https://github.com/sourcefuse/terraform-aws-arc-security

Last synced: about 1 month ago
JSON representation
Host: GitHub
URL: https://github.com/sourcefuse/terraform-aws-arc-security
Owner: sourcefuse
License: apache-2.0
Created: 2023-11-13T15:05:30.000Z (over 2 years ago)
Default Branch: main
Last Pushed: 2025-06-05T06:16:11.000Z (10 months ago)
Last Synced: 2025-08-01T05:55:59.020Z (8 months ago)
Language: HCL
Size: 4.19 MB
Stars: 1
Watchers: 5
Forks: 0
Open Issues: 2
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Security: security-hub-notification.tf
Awesome Lists containing this project

README

          ![Module Structure](./static/banner.png)

# [terraform-aws-arc-security](https://github.com/sourcefuse/terraform-aws-arc-security)

  ![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge&logo=terraform&logoColor=white) ![GitHub Actions](https://img.shields.io/badge/github%20actions-%232671E5.svg?style=for-the-badge&logo=githubactions&logoColor=white)

[![Quality gate](https://sonarcloud.io/api/project_badges/quality_gate?project=sourcefuse_terraform-aws-arc-security)](https://sonarcloud.io/summary/new_code?id=sourcefuse_terraform-aws-arc-security)

[![Known Vulnerabilities](https://github.com/sourcefuse/terraform-aws-arc-security/actions/workflows/snyk.yaml/badge.svg)](https://github.com/sourcefuse/terraform-aws-arc-security/actions/workflows/snyk.yaml)

## Overview

The SourceFuse AWS Reference Architecture (ARC) Terraform module streamlines the management of Security Hub components, enhancing security posture and compliance for AWS environments. This module offers simplified configuration and deployment for Security Hub, optimizing resource allocation and threat detection capabilities.

For more information about this repository and its usage, please see [Terraform AWS ARC GitHub SECURITY Module Usage Guide](https://github.com/sourcefuse/terraform-aws-arc-security/blob/main/docs/module-usage-guide/README.md).

## Usage

To see a full example, check out the [main.tf](./example/main.tf) file in the example folder.  

```hcl

module "cloud_security" {

  source      = "sourcefuse/arc-security/aws"

  version     = "1.0.2"

  region      = var.region

  environment = var.environment

  namespace   = var.namespace

  enable_inspector    = true

  enable_aws_config   = true

  enable_guard_duty   = true

  enable_security_hub = false

  create_config_iam_role = true

  aws_config_sns_subscribers   = local.aws_config_sns_subscribers

  guard_duty_sns_subscribers   = local.guard_duty_sns_subscribers

  security_hub_sns_subscribers = local.security_hub_sns_subscribers

  aws_config_managed_rules       = var.aws_config_managed_rules

  enabled_security_hub_standards = local.security_hub_standards

  create_inspector_iam_role               = var.create_inspector_iam_role

  inspector_enabled_rules                 = var.inspector_enabled_rules

  inspector_schedule_expression           = var.inspector_schedule_expression

  inspector_assessment_event_subscription = var.inspector_assessment_event_subscription

  tags = module.tags.tags

}

```

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.5.0 |

|  [aws](#requirement\_aws) | >= 5.0, < 6.0 |

## Providers

| Name | Version |

|------|---------|

|  [aws](#provider\_aws) | 5.99.1 |

## Modules

| Name | Source | Version |

|------|--------|---------|

|  [aws\_config\_storage](#module\_aws\_config\_storage) | cloudposse/config-storage/aws | 1.0.2 |

|  [config](#module\_config) | cloudposse/config/aws | 1.5.2 |

|  [guard\_duty](#module\_guard\_duty) | cloudposse/guardduty/aws | 0.6.0 |

|  [guard\_duty\_sns\_topic](#module\_guard\_duty\_sns\_topic) | cloudposse/sns-topic/aws | 0.20.1 |

|  [inspector](#module\_inspector) | ./modules/inspector | n/a |

|  [security\_hub](#module\_security\_hub) | cloudposse/security-hub/aws | 0.12.2 |

|  [securityhub\_sns\_kms\_key](#module\_securityhub\_sns\_kms\_key) | cloudposse/kms-key/aws | 0.12.2 |

|  [securityhub\_sns\_topic](#module\_securityhub\_sns\_topic) | cloudposse/sns-topic/aws | 0.21.0 |

|  [sns\_guard\_duty](#module\_sns\_guard\_duty) | cloudposse/sns-topic/aws | 0.21.0 |

## Resources

| Name | Type |

|------|------|

| [aws_cloudwatch_event_rule.guard_duty_findings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |

| [aws_cloudwatch_event_rule.imported_findings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |

| [aws_cloudwatch_event_target.guard_duty_imported_findings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |

| [aws_cloudwatch_event_target.security_hub_imported_findings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |

| [aws_kms_alias.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |

| [aws_kms_key.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |

| [aws_sns_topic_policy.sns_topic_guard_duty](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |

| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |

| [aws_iam_policy_document.guard_duty_sns_topic_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.securityhub_sns_kms_key_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_session_context.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_session_context) | data source |

| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |

| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [add\_inspector\_member\_accounts](#input\_add\_inspector\_member\_accounts) | Whether to associate as a member account with your Amazon Inspector delegated administrator account. | `bool` | `false` | no |

|  [aws\_config\_managed\_rules](#input\_aws\_config\_managed\_rules) | A list of AWS Managed Rules that should be enabled on the account.

See the following for a list of possible rules to enable:
https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html | 
map(object({
    description      = string
    identifier       = string
    input_parameters = any
    tags             = map(string)
    enabled          = bool
  })) | `{}` | no |

|  [aws\_config\_sns\_subscribers](#input\_aws\_config\_sns\_subscribers) | A map of subscription configurations for SNS topics

For more information, see:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription#argument-reference

protocol:
  The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially
  supported, see link) (email is an option but is unsupported in terraform, see link).
endpoint:
  The endpoint to send data to, the contents will vary with the protocol. (see link for more information)
endpoint\_auto\_confirms:
  Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty. Default is
  false
raw\_message\_delivery:
  Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property).
  Default is false | map(object({
    protocol               = string
    endpoint               = string
    endpoint_auto_confirms = bool
    raw_message_delivery   = bool
  })) | n/a | yes |

|  [create\_config\_iam\_role](#input\_create\_config\_iam\_role) | Flag to indicate whether an iam role should be created for aws config. | `bool` | `false` | no |

|  [enable\_aws\_config](#input\_enable\_aws\_config) | Whether to enable AWS Config | `bool` | `true` | no |

|  [enable\_guard\_duty](#input\_enable\_guard\_duty) | Whether to enable Guard Duty | `bool` | `true` | no |

|  [enable\_inspector](#input\_enable\_inspector) | Whether to enable Inspector | `bool` | `true` | no |

|  [enable\_inspector\_at\_orgnanization](#input\_enable\_inspector\_at\_orgnanization) | Whether to enable Inspecter at Org level, if false account\_list should be provided | `bool` | `false` | no |

|  [enable\_security\_hub](#input\_enable\_security\_hub) | Whether to enable Security Hub | `bool` | `true` | no |

|  [enabled\_security\_hub\_standards](#input\_enabled\_security\_hub\_standards) | A list of standards/rulesets to enable

See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_standards_subscription#argument-reference

The possible values are:

  - standards/aws-foundational-security-best-practices/v/1.0.0
  - ruleset/cis-aws-foundations-benchmark/v/1.2.0
  - standards/pci-dss/v/3.2.1 | `list(any)` | n/a | yes |

|  [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | n/a | yes |

|  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable | `bool` | `false` | no |

|  [guard\_duty\_s3\_protection\_enabled](#input\_guard\_duty\_s3\_protection\_enabled) | Flag to indicate whether S3 protection will be turned on in GuardDuty. | `bool` | `false` | no |

|  [guard\_duty\_sns\_subscribers](#input\_guard\_duty\_sns\_subscribers) | A map of subscription configurations for SNS topics

For more information, see:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription#argument-reference

protocol:
  The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially
  supported, see link) (email is an option but is unsupported in terraform, see link).
endpoint:
  The endpoint to send data to, the contents will vary with the protocol. (see link for more information)
endpoint\_auto\_confirms:
  Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty. Default is
  false
raw\_message\_delivery:
  Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property).
  Default is false | map(object({
    protocol               = string
    endpoint               = string
    endpoint_auto_confirms = bool
    raw_message_delivery   = bool
  })) | `null` | no |

|  [inspector\_account\_list](#input\_inspector\_account\_list) | List of Account for which inspector has to be enabled | `list(string)` | n/a | yes |

|  [inspector\_resource\_types](#input\_inspector\_resource\_types) | Type of resources to scan. Valid values are EC2, ECR, LAMBDA and LAMBDA\_CODE. At least one item is required. | `list(string)` | [
  "EC2",
  "ECR"
] | no |

|  [inspector\_schedule\_expression](#input\_inspector\_schedule\_expression) | AWS Schedule Expression to indicate how often the inspector scheduled event shoud run | `string` | `"rate(7 days)"` | no |

|  [inspector\_sns\_subscribers](#input\_inspector\_sns\_subscribers) | A map of subscription configurations for SNS topics

For more information, see:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription#argument-reference

protocol:
  The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially
  supported, see link) (email is an option but is unsupported in terraform, see link).
endpoint:
  The endpoint to send data to, the contents will vary with the protocol. (see link for more information)
endpoint\_auto\_confirms:
  Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty. Default is
  false
raw\_message\_delivery:
  Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property).
  Default is false | map(object({
    protocol               = string
    endpoint               = string
    endpoint_auto_confirms = bool
    raw_message_delivery   = bool
  })) | `null` | no |

|  [namespace](#input\_namespace) | Namespace for the resources. | `string` | n/a | yes |

|  [region](#input\_region) | AWS region | `string` | `"us-east-1"` | no |

|  [security\_hub\_sns\_subscribers](#input\_security\_hub\_sns\_subscribers) | A map of subscription configurations for SNS topics

For more information, see:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription#argument-reference

protocol:
  The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially
  supported, see link) (email is an option but is unsupported in terraform, see link).
endpoint:
  The endpoint to send data to, the contents will vary with the protocol. (see link for more information)
endpoint\_auto\_confirms:
  Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty. Default is
  false
raw\_message\_delivery:
  Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property).
  Default is false | map(object({
    protocol               = string
    endpoint               = string
    endpoint_auto_confirms = bool
    raw_message_delivery   = bool
  })) | `null` | no |

|  [tags](#input\_tags) | Tags for AWS resources | `map(string)` | n/a | yes |

## Outputs

| Name | Description |

|------|-------------|

|  [aws\_config\_configuration\_recorder\_id](#output\_aws\_config\_configuration\_recorder\_id) | The ID of the AWS Config Recorder |

|  [aws\_config\_iam\_role](#output\_aws\_config\_iam\_role) | IAM Role used to make read or write requests to the delivery channel and to describe the AWS resources associated with
the account. |

|  [aws\_config\_sns\_topic](#output\_aws\_config\_sns\_topic) | SNS topic |

|  [aws\_config\_sns\_topic\_subscriptions](#output\_aws\_config\_sns\_topic\_subscriptions) | SNS topic subscriptions |

|  [guard\_duty\_detector](#output\_guard\_duty\_detector) | GuardDuty detector |

|  [guard\_duty\_sns\_topic](#output\_guard\_duty\_sns\_topic) | SNS topic |

|  [guard\_duty\_sns\_topic\_subscriptions](#output\_guard\_duty\_sns\_topic\_subscriptions) | SNS topic subscriptions |

|  [inspector\_aws\_cloudwatch\_event\_rule](#output\_inspector\_aws\_cloudwatch\_event\_rule) | The AWS Inspector event rule |

|  [inspector\_aws\_cloudwatch\_event\_target](#output\_inspector\_aws\_cloudwatch\_event\_target) | The AWS Inspector event target |

|  [security\_hub\_enabled\_subscriptions](#output\_security\_hub\_enabled\_subscriptions) | A list of subscriptions that have been enabled |

|  [security\_hub\_sns\_topic](#output\_security\_hub\_sns\_topic) | The SNS topic that was created |

|  [security\_hub\_sns\_topic\_subscriptions](#output\_security\_hub\_sns\_topic\_subscriptions) | The SNS topic that was created |

### Git commits

while Contributing or doing git commit please specify the breaking change in your commit message whether its major,minor or patch

For Example

```sh

git commit -m "your commit message #major"

```

By specifying this , it will bump the version and if you dont specify this in your commit message then by default it will consider patch and will bump that accordingly

## Development

### Prerequisites

- [terraform](https://learn.hashicorp.com/terraform/getting-started/install#installing-terraform)

- [terraform-docs](https://github.com/segmentio/terraform-docs)

- [pre-commit](https://pre-commit.com/#install)

- [golang](https://golang.org/doc/install#install)

- [golint](https://github.com/golang/lint#installation)

### Configurations

- Configure pre-commit hooks

  ```sh

  pre-commit install

  ```

### Tests

- Tests are available in `test` directory

- Configure the dependencies

  ```sh

  cd test/

  go mod init github.com/sourcefuse/terraform-aws-refarch-

  go get github.com/gruntwork-io/terratest/modules/terraform

  ```

- Now execute the test  

  ```sh

  go test -timeout  30m

  ```

## Authors

This project is authored by:

- SourceFuse
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/sourcefuse/terraform-aws-arc-security

Awesome Lists containing this project

README
