Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/trussworks/terraform-aws-cloudtrail

Creates and configures AWS CloudTrail
https://github.com/trussworks/terraform-aws-cloudtrail

aws aws-cloudtrail logging terraform terraform-modules

Last synced: 28 days ago
JSON representation

Creates and configures AWS CloudTrail

Host: GitHub
URL: https://github.com/trussworks/terraform-aws-cloudtrail
Owner: trussworks
License: bsd-3-clause
Created: 2019-05-24T17:38:22.000Z (over 5 years ago)
Default Branch: main
Last Pushed: 2024-05-09T16:04:11.000Z (8 months ago)
Last Synced: 2024-10-31T13:23:49.340Z (about 2 months ago)
Topics: aws, aws-cloudtrail, logging, terraform, terraform-modules
Language: HCL
Homepage: https://registry.terraform.io/modules/trussworks/cloudtrail
Size: 406 KB
Stars: 46
Watchers: 6
Forks: 33
Open Issues: 5
Metadata Files:
- Readme: README.md
- License: LICENSE

Awesome Lists containing this project

README

        # Terraform AWS CloudTrail

This module creates AWS CloudTrail and configures it so that logs go to cloudwatch.

## Usage

```hcl

module "aws_cloudtrail" {

    source             = "trussworks/cloudtrail/aws"

    s3_bucket_name     = "my-company-cloudtrail-logs"

    log_retention_days = 90

}

```

## Upgrade Instructions for v2 -> v3

Starting in v3, encryption is not optional and will be on for both logs

delivered to S3 and Cloudwatch Logs. The KMS key resource created this

module will be used to encrypt both S3 and Cloudwatch-based logs.

Because of this change, remove the `encrypt_cloudtrail` parameter from

previous invocations of the module prior to upgrading the version.

## Requirements

| Name | Version |

|------|---------|

| terraform | >= 1.0 |

| aws | >= 3.0 |

## Providers

| Name | Version |

|------|---------|

| aws | >= 3.0 |

## Modules

No modules.

## Resources

| Name | Type |

|------|------|

| [aws_cloudtrail.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail) | resource |

| [aws_cloudwatch_log_group.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_iam_policy.cloudtrail_cloudwatch_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

| [aws_iam_policy_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource |

| [aws_iam_role.cloudtrail_cloudwatch_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |

| [aws_kms_alias.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |

| [aws_kms_key.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |

| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |

| [aws_iam_policy_document.cloudtrail_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.cloudtrail_cloudwatch_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.cloudtrail_kms_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |

| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| api\_call\_rate\_insight | A measurement of write-only management API calls that occur per minute against a baseline API call volume. | `bool` | `false` | no |

| api\_error\_rate\_insight | A measurement of management API calls that result in error codes. The error is shown if the API call is unsuccessful. | `bool` | `false` | no |

| cloudwatch\_log\_group\_name | The name of the CloudWatch Log Group that receives CloudTrail events. | `string` | `"cloudtrail-events"` | no |

| enabled | Enables logging for the trail. Defaults to true. Setting this to false will pause logging. | `bool` | `true` | no |

| iam\_policy\_name | Name for the CloudTrail IAM policy | `string` | `"cloudtrail-cloudwatch-logs-policy"` | no |

| iam\_role\_name | Name for the CloudTrail IAM role | `string` | `"cloudtrail-cloudwatch-logs-role"` | no |

| key\_deletion\_window\_in\_days | Duration in days after which the key is deleted after destruction of the resource, must be 7-30 days.  Default 30 days. | `string` | `30` | no |

| log\_retention\_days | Number of days to keep AWS logs around in specific log group. | `string` | `90` | no |

| org\_trail | Whether or not this is an organization trail. Only valid in master account. | `string` | `"false"` | no |

| s3\_bucket\_name | The name of the AWS S3 bucket. | `string` | n/a | yes |

| s3\_key\_prefix | S3 key prefix for CloudTrail logs | `string` | `"cloudtrail"` | no |

| sns\_topic\_arn | ARN of the SNS topic for notification of log file delivery. | `string` | `""` | no |

| tags | A mapping of tags to CloudTrail resources. | `map(string)` | `{}` | no |

| trail\_name | Name for the Cloudtrail | `string` | `"cloudtrail"` | no |

## Outputs

| Name | Description |

|------|-------------|

| cloudtrail\_arn | CloudTrail ARN |

| cloudtrail\_home\_region | CloudTrail Home Region |

| cloudtrail\_id | CloudTrail ID |

## Developer Setup

Install dependencies (macOS)

```shell

brew install pre-commit go terraform terraform-docs

```