feat: add support for guardduty detector features

main.tf

@@ -43,6 +43,24 @@ resource "aws_guardduty_detector" "primary" {
  }
 }
 
+##################################################
+# GuardDuty Features Configuration
+##################################################
+resource "aws_guardduty_detector_feature" "this" {
+ for_each = var.configuration_features
+ detector_id = aws_guardduty_detector.primary.id
+ name = each.key
+ status = each.enabled ? "ENABLED" : "DISABLED"
+
+ dynamic "additional_configuration" {
+ for_each = each.additional_configuration
+ content {
+ name = additional_configuration.key
+ status = each.enabled ? "ENABLED" : "DISABLED"
+ }
+ }
+}
+
 ##################################################
 # GuardDuty Filter
 ##################################################

modules/organizations_admin/main.tf

@@ -31,3 +31,22 @@ resource "aws_guardduty_organization_configuration" "this" {
  }
  }
 }
+
+##################################################
+# GuardDuty Organizations Features Configuration
+##################################################
+resource "aws_guardduty_organization_configuration_feature" "this" {
+ for_each = var.organization_configuration_features
+ detector_id = var.guardduty_detector_id
+ name = each.key
+ auto_enable = each.auto_enable
+
+ dynamic "additional_configuration" {
+ for_each = each.additional_configuration
+ content {
+ name = additional_configuration.key
+ auto_enable = additional_configuration.auto_enable
+ }
+ }
+}
+

modules/organizations_admin/variables.tf

@@ -41,3 +41,30 @@ variable "auto_enable_organization_members" {
  type = string
  default = "NEW"
 }
+
+variable "organization_configuration_features" {
+ description = "Enable new organization GuardDuty protections only available as features"
+ type = map(object({
+ auto_enable = string
+ additional_configuration = map(object({
+ auto_enable = string
+ }))
+ }))
+ validation {
+ condition = alltrue([for k in var.organization_configuration_features : contains(["S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING"], k)])
+ error_message = "The organization_configuration_features key must be one of: S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, EKS_RUNTIME_MONITORING, LAMBDA_NETWORK_LOGS, RUNTIME_MONITORING."
+ }
+ validation {
+ condition = alltrue([for k, v in var.organization_configuration_features : contains(["ALL", "NONE", "NEW"], v.auto_enable)])
+ error_message = "The auto_enable value must be one of: ALL, NONE, NEW."
+ }
+ validation {
+ condition = alltrue([for k, v in var.organization_configuration_features : [for a in v.additional_configuration : contains(["EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EC2_AGENT_MANAGEMENT"], a)]])
+ error_message = "The additional_configuration key must be one of: EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT, EC2_AGENT_MANAGEMENT."
+ }
+ validation {
+ condition = alltrue([for k, v in var.organization_configuration_features : [for ak, av in v.additional_configuration : contains(["ALL", "NONE", "NEW"], av.auto_enable)]])
+ error_message = "The auto_enable value must be one of: ALL, NONE, NEW."
+ }
+ default = {}
+}

variables.tf

@@ -43,6 +43,23 @@ variable "finding_publishing_frequency" {
  default = "FIFTEEN_MINUTES"
 }
 
+variable "configuration_features" {
+ description = "Enable new GuardDuty protections only available as features"
+ type = map(object({
+ enabled = bool
+ additional_configuration = map(bool)
+ }))
+ validation {
+ condition = alltrue([for k in var.configuration_features : contains(["S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING"], k)])
+ error_message = "The configuration_features key must be one of: S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, EKS_RUNTIME_MONITORING, LAMBDA_NETWORK_LOGS, RUNTIME_MONITORING."
+ }
+ validation {
+ condition = alltrue([for k, v in var.configuration_features : [for a in v.additional_configuration : contains(["EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EC2_AGENT_MANAGEMENT"], a)]])
+ error_message = "The additional_configuration key must be one of: EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT, EC2_AGENT_MANAGEMENT."
+ }
+ default = {}
+}
+
 
 ##################################################
 # GuardDuty Filter