_workspace\"\u003e\u003c/a\u003e [create\\_workspace](#output\\_create\\_workspace) | The create\\_workspace flag that gets passed to the module. |\n| \u003ca name=\"output_managed_grafana_workspace_endpoint\"\u003e\u003c/a\u003e [managed\\_grafana\\_workspace\\_endpoint](#output\\_managed\\_grafana\\_workspace\\_endpoint) | Amazon Managed Grafana workspace endpoint |\n| \u003ca name=\"output_managed_grafana_workspace_id\"\u003e\u003c/a\u003e [managed\\_grafana\\_workspace\\_id](#output\\_managed\\_grafana\\_workspace\\_id) | Amazon Managed Grafana workspace ID |\n| \u003ca name=\"output_managed_prometheus_workspace_endpoint\"\u003e\u003c/a\u003e [managed\\_prometheus\\_workspace\\_endpoint](#output\\_managed\\_prometheus\\_workspace\\_endpoint) | Amazon Managed Prometheus workspace endpoint |\n| \u003ca name=\"output_managed_prometheus_workspace_id\"\u003e\u003c/a\u003e [managed\\_prometheus\\_workspace\\_id](#output\\_managed\\_prometheus\\_workspace\\_id) | Amazon Managed Prometheus workspace ID |\n\u003c!-- END_TF_DOCS --\u003e\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fliatrio%2Faws-managed-services","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fliatrio%2Faws-managed-services","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fliatrio%2Faws-managed-services/lists"}