Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
Awesome Lists | Featured Topics | Projects
https://github.com/cloudandthings/terraform-aws-clickops-notifier

Get notified when actions are taken in the AWS Console.
https://github.com/cloudandthings/terraform-aws-clickops-notifier
aws clickops terraform terraform-modules
Last synced: 3 days ago
JSON representation
Get notified when actions are taken in the AWS Console.
Host: GitHub
URL: https://github.com/cloudandthings/terraform-aws-clickops-notifier
Owner: cloudandthings
License: mit
Created: 2022-03-12T06:37:55.000Z (almost 3 years ago)
Default Branch: main
Last Pushed: 2024-11-07T11:27:41.000Z (about 1 month ago)
Last Synced: 2024-12-02T00:09:39.243Z (10 days ago)
Topics: aws, clickops, terraform, terraform-modules
Language: Python
Homepage: https://registry.terraform.io/modules/cloudandthings/clickops-notifier/aws/latest
Size: 16.3 MB
Stars: 261
Watchers: 2
Forks: 20
Open Issues: 17
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: .github/contributing.md
Awesome Lists containing this project

awesome-tf - terraform-aws-clickops-notifier - Get notified when actions are taken in the AWS Console. (Tools / Community providers)
README

        [![Tests](https://github.com/cloudandthings/terraform-aws-clickops-notifier/actions/workflows/tests.yml/badge.svg)](https://github.com/cloudandthings/terraform-aws-clickops-notifier/actions/workflows/tests.yml)

# AWS ClickOps Notifier

Get notified when users are taking actions in the AWS Console. More [here](https://medium.com/cloudandthings/aws-clickoops-1b8cabc9b8e3)

## 🏗️ Module Usage

It is not strictly a requirement, that you use this with AWS ControlTower. The module has only been tested in the Log Archive account that ships with AWS ControlTower. Setup your AWS credentails such that `aws sts get-caller-identity | grep Account` gives you your ControlTower Log Archive account id.

### Organizational Mode vs Standalone Mode

If your account is part of an AWS Organization that does not use centralized CloudTrail logging or that does not want to monitor ClickOps at an organizational level, you can deploy ClickOps in `standalone` mode in a single account. For standalone mode you need CloudTrail enabled in your account, have it configured to write logs to a CloudWatch Log Group and have sufficient permission to create a subscription filter on the log group.

## Excluded scoped actions

The following actions will not be alerted, these are either:

- actions that are commonly performed in the AWS Console and we think they are okay

- actions that can only be performed in the AWS Console

This functionality can be overriden with the `excluded_scoped_actions` and `excluded_scoped_actions_effect` variables. The list of excluded actions is available in the terraform docs below.

## Contributing

Report issues/questions/feature requests on in the [issues](https://github.com/cloudandthings/terraform-aws-clickops-notifier/issues/new) section.

Full contributing [guidelines are covered here](.github/contributing.md).

----

## Documentation

----

### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [additional\_iam\_policy\_statements](#input\_additional\_iam\_policy\_statements) | Map of dynamic policy statements to attach to Lambda Function role | `any` | `{}` | no |

|  [allowed\_aws\_principals\_for\_sns\_subscribe](#input\_allowed\_aws\_principals\_for\_sns\_subscribe) | List of AWS principals allowed to subscribe to the SNS topic (only applicable to org deployments). | `list(string)` | `[]` | no |

|  [cloudtrail\_bucket\_name](#input\_cloudtrail\_bucket\_name) | Bucket containing the Cloudtrail logs that you want to process. ControlTower bucket name follows this naming convention `aws-controltower-logs-{{account_id}}-{{region}}` | `string` | `""` | no |

|  [cloudtrail\_bucket\_notifications\_sns\_arn](#input\_cloudtrail\_bucket\_notifications\_sns\_arn) | SNS topic ARN for bucket notifications. If not provided, a new SNS topic will be created along with the bucket notifications configuration. | `string` | `null` | no |

|  [cloudtrail\_log\_group](#input\_cloudtrail\_log\_group) | CloudWatch Log group for CloudTrail events. | `string` | `""` | no |

|  [create\_iam\_role](#input\_create\_iam\_role) | Determines whether a an IAM role is created or to use an existing IAM role | `bool` | `true` | no |

|  [event\_batch\_size](#input\_event\_batch\_size) | Batch events into chunks of `event_batch_size` | `number` | `100` | no |

|  [event\_maximum\_batching\_window](#input\_event\_maximum\_batching\_window) | Maximum batching window in seconds. | `number` | `300` | no |

|  [event\_processing\_timeout](#input\_event\_processing\_timeout) | Maximum number of seconds the lambda is allowed to run and number of seconds events should be hidden in SQS after being picked up my Lambda. | `number` | `60` | no |

|  [excluded\_accounts](#input\_excluded\_accounts) | List of accounts that be excluded for scans on manual actions. These take precidence over `included_accounts` | `list(string)` | `[]` | no |

|  [excluded\_scoped\_actions](#input\_excluded\_scoped\_actions) | A list of service scoped actions that will not be alerted on. Format {{service}}.amazonaws.com:{{action}} | `list(string)` | `[]` | no |

|  [excluded\_scoped\_actions\_effect](#input\_excluded\_scoped\_actions\_effect) | Should the existing exluded actions be replaces or appended to. By default it will append to the list, valid values: APPEND, REPLACE | `string` | `"APPEND"` | no |

|  [excluded\_users](#input\_excluded\_users) | List of email addresses will not be reported on when practicing ClickOps. | `list(string)` | `[]` | no |

|  [firehose\_delivery\_stream\_name](#input\_firehose\_delivery\_stream\_name) | Kinesis Firehose delivery stream name to output ClickOps events to. | `string` | `null` | no |

|  [iam\_role\_arn](#input\_iam\_role\_arn) | Existing IAM role ARN for the lambda. Required if `create_iam_role` is set to `false` | `string` | `null` | no |

|  [included\_accounts](#input\_included\_accounts) | List of accounts that be scanned to manual actions. If empty will scan all accounts. | `list(string)` | `[]` | no |

|  [included\_users](#input\_included\_users) | List of emails that be scanned to manual actions. If empty will scan all emails. | `list(string)` | `[]` | no |

|  [kms\_key\_id\_for\_sns\_topic](#input\_kms\_key\_id\_for\_sns\_topic) | KMS key ID for encrypting the sns\_topic (only applicable to org deployments). | `string` | `null` | no |

|  [lambda\_deployment\_s3\_bucket](#input\_lambda\_deployment\_s3\_bucket) | S3 bucket for lambda deployment package. | `string` | `null` | no |

|  [lambda\_deployment\_s3\_key](#input\_lambda\_deployment\_s3\_key) | S3 object key for lambda deployment package. Otherwise, defaults to `var.naming_prefix/local.deployment_filename`. | `string` | `null` | no |

|  [lambda\_deployment\_upload\_to\_s3\_enabled](#input\_lambda\_deployment\_upload\_to\_s3\_enabled) | If `true`, the lambda deployment package within this module repo will be copied to S3. If `false` then the S3 object must be uploaded separately. Ignored if `lambda_deployment_s3_bucket` is null. | `bool` | `true` | no |

|  [lambda\_log\_level](#input\_lambda\_log\_level) | Lambda logging level. One of: `["DEBUG", "INFO", "WARN", "ERROR"]`. | `string` | `"WARN"` | no |

|  [lambda\_memory\_size](#input\_lambda\_memory\_size) | The amount of memory for Lambda to use | `number` | `"128"` | no |

|  [lambda\_runtime](#input\_lambda\_runtime) | The lambda runtime to use. One of: `["python3.9", "python3.8", "python3.7"]` | `string` | `"python3.8"` | no |

|  [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | Number of days to keep CloudWatch logs | `number` | `14` | no |

|  [naming\_prefix](#input\_naming\_prefix) | Resources will be prefixed with this | `string` | `"clickops-notifier"` | no |

|  [standalone](#input\_standalone) | Deploy ClickOps in a standalone account instead of into an entire AWS Organization. Ideal for teams who want to monitor ClickOps in only their accounts where it is not instrumented at an Organizational level. | `bool` | `false` | no |

|  [subcription\_filter\_distribution](#input\_subcription\_filter\_distribution) | The method used to distribute log data to the destination. By default log data is grouped by log stream, but the grouping can be set to random for a more even distribution. This property is only applicable when the destination is an Amazon Kinesis stream. Valid values are "Random" and "ByLogStream". | `string` | `"Random"` | no |

|  [tags](#input\_tags) | Tags to add to resources in addition to the default\_tags for the provider | `map(string)` | `{}` | no |

|  [webhooks\_for\_msteams\_notifications](#input\_webhooks\_for\_msteams\_notifications) | Map of `custom_name => webhook URL`s for MS Teams notifications. https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet | `map(string)` | `{}` | no |

|  [webhooks\_for\_slack\_notifications](#input\_webhooks\_for\_slack\_notifications) | Map of `custom_name => webhook URL`s for Slack notifications. https://api.slack.com/messaging/webhooks | `map(string)` | `{}` | no |

----

### Modules

| Name | Source | Version |

|------|--------|---------|

|  [clickops\_notifier\_lambda](#module\_clickops\_notifier\_lambda) | terraform-aws-modules/lambda/aws | 4.9.0 |

----

### Outputs

| Name | Description |

|------|-------------|

|  [clickops\_notifier\_lambda](#output\_clickops\_notifier\_lambda) | Expose all the outputs from the lambda module |

|  [sns\_topic](#output\_sns\_topic) | Expose the bucket notification SNS details |

|  [sqs\_queue](#output\_sqs\_queue) | Expose the bucket notification SQS details |

----

### Providers

| Name | Version |

|------|---------|

|  [aws](#provider\_aws) | >= 4.9 |

----

### Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 0.15.0 |

|  [aws](#requirement\_aws) | >= 4.9 |

----

### Resources

| Name | Type |

|------|------|

| [aws_cloudwatch_log_subscription_filter.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_subscription_filter) | resource |

| [aws_s3_bucket_notification.bucket_notification](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |

| [aws_s3_object.deployment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource |

| [aws_sns_topic.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |

| [aws_sns_topic_policy.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |

| [aws_sns_topic_subscription.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |

| [aws_sqs_queue.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |

| [aws_sqs_queue_policy.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |

| [aws_ssm_parameter.webhooks_for_msteams](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |

| [aws_ssm_parameter.webhooks_for_slack](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |

| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |

| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudwatch_log_group) | data source |

| [aws_iam_policy_document.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.lambda_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.sns_topic_policy_bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

----

### Default excluded scoped actions

```hcl

locals {

  ignored_scoped_events_built_in = [

    "cognito-idp.amazonaws.com:InitiateAuth",

    "cognito-idp.amazonaws.com:RespondToAuthChallenge",

    "sso.amazonaws.com:Federate",

    "sso.amazonaws.com:Authenticate",

    "sso.amazonaws.com:Logout",

    "sso.amazonaws.com:SearchUsers",

    "sso.amazonaws.com:SearchGroups",

    "sso.amazonaws.com:CreateToken",

    "signin.amazonaws.com:UserAuthentication",

    "signin.amazonaws.com:SwitchRole",

    "signin.amazonaws.com:RenewRole",

    "signin.amazonaws.com:ExternalIdPDirectoryLogin",

    "signin.amazonaws.com:CredentialVerification",

    "signin.amazonaws.com:CredentialChallenge",

    "signin.amazonaws.com:CheckMfa",

    "logs.amazonaws.com:StartQuery",

    "cloudtrail.amazonaws.com:StartQuery",

    "iam.amazonaws.com:SimulatePrincipalPolicy",

    "iam.amazonaws.com:GenerateServiceLastAccessedDetails",

    "glue.amazonaws.com:BatchGetJobs",

    "glue.amazonaws.com:BatchGetCrawlers",

    "glue.amazonaws.com:StartJobRun",

    "glue.amazonaws.com:StartCrawler",

    "athena.amazonaws.com:StartQueryExecution",

    "servicecatalog.amazonaws.com:SearchProductsAsAdmin",

    "servicecatalog.amazonaws.com:SearchProducts",

    "servicecatalog.amazonaws.com:SearchProvisionedProducts",

    "servicecatalog.amazonaws.com:TerminateProvisionedProduct",

    "cloudshell.amazonaws.com:CreateSession",

    "cloudshell.amazonaws.com:PutCredentials",

    "cloudshell.amazonaws.com:SendHeartBeat",

    "cloudshell.amazonaws.com:CreateEnvironment",

    "kms.amazonaws.com:Decrypt",

    "kms.amazonaws.com:RetireGrant",

    "trustedadvisor.amazonaws.com:RefreshCheck",

    # Must CreateMultipartUpload before uploading any parts.

    "s3.amazonaws.com:UploadPart",

    "s3.amazonaws.com:UploadPartCopy",

    "route53domains:TransferDomain",

    "support.amazonaws.com:AddAttachmentsToSet",

    "support.amazonaws.com:AddCommunicationToCase",

    "support.amazonaws.com:CreateCase",

    "support.amazonaws.com:InitiateCallForCase",

    "support.amazonaws.com:InitiateChatForCase",

    "support.amazonaws.com:PutCaseAttributes",

    "support.amazonaws.com:RateCaseCommunication",

    "support.amazonaws.com:RefreshTrustedAdvisorCheck",

    "support.amazonaws.com:ResolveCase",

    "grafana.amazonaws.com:login_auth_sso",

  ]

}

```

----