-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
81 lines (61 loc) · 1.83 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
resource "aws_guardduty_detector" "guardduty" {
enable = true
finding_publishing_frequency = var.finding_publishing_frequency
datasources {
s3_logs {
enable = var.is_s3_protection_enabled
}
malware_protection {
scan_ec2_instance_with_findings {
ebs_volumes {
enable = var.is_malware_protection_enabled
}
}
}
kubernetes {
audit_logs {
enable = var.is_kubernetes_protection_enabled
}
}
}
tags = local.tags
}
module "sns_email" {
source = "oozou/sns/aws"
version = "1.0.1"
prefix = var.prefix
environment = var.environment
name = format("%s-gd", var.name)
display_name = format("%s-GuardDuty", var.name)
# KMS
is_enable_encryption = true
is_create_kms = true
additional_kms_key_policies = [data.aws_iam_policy_document.cwe.json]
subscription_configurations = {
email = {
protocol = "email"
addresses = var.is_enabled_notification.email_notify.enable ? var.is_enabled_notification.email_notify.mail_list : []
}
}
sns_permission_configuration = { # Defautl is {}
allow_eventbridge = {
pricipal = "events.amazonaws.com"
}
}
tags = local.tags
}
module "eventbridge_mail" {
source = "oozou/eventbridge/aws"
version = "1.0.1"
prefix = var.prefix
environment = var.environment
event_description = "The rule for GuardDuty Notify SNS to Email"
name = format("%s-gd", var.name)
# Enable or Not
cloudwatch_event_rule_is_enabled = var.is_enabled_notification.email_notify.enable
input_transformer = local.input_transformer
event_pattern = local.event_pattern
cloudwatch_event_target_arn = module.sns_email.sns_topic_arn
retry_policy = var.retry_policy
tags = local.tags
}