{"id":13505679,"url":"https://github.com/nozaq/terraform-aws-secure-baseline","last_synced_at":"2025-04-11T11:48:36.952Z","repository":{"id":29287892,"uuid":"121206877","full_name":"nozaq/terraform-aws-secure-baseline","owner":"nozaq","description":"Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.","archived":false,"fork":false,"pushed_at":"2024-07-09T12:20:18.000Z","size":722,"stargazers_count":1163,"open_issues_count":31,"forks_count":374,"subscribers_count":34,"default_branch":"main","last_synced_at":"2025-04-03T15:07:20.106Z","etag":null,"topics":["aws","aws-auditing","cis-benchmark","devops","hardening","security","security-hardening","security-tools","terraform","terraform-module","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nozaq.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"securityhub_baselines.tf","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-12T06:03:00.000Z","updated_at":"2025-03-20T18:22:33.000Z","dependencies_parsed_at":"2024-06-19T03:03:15.298Z","dependency_job_id":"ce7009f8-aafc-424f-993a-0f883de87bb8","html_url":"https://github.com/nozaq/terraform-aws-secure-baseline","commit_stats":{"total_commits":276,"total_committers":39,"mean_commits":7.076923076923077,"dds":0.5652173913043479,"last_synced_commit":"6b2d679cf480093ec279450d7d0a90affe3ddc43"},"previous_names":[],"tags_count":102,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nozaq%2Fterraform-aws-secure-baseline","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nozaq%2Fterraform-aws-secure-baseline/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nozaq%2Fterraform-aws-secure-baseline/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nozaq%2Fterraform-aws-secure-baseline/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nozaq","download_url":"https://codeload.github.com/nozaq/terraform-aws-secure-baseline/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248388757,"owners_count":21095453,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-auditing","cis-benchmark","devops","hardening","security","security-hardening","security-tools","terraform","terraform-module","terraform-modules"],"created_at":"2024-08-01T00:01:11.507Z","updated_at":"2025-04-11T11:48:36.899Z","avatar_url":"https://github.com/nozaq.png","language":"HCL","funding_links":[],"categories":["\u003ca id=\"7e840ca27f1ff222fd25bc61a79b07ba\"\u003e\u003c/a\u003e特定目标","Community Modules","HCL","Automation","\u003ca id=\"c71ad1932bbf9c908af83917fe1fd5da\"\u003e\u003c/a\u003eAWS","Compliance-Ready Modules"],"sub_categories":["\u003ca id=\"c71ad1932bbf9c908af83917fe1fd5da\"\u003e\u003c/a\u003eAWS","Miscellaneous","Controllers","\u003ca id=\"0476f6b97e87176da0a0d7328f8747e7\"\u003e\u003c/a\u003eblog","AWS"],"readme":"# terraform-aws-secure-baseline\n\n[![Github Actions](https://github.com/nozaq/terraform-aws-secure-baseline/actions/workflows/main.yml/badge.svg)](https://github.com/nozaq/terraform-aws-secure-baseline/actions/workflows/main.yml)\n[![Releases](https://img.shields.io/github/v/release/nozaq/terraform-aws-secure-baseline)](https://github.com/nozaq/terraform-aws-secure-baseline/releases/latest)\n\n[Terraform Module Registry](https://registry.terraform.io/modules/nozaq/secure-baseline/aws)\n\nA terraform module to set up your AWS account with the reasonably secure configuration baseline.\nMost configurations are based on [CIS Amazon Web Services Foundations v1.4.0] and [AWS Foundational Security Best Practices v1.0.0].\n\nSee [Benchmark Compliance](./compliance.md) to check which items in various benchmarks are covered.\n\n## Features\n\n### Identity and Access Management\n\n- Set up IAM Password Policy.\n- Create an IAM role for contacting AWS support for incident handling.\n- Enable AWS Config rules to audit root account status.\n- Enable IAM Access Analyzer in each region.\n- Enable S3 account-level Public Access Block configuration.\n\n### Logging \u0026 Monitoring\n\n- Enable CloudTrail in all regions and deliver events to CloudWatch Logs.\n- Object-level logging for all S3 buckets is enabled by default.\n- CloudTrail Insights event logging is enabled by default.\n- CloudTrail logs are encrypted using AWS Key Management Service.\n- All logs are stored in the S3 bucket with access logging enabled.\n- Logs are automatically archived into Amazon Glacier after the given period(defaults to 90 days).\n- Set up CloudWatch alarms to notify you when critical changes happen in your AWS account.\n- Enable AWS Config in each regions to automatically take configuration snapshots.\n- Enable SecurityHub and subscribe available standards.\n- Enable GuardDuty in each regions.\n\n### Networking \u0026 Computing\n\n- Remove all rules associated with default route tables, default network ACLs and default security groups in the default VPC in all regions.\n- Disable automatic public IP assignments in default subnets.\n- Enable AWS Config rules to audit unrestricted common ports in Security Group rules.\n- Enable VPC Flow Logs with the default VPC in all regions.\n- Enable default EBS encryption for newly created volumes.\n\n## Usage\n\n```hcl\ndata \"aws_caller_identity\" \"current\" {}\ndata \"aws_region\" \"current\" {}\n\nmodule \"secure_baseline\" {\n  source = \"nozaq/secure-baseline/aws\"\n\n  audit_log_bucket_name           = \"YOUR_BUCKET_NAME\"\n  aws_account_id                  = data.aws_caller_identity.current.account_id\n  region                          = data.aws_region.current.name\n  support_iam_role_principal_arns = [\"YOUR_IAM_USER\"]\n\n  providers = {\n    aws                = aws\n    aws.ap-northeast-1 = aws.ap-northeast-1\n    aws.ap-northeast-2 = aws.ap-northeast-2\n    aws.ap-northeast-3 = aws.ap-northeast-3\n    aws.ap-south-1     = aws.ap-south-1\n    aws.ap-southeast-1 = aws.ap-southeast-1\n    aws.ap-southeast-2 = aws.ap-southeast-2\n    aws.ca-central-1   = aws.ca-central-1\n    aws.eu-central-1   = aws.eu-central-1\n    aws.eu-north-1     = aws.eu-north-1\n    aws.eu-west-1      = aws.eu-west-1\n    aws.eu-west-2      = aws.eu-west-2\n    aws.eu-west-3      = aws.eu-west-3\n    aws.sa-east-1      = aws.sa-east-1\n    aws.us-east-1      = aws.us-east-1\n    aws.us-east-2      = aws.us-east-2\n    aws.us-west-1      = aws.us-west-1\n    aws.us-west-2      = aws.us-west-2\n  }\n}\n```\n\nCheck [the example](./examples/simple/regions.tf) to understand how these providers are defined.\nNote that you need to define a provider for each AWS region and pass them to the module. Currently this is the recommended way to handle multiple regions in one module.\nDetailed information can be found at [Providers within Modules - Terraform Docs].\n\nA new S3 bucket to store audit logs is automatically created by default, while the external S3 bucket can be specified. It is useful when you already have a centralized S3 bucket to store all logs. Please see [external-bucket](./examples/external-bucket) example for more detail.\n\n### Managing multiple accounts in AWS Organization\n\nWhen you have multiple AWS accounts in your AWS Organization, `secure-baseline` module configures the separated environment for each AWS account. You can change this behavior to centrally manage security information and audit logs from all accounts in one master account.\nCheck [organization](./examples/organization) example for more detail.\n\n## Submodules\n\nThis module is composed of several submodules and each of which can be used independently.\n[Modules in Package Sub-directories - Terraform] describes how to source a submodule.\n\n- [alarm-baseline](./modules/alarm-baseline)\n- [analyzer-baseline](./modules/analyzer-baseline)\n- [cloudtrail-baseline](./modules/cloudtrail-baseline)\n- [config-baseline](./modules/config-baseline)\n- [ebs-baseline](./modules/ebs-baseline)\n- [guardduty-baseline](./modules/guardduty-baseline)\n- [iam-baseline](./modules/iam-baseline)\n- [s3-baseline](./modules/s3-baseline)\n- [secure-bucket](./modules/secure-bucket)\n- [securityhub-baseline](./modules/securityhub-baseline)\n- [vpc-baseline](./modules/vpc-baseline)\n\n## Compatibility\n\n- Starting from v1.0, this module requires [Terraform Provider for AWS](https://github.com/terraform-providers/terraform-provider-aws) v4.0 or later. [Version 1.0 Upgrade Guide](./docs/upgrade-1.0.md) described the recommended procedure after the upgrade.\n- Starting from v0.20, this module requires [Terraform Provider for AWS](https://github.com/terraform-providers/terraform-provider-aws) v3.0 or later. Please use v0.19 if you need to use v2.x or earlier.\n- Starting from v0.10, this module requires Terraform v0.12 or later. Please use v0.9 if you need to use Terraform v0.11 or ealier.\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.1.4 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 4.3 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 4.3 |\n\n## Inputs\n\n| Name | Description | Type | Required |\n|------|-------------|------|:--------:|\n| \u003ca name=\"input_audit_log_bucket_name\"\u003e\u003c/a\u003e [audit\\_log\\_bucket\\_name](#input\\_audit\\_log\\_bucket\\_name) | The name of the S3 bucket to store various audit logs. | `string` | yes |\n| \u003ca name=\"input_aws_account_id\"\u003e\u003c/a\u003e [aws\\_account\\_id](#input\\_aws\\_account\\_id) | The AWS Account ID number of the account. | `string` | yes |\n| \u003ca name=\"input_region\"\u003e\u003c/a\u003e [region](#input\\_region) | The AWS region in which global resources are set up. | `string` | yes |\n| \u003ca name=\"input_support_iam_role_principal_arns\"\u003e\u003c/a\u003e [support\\_iam\\_role\\_principal\\_arns](#input\\_support\\_iam\\_role\\_principal\\_arns) | List of ARNs of the IAM principal elements by which the support role could be assumed. | `list(string)` | yes |\n| \u003ca name=\"input_account_type\"\u003e\u003c/a\u003e [account\\_type](#input\\_account\\_type) | The type of the AWS account. The possible values are `individual`, `master` and `member` . Specify `master` and `member` to set up centalized logging for multiple accounts in AWS Organization. Use individual` otherwise.` | `string` | no |\n| \u003ca name=\"input_alarm_baseline_enabled\"\u003e\u003c/a\u003e [alarm\\_baseline\\_enabled](#input\\_alarm\\_baseline\\_enabled) | Boolean whether alarm-baseline is enabled. | `bool` | no |\n| \u003ca name=\"input_alarm_namespace\"\u003e\u003c/a\u003e [alarm\\_namespace](#input\\_alarm\\_namespace) | The namespace in which all alarms are set up. | `string` | no |\n| \u003ca name=\"input_alarm_sns_topic_kms_master_key_id\"\u003e\u003c/a\u003e [alarm\\_sns\\_topic\\_kms\\_master\\_key\\_id](#input\\_alarm\\_sns\\_topic\\_kms\\_master\\_key\\_id) | To enable SNS Topic encryption enter value with the ID of a custom master KMS key that is used for encryption | `string` | no |\n| \u003ca name=\"input_alarm_sns_topic_name\"\u003e\u003c/a\u003e [alarm\\_sns\\_topic\\_name](#input\\_alarm\\_sns\\_topic\\_name) | The name of the SNS Topic which will be notified when any alarm is performed. | `string` | no |\n| \u003ca name=\"input_allow_users_to_change_password\"\u003e\u003c/a\u003e [allow\\_users\\_to\\_change\\_password](#input\\_allow\\_users\\_to\\_change\\_password) | Whether to allow users to change their own password. | `bool` | no |\n| \u003ca name=\"input_analyzer_baseline_enabled\"\u003e\u003c/a\u003e [analyzer\\_baseline\\_enabled](#input\\_analyzer\\_baseline\\_enabled) | Boolean whether analyzer-baseline is enabled. | `bool` | no |\n| \u003ca name=\"input_analyzer_name\"\u003e\u003c/a\u003e [analyzer\\_name](#input\\_analyzer\\_name) | The name for the IAM Access Analyzer resource to be created. | `string` | no |\n| \u003ca name=\"input_audit_log_bucket_access_logs_name\"\u003e\u003c/a\u003e [audit\\_log\\_bucket\\_access\\_logs\\_name](#input\\_audit\\_log\\_bucket\\_access\\_logs\\_name) | The name of the S3 bucket to store various audit logs. | `string` | no |\n| \u003ca name=\"input_audit_log_bucket_custom_policy_json\"\u003e\u003c/a\u003e [audit\\_log\\_bucket\\_custom\\_policy\\_json](#input\\_audit\\_log\\_bucket\\_custom\\_policy\\_json) | Override policy for the audit log bucket. Allows addition of extra policies. | `string` | no |\n| \u003ca name=\"input_audit_log_bucket_force_destroy\"\u003e\u003c/a\u003e [audit\\_log\\_bucket\\_force\\_destroy](#input\\_audit\\_log\\_bucket\\_force\\_destroy) | A boolean that indicates all objects should be deleted from the audit log bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | no |\n| \u003ca name=\"input_audit_log_bucket_key_enabled\"\u003e\u003c/a\u003e [audit\\_log\\_bucket\\_key\\_enabled](#input\\_audit\\_log\\_bucket\\_key\\_enabled) | Whether or not to use Amazon S3 Bucket Keys for encrypting the audit log bucket. | `bool` | no |\n| \u003ca name=\"input_audit_log_lifecycle_glacier_transition_days\"\u003e\u003c/a\u003e [audit\\_log\\_lifecycle\\_glacier\\_transition\\_days](#input\\_audit\\_log\\_lifecycle\\_glacier\\_transition\\_days) | The number of days after log creation when the log file is archived into Glacier. Setting to zero disables the transition. | `number` | no |\n| \u003ca name=\"input_aws_config_changes_enabled\"\u003e\u003c/a\u003e [aws\\_config\\_changes\\_enabled](#input\\_aws\\_config\\_changes\\_enabled) | The boolean flag whether the aws\\_config\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_cloudtrail_baseline_enabled\"\u003e\u003c/a\u003e [cloudtrail\\_baseline\\_enabled](#input\\_cloudtrail\\_baseline\\_enabled) | Boolean whether cloudtrail-baseline is enabled. | `bool` | no |\n| \u003ca name=\"input_cloudtrail_cfg_changes_enabled\"\u003e\u003c/a\u003e [cloudtrail\\_cfg\\_changes\\_enabled](#input\\_cloudtrail\\_cfg\\_changes\\_enabled) | The boolean flag whether the cloudtrail\\_cfg\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_cloudtrail_cloudwatch_logs_enabled\"\u003e\u003c/a\u003e [cloudtrail\\_cloudwatch\\_logs\\_enabled](#input\\_cloudtrail\\_cloudwatch\\_logs\\_enabled) | Specifies whether the trail is delivered to CloudWatch Logs. | `bool` | no |\n| \u003ca name=\"input_cloudtrail_cloudwatch_logs_group_name\"\u003e\u003c/a\u003e [cloudtrail\\_cloudwatch\\_logs\\_group\\_name](#input\\_cloudtrail\\_cloudwatch\\_logs\\_group\\_name) | The name of CloudWatch Logs group to which CloudTrail events are delivered. | `string` | no |\n| \u003ca name=\"input_cloudtrail_dynamodb_event_logging_tables\"\u003e\u003c/a\u003e [cloudtrail\\_dynamodb\\_event\\_logging\\_tables](#input\\_cloudtrail\\_dynamodb\\_event\\_logging\\_tables) | The list of DynamoDB table ARNs on which to enable event logging. | `list(string)` | no |\n| \u003ca name=\"input_cloudtrail_iam_role_name\"\u003e\u003c/a\u003e [cloudtrail\\_iam\\_role\\_name](#input\\_cloudtrail\\_iam\\_role\\_name) | The name of the IAM Role to be used by CloudTrail to delivery logs to CloudWatch Logs group. | `string` | no |\n| \u003ca name=\"input_cloudtrail_iam_role_policy_name\"\u003e\u003c/a\u003e [cloudtrail\\_iam\\_role\\_policy\\_name](#input\\_cloudtrail\\_iam\\_role\\_policy\\_name) | The name of the IAM Role Policy to be used by CloudTrail to delivery logs to CloudWatch Logs group. | `string` | no |\n| \u003ca name=\"input_cloudtrail_key_deletion_window_in_days\"\u003e\u003c/a\u003e [cloudtrail\\_key\\_deletion\\_window\\_in\\_days](#input\\_cloudtrail\\_key\\_deletion\\_window\\_in\\_days) | Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 30 days. | `number` | no |\n| \u003ca name=\"input_cloudtrail_lambda_invocation_logging_lambdas\"\u003e\u003c/a\u003e [cloudtrail\\_lambda\\_invocation\\_logging\\_lambdas](#input\\_cloudtrail\\_lambda\\_invocation\\_logging\\_lambdas) | The list of lambda ARNs on which to enable invocation logging. | `list(string)` | no |\n| \u003ca name=\"input_cloudtrail_name\"\u003e\u003c/a\u003e [cloudtrail\\_name](#input\\_cloudtrail\\_name) | The name of the trail. | `string` | no |\n| \u003ca name=\"input_cloudtrail_s3_key_prefix\"\u003e\u003c/a\u003e [cloudtrail\\_s3\\_key\\_prefix](#input\\_cloudtrail\\_s3\\_key\\_prefix) | The prefix used when CloudTrail delivers events to the S3 bucket. | `string` | no |\n| \u003ca name=\"input_cloudtrail_s3_object_level_logging_buckets\"\u003e\u003c/a\u003e [cloudtrail\\_s3\\_object\\_level\\_logging\\_buckets](#input\\_cloudtrail\\_s3\\_object\\_level\\_logging\\_buckets) | The list of S3 bucket ARNs on which to enable object-level logging. | `list(string)` | no |\n| \u003ca name=\"input_cloudtrail_sns_topic_enabled\"\u003e\u003c/a\u003e [cloudtrail\\_sns\\_topic\\_enabled](#input\\_cloudtrail\\_sns\\_topic\\_enabled) | Specifies whether the trail is delivered to a SNS topic. | `bool` | no |\n| \u003ca name=\"input_cloudtrail_sns_topic_name\"\u003e\u003c/a\u003e [cloudtrail\\_sns\\_topic\\_name](#input\\_cloudtrail\\_sns\\_topic\\_name) | The name of the SNS topic to link to the trail. | `string` | no |\n| \u003ca name=\"input_cloudwatch_logs_retention_in_days\"\u003e\u003c/a\u003e [cloudwatch\\_logs\\_retention\\_in\\_days](#input\\_cloudwatch\\_logs\\_retention\\_in\\_days) | Number of days to retain logs for. CIS recommends 365 days.  Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely. | `number` | no |\n| \u003ca name=\"input_config_aggregator_name\"\u003e\u003c/a\u003e [config\\_aggregator\\_name](#input\\_config\\_aggregator\\_name) | The name of the organizational AWS Config Configuration Aggregator. | `string` | no |\n| \u003ca name=\"input_config_aggregator_name_prefix\"\u003e\u003c/a\u003e [config\\_aggregator\\_name\\_prefix](#input\\_config\\_aggregator\\_name\\_prefix) | The prefix of the name for the IAM role attached to the organizational AWS Config Configuration Aggregator. | `string` | no |\n| \u003ca name=\"input_config_baseline_enabled\"\u003e\u003c/a\u003e [config\\_baseline\\_enabled](#input\\_config\\_baseline\\_enabled) | Boolean whether config-baseline is enabled. | `bool` | no |\n| \u003ca name=\"input_config_delivery_frequency\"\u003e\u003c/a\u003e [config\\_delivery\\_frequency](#input\\_config\\_delivery\\_frequency) | The frequency which AWS Config sends a snapshot into the S3 bucket. | `string` | no |\n| \u003ca name=\"input_config_global_resources_all_regions\"\u003e\u003c/a\u003e [config\\_global\\_resources\\_all\\_regions](#input\\_config\\_global\\_resources\\_all\\_regions) | Record global resources in all regions. If false, only default region will record global resources. | `bool` | no |\n| \u003ca name=\"input_config_iam_role_name\"\u003e\u003c/a\u003e [config\\_iam\\_role\\_name](#input\\_config\\_iam\\_role\\_name) | The name of the IAM Role which AWS Config will use. | `string` | no |\n| \u003ca name=\"input_config_iam_role_policy_name\"\u003e\u003c/a\u003e [config\\_iam\\_role\\_policy\\_name](#input\\_config\\_iam\\_role\\_policy\\_name) | The name of the IAM Role Policy which AWS Config will use. | `string` | no |\n| \u003ca name=\"input_config_s3_bucket_key_prefix\"\u003e\u003c/a\u003e [config\\_s3\\_bucket\\_key\\_prefix](#input\\_config\\_s3\\_bucket\\_key\\_prefix) | The prefix used when writing AWS Config snapshots into the S3 bucket. | `string` | no |\n| \u003ca name=\"input_config_sns_topic_kms_master_key_id\"\u003e\u003c/a\u003e [config\\_sns\\_topic\\_kms\\_master\\_key\\_id](#input\\_config\\_sns\\_topic\\_kms\\_master\\_key\\_id) | To enable SNS Topic encryption enter value with the ID of a custom master KMS key that is used for encryption | `string` | no |\n| \u003ca name=\"input_config_sns_topic_name\"\u003e\u003c/a\u003e [config\\_sns\\_topic\\_name](#input\\_config\\_sns\\_topic\\_name) | The name of the SNS Topic to be used to notify configuration changes. | `string` | no |\n| \u003ca name=\"input_console_signin_failures_enabled\"\u003e\u003c/a\u003e [console\\_signin\\_failures\\_enabled](#input\\_console\\_signin\\_failures\\_enabled) | The boolean flag whether the console\\_signin\\_failures alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_create_password_policy\"\u003e\u003c/a\u003e [create\\_password\\_policy](#input\\_create\\_password\\_policy) | Define if the password policy should be created. | `bool` | no |\n| \u003ca name=\"input_create_support_role\"\u003e\u003c/a\u003e [create\\_support\\_role](#input\\_create\\_support\\_role) | Define if the support role should be created. | `bool` | no |\n| \u003ca name=\"input_disable_or_delete_cmk_enabled\"\u003e\u003c/a\u003e [disable\\_or\\_delete\\_cmk\\_enabled](#input\\_disable\\_or\\_delete\\_cmk\\_enabled) | The boolean flag whether the disable\\_or\\_delete\\_cmk alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_guardduty_disable_email_notification\"\u003e\u003c/a\u003e [guardduty\\_disable\\_email\\_notification](#input\\_guardduty\\_disable\\_email\\_notification) | Boolean whether an email notification is sent to the accounts. | `bool` | no |\n| \u003ca name=\"input_guardduty_enabled\"\u003e\u003c/a\u003e [guardduty\\_enabled](#input\\_guardduty\\_enabled) | Boolean whether the guardduty-baseline module is enabled or disabled | `bool` | no |\n| \u003ca name=\"input_guardduty_finding_publishing_frequency\"\u003e\u003c/a\u003e [guardduty\\_finding\\_publishing\\_frequency](#input\\_guardduty\\_finding\\_publishing\\_frequency) | Specifies the frequency of notifications sent for subsequent finding occurrences. | `string` | no |\n| \u003ca name=\"input_guardduty_invitation_message\"\u003e\u003c/a\u003e [guardduty\\_invitation\\_message](#input\\_guardduty\\_invitation\\_message) | Message for invitation. | `string` | no |\n| \u003ca name=\"input_iam_baseline_enabled\"\u003e\u003c/a\u003e [iam\\_baseline\\_enabled](#input\\_iam\\_baseline\\_enabled) | Boolean whether iam-baseline is enabled. | `bool` | no |\n| \u003ca name=\"input_iam_changes_enabled\"\u003e\u003c/a\u003e [iam\\_changes\\_enabled](#input\\_iam\\_changes\\_enabled) | The boolean flag whether the iam\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_master_account_id\"\u003e\u003c/a\u003e [master\\_account\\_id](#input\\_master\\_account\\_id) | The ID of the master AWS account to which the current AWS account is associated. Required if `account_type` is `member`. | `string` | no |\n| \u003ca name=\"input_max_password_age\"\u003e\u003c/a\u003e [max\\_password\\_age](#input\\_max\\_password\\_age) | The number of days that an user password is valid. | `number` | no |\n| \u003ca name=\"input_member_accounts\"\u003e\u003c/a\u003e [member\\_accounts](#input\\_member\\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts. | \u003cpre\u003elist(object({\u003cbr\u003e    account_id = string\u003cbr\u003e    email      = string\u003cbr\u003e  }))\u003c/pre\u003e | no |\n| \u003ca name=\"input_mfa_console_signin_allow_sso\"\u003e\u003c/a\u003e [mfa\\_console\\_signin\\_allow\\_sso](#input\\_mfa\\_console\\_signin\\_allow\\_sso) | The boolean flag whether the no\\_mfa\\_console\\_signin alarm allows SSO auth to be ignored. | `bool` | no |\n| \u003ca name=\"input_minimum_password_length\"\u003e\u003c/a\u003e [minimum\\_password\\_length](#input\\_minimum\\_password\\_length) | Minimum length to require for user passwords. | `number` | no |\n| \u003ca name=\"input_nacl_changes_enabled\"\u003e\u003c/a\u003e [nacl\\_changes\\_enabled](#input\\_nacl\\_changes\\_enabled) | The boolean flag whether the nacl\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_network_gw_changes_enabled\"\u003e\u003c/a\u003e [network\\_gw\\_changes\\_enabled](#input\\_network\\_gw\\_changes\\_enabled) | The boolean flag whether the network\\_gw\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_no_mfa_console_signin_enabled\"\u003e\u003c/a\u003e [no\\_mfa\\_console\\_signin\\_enabled](#input\\_no\\_mfa\\_console\\_signin\\_enabled) | The boolean flag whether the no\\_mfa\\_console\\_signin alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_organizations_changes_enabled\"\u003e\u003c/a\u003e [organizations\\_changes\\_enabled](#input\\_organizations\\_changes\\_enabled) | The boolean flag whether the organizations\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_password_reuse_prevention\"\u003e\u003c/a\u003e [password\\_reuse\\_prevention](#input\\_password\\_reuse\\_prevention) | The number of previous passwords that users are prevented from reusing. | `number` | no |\n| \u003ca name=\"input_permissions_boundary_arn\"\u003e\u003c/a\u003e [permissions\\_boundary\\_arn](#input\\_permissions\\_boundary\\_arn) | The permissions boundary ARN for all IAM Roles, provisioned by this module | `string` | no |\n| \u003ca name=\"input_require_lowercase_characters\"\u003e\u003c/a\u003e [require\\_lowercase\\_characters](#input\\_require\\_lowercase\\_characters) | Whether to require lowercase characters for user passwords. | `bool` | no |\n| \u003ca name=\"input_require_numbers\"\u003e\u003c/a\u003e [require\\_numbers](#input\\_require\\_numbers) | Whether to require numbers for user passwords. | `bool` | no |\n| \u003ca name=\"input_require_symbols\"\u003e\u003c/a\u003e [require\\_symbols](#input\\_require\\_symbols) | Whether to require symbols for user passwords. | `bool` | no |\n| \u003ca name=\"input_require_uppercase_characters\"\u003e\u003c/a\u003e [require\\_uppercase\\_characters](#input\\_require\\_uppercase\\_characters) | Whether to require uppercase characters for user passwords. | `bool` | no |\n| \u003ca name=\"input_root_usage_enabled\"\u003e\u003c/a\u003e [root\\_usage\\_enabled](#input\\_root\\_usage\\_enabled) | The boolean flag whether the root\\_usage alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_route_table_changes_enabled\"\u003e\u003c/a\u003e [route\\_table\\_changes\\_enabled](#input\\_route\\_table\\_changes\\_enabled) | The boolean flag whether the route\\_table\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_s3_baseline_enabled\"\u003e\u003c/a\u003e [s3\\_baseline\\_enabled](#input\\_s3\\_baseline\\_enabled) | Boolean whether s3-baseline is enabled. | `bool` | no |\n| \u003ca name=\"input_s3_block_public_acls\"\u003e\u003c/a\u003e [s3\\_block\\_public\\_acls](#input\\_s3\\_block\\_public\\_acls) | Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to true. | `bool` | no |\n| \u003ca name=\"input_s3_block_public_policy\"\u003e\u003c/a\u003e [s3\\_block\\_public\\_policy](#input\\_s3\\_block\\_public\\_policy) | Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to true. | `bool` | no |\n| \u003ca name=\"input_s3_bucket_policy_changes_enabled\"\u003e\u003c/a\u003e [s3\\_bucket\\_policy\\_changes\\_enabled](#input\\_s3\\_bucket\\_policy\\_changes\\_enabled) | The boolean flag whether the s3\\_bucket\\_policy\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_s3_ignore_public_acls\"\u003e\u003c/a\u003e [s3\\_ignore\\_public\\_acls](#input\\_s3\\_ignore\\_public\\_acls) | Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to true. | `bool` | no |\n| \u003ca name=\"input_s3_restrict_public_buckets\"\u003e\u003c/a\u003e [s3\\_restrict\\_public\\_buckets](#input\\_s3\\_restrict\\_public\\_buckets) | Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to true. | `bool` | no |\n| \u003ca name=\"input_security_group_changes_enabled\"\u003e\u003c/a\u003e [security\\_group\\_changes\\_enabled](#input\\_security\\_group\\_changes\\_enabled) | The boolean flag whether the security\\_group\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_securityhub_enable_aws_foundational_standard\"\u003e\u003c/a\u003e [securityhub\\_enable\\_aws\\_foundational\\_standard](#input\\_securityhub\\_enable\\_aws\\_foundational\\_standard) | Boolean whether AWS Foundations standard is enabled. | `bool` | no |\n| \u003ca name=\"input_securityhub_enable_cis_standard\"\u003e\u003c/a\u003e [securityhub\\_enable\\_cis\\_standard](#input\\_securityhub\\_enable\\_cis\\_standard) | Boolean whether CIS standard is enabled. | `bool` | no |\n| \u003ca name=\"input_securityhub_enable_pci_dss_standard\"\u003e\u003c/a\u003e [securityhub\\_enable\\_pci\\_dss\\_standard](#input\\_securityhub\\_enable\\_pci\\_dss\\_standard) | Boolean whether PCI DSS standard is enabled. | `bool` | no |\n| \u003ca name=\"input_securityhub_enable_product_arns\"\u003e\u003c/a\u003e [securityhub\\_enable\\_product\\_arns](#input\\_securityhub\\_enable\\_product\\_arns) | List of Security Hub product ARNs, `\u003cREGION\u003e` will be replaced. See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html for list. | `list(string)` | no |\n| \u003ca name=\"input_securityhub_enabled\"\u003e\u003c/a\u003e [securityhub\\_enabled](#input\\_securityhub\\_enabled) | Boolean whether the securityhub-baseline module is enabled or disabled | `bool` | no |\n| \u003ca name=\"input_support_iam_role_name\"\u003e\u003c/a\u003e [support\\_iam\\_role\\_name](#input\\_support\\_iam\\_role\\_name) | The name of the the support role. | `string` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Specifies object tags key and value. This applies to all resources created by this module. | `map(string)` | no |\n| \u003ca name=\"input_target_regions\"\u003e\u003c/a\u003e [target\\_regions](#input\\_target\\_regions) | A list of regions to set up with this module. | `list(string)` | no |\n| \u003ca name=\"input_turn_off_organization_trail\"\u003e\u003c/a\u003e [turn\\_off\\_organization\\_trail](#input\\_turn\\_off\\_organization\\_trail) | Specifies whether the disable the organization trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. | `bool` | no |\n| \u003ca name=\"input_unauthorized_api_calls_enabled\"\u003e\u003c/a\u003e [unauthorized\\_api\\_calls\\_enabled](#input\\_unauthorized\\_api\\_calls\\_enabled) | The boolean flag whether the unauthorized\\_api\\_calls alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_use_external_audit_log_bucket\"\u003e\u003c/a\u003e [use\\_external\\_audit\\_log\\_bucket](#input\\_use\\_external\\_audit\\_log\\_bucket) | A boolean that indicates whether the specific audit log bucket already exists. Create a new S3 bucket if it is set to false. | `bool` | no |\n| \u003ca name=\"input_vpc_changes_enabled\"\u003e\u003c/a\u003e [vpc\\_changes\\_enabled](#input\\_vpc\\_changes\\_enabled) | The boolean flag whether the vpc\\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |\n| \u003ca name=\"input_vpc_enable\"\u003e\u003c/a\u003e [vpc\\_enable](#input\\_vpc\\_enable) | Boolean whether the VPC baseline module should be enabled | `bool` | no |\n| \u003ca name=\"input_vpc_enable_flow_logs\"\u003e\u003c/a\u003e [vpc\\_enable\\_flow\\_logs](#input\\_vpc\\_enable\\_flow\\_logs) | The boolean flag whether to enable VPC Flow Logs in default VPCs | `bool` | no |\n| \u003ca name=\"input_vpc_flow_logs_destination_type\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_destination\\_type](#input\\_vpc\\_flow\\_logs\\_destination\\_type) | The type of the logging destination. Valid values: cloud-watch-logs, s3 | `string` | no |\n| \u003ca name=\"input_vpc_flow_logs_log_group_name\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_log\\_group\\_name](#input\\_vpc\\_flow\\_logs\\_log\\_group\\_name) | The name of CloudWatch Logs group to which VPC Flow Logs are delivered. | `string` | no |\n| \u003ca name=\"input_vpc_flow_logs_retention_in_days\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_retention\\_in\\_days](#input\\_vpc\\_flow\\_logs\\_retention\\_in\\_days) | Number of days to retain logs if vpc\\_log\\_destination\\_type is cloud-watch-logs. CIS recommends 365 days. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely. | `number` | no |\n| \u003ca name=\"input_vpc_flow_logs_s3_arn\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_s3\\_arn](#input\\_vpc\\_flow\\_logs\\_s3\\_arn) | ARN of the S3 bucket to which VPC Flow Logs are delivered if vpc\\_log\\_destination\\_type is s3. | `string` | no |\n| \u003ca name=\"input_vpc_flow_logs_s3_key_prefix\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_s3\\_key\\_prefix](#input\\_vpc\\_flow\\_logs\\_s3\\_key\\_prefix) | The prefix used when VPC Flow Logs delivers logs to the S3 bucket. | `string` | no |\n| \u003ca name=\"input_vpc_iam_role_name\"\u003e\u003c/a\u003e [vpc\\_iam\\_role\\_name](#input\\_vpc\\_iam\\_role\\_name) | The name of the IAM Role which VPC Flow Logs will use. | `string` | no |\n| \u003ca name=\"input_vpc_iam_role_policy_name\"\u003e\u003c/a\u003e [vpc\\_iam\\_role\\_policy\\_name](#input\\_vpc\\_iam\\_role\\_policy\\_name) | The name of the IAM Role Policy which VPC Flow Logs will use. | `string` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_alarm_sns_topic\"\u003e\u003c/a\u003e [alarm\\_sns\\_topic](#output\\_alarm\\_sns\\_topic) | The SNS topic to which CloudWatch Alarms will be sent. |\n| \u003ca name=\"output_audit_bucket\"\u003e\u003c/a\u003e [audit\\_bucket](#output\\_audit\\_bucket) | The S3 bucket used for storing audit logs. |\n| \u003ca name=\"output_cloudtrail\"\u003e\u003c/a\u003e [cloudtrail](#output\\_cloudtrail) | The trail for recording events in all regions. |\n| \u003ca name=\"output_cloudtrail_kms_key\"\u003e\u003c/a\u003e [cloudtrail\\_kms\\_key](#output\\_cloudtrail\\_kms\\_key) | The KMS key used for encrypting CloudTrail events. |\n| \u003ca name=\"output_cloudtrail_log_delivery_iam_role\"\u003e\u003c/a\u003e [cloudtrail\\_log\\_delivery\\_iam\\_role](#output\\_cloudtrail\\_log\\_delivery\\_iam\\_role) | The IAM role used for delivering CloudTrail events to CloudWatch Logs. |\n| \u003ca name=\"output_cloudtrail_log_group\"\u003e\u003c/a\u003e [cloudtrail\\_log\\_group](#output\\_cloudtrail\\_log\\_group) | The CloudWatch Logs log group which stores CloudTrail events. |\n| \u003ca name=\"output_cloudtrail_sns_topic\"\u003e\u003c/a\u003e [cloudtrail\\_sns\\_topic](#output\\_cloudtrail\\_sns\\_topic) | The sns topic linked to the cloudtrail. |\n| \u003ca name=\"output_config_configuration_recorder\"\u003e\u003c/a\u003e [config\\_configuration\\_recorder](#output\\_config\\_configuration\\_recorder) | The configuration recorder in each region. |\n| \u003ca name=\"output_config_iam_role\"\u003e\u003c/a\u003e [config\\_iam\\_role](#output\\_config\\_iam\\_role) | The IAM role used for delivering AWS Config records to CloudWatch Logs. |\n| \u003ca name=\"output_config_sns_topic\"\u003e\u003c/a\u003e [config\\_sns\\_topic](#output\\_config\\_sns\\_topic) | The SNS topic) that AWS Config delivers notifications to. |\n| \u003ca name=\"output_default_network_acl\"\u003e\u003c/a\u003e [default\\_network\\_acl](#output\\_default\\_network\\_acl) | The default network ACL. |\n| \u003ca name=\"output_default_route_table\"\u003e\u003c/a\u003e [default\\_route\\_table](#output\\_default\\_route\\_table) | The default route table. |\n| \u003ca name=\"output_default_security_group\"\u003e\u003c/a\u003e [default\\_security\\_group](#output\\_default\\_security\\_group) | The ID of the default security group. |\n| \u003ca name=\"output_default_vpc\"\u003e\u003c/a\u003e [default\\_vpc](#output\\_default\\_vpc) | The default VPC. |\n| \u003ca name=\"output_guardduty_detector\"\u003e\u003c/a\u003e [guardduty\\_detector](#output\\_guardduty\\_detector) | The GuardDuty detector in each region. |\n| \u003ca name=\"output_support_iam_role\"\u003e\u003c/a\u003e [support\\_iam\\_role](#output\\_support\\_iam\\_role) | The IAM role used for the support user. |\n| \u003ca name=\"output_vpc_flow_logs_group\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_group](#output\\_vpc\\_flow\\_logs\\_group) | The CloudWatch Logs log group which stores VPC Flow Logs in each region. |\n| \u003ca name=\"output_vpc_flow_logs_iam_role\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_iam\\_role](#output\\_vpc\\_flow\\_logs\\_iam\\_role) | The IAM role used for delivering VPC Flow Logs to CloudWatch Logs. |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\n[cis amazon web services foundations v1.4.0]: https://www.cisecurity.org/benchmark/amazon_web_services/\n[aws foundational security best practices v1.0.0]: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp.html\n[providers within modules - terraform docs]: https://www.terraform.io/docs/modules/usage.html#providers-within-modules\n[modules in package sub-directories - terraform]: https://www.terraform.io/docs/modules/sources.html#modules-in-package-sub-directories\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnozaq%2Fterraform-aws-secure-baseline","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnozaq%2Fterraform-aws-secure-baseline","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnozaq%2Fterraform-aws-secure-baseline/lists"}