nozaq / terraform-aws-secure-baseline Goto Github PK

Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.

License: MIT License

HCL 99.90% Dockerfile 0.10%

terraform aws security security-hardening terraform-modules hardening cis-benchmark aws-auditing security-tools devops

terraform-aws-secure-baseline's Introduction

terraform-aws-secure-baseline

Terraform Module Registry

A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0.

See Benchmark Compliance to check which items in various benchmarks are covered.

Features

Identity and Access Management

Set up IAM Password Policy.
Create an IAM role for contacting AWS support for incident handling.
Enable AWS Config rules to audit root account status.
Enable IAM Access Analyzer in each region.
Enable S3 account-level Public Access Block configuration.

Logging & Monitoring

Enable CloudTrail in all regions and deliver events to CloudWatch Logs.
Object-level logging for all S3 buckets is enabled by default.
CloudTrail Insights event logging is enabled by default.
CloudTrail logs are encrypted using AWS Key Management Service.
All logs are stored in the S3 bucket with access logging enabled.
Logs are automatically archived into Amazon Glacier after the given period(defaults to 90 days).
Set up CloudWatch alarms to notify you when critical changes happen in your AWS account.
Enable AWS Config in each regions to automatically take configuration snapshots.
Enable SecurityHub and subscribe available standards.
Enable GuardDuty in each regions.

Networking & Computing

Remove all rules associated with default route tables, default network ACLs and default security groups in the default VPC in all regions.
Disable automatic public IP assignments in default subnets.
Enable AWS Config rules to audit unrestricted common ports in Security Group rules.
Enable VPC Flow Logs with the default VPC in all regions.
Enable default EBS encryption for newly created volumes.

Usage

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

module "secure_baseline" {
  source = "nozaq/secure-baseline/aws"

  audit_log_bucket_name           = "YOUR_BUCKET_NAME"
  aws_account_id                  = data.aws_caller_identity.current.account_id
  region                          = data.aws_region.current.name
  support_iam_role_principal_arns = ["YOUR_IAM_USER"]

  providers = {
    aws                = aws
    aws.ap-northeast-1 = aws.ap-northeast-1
    aws.ap-northeast-2 = aws.ap-northeast-2
    aws.ap-northeast-3 = aws.ap-northeast-3
    aws.ap-south-1     = aws.ap-south-1
    aws.ap-southeast-1 = aws.ap-southeast-1
    aws.ap-southeast-2 = aws.ap-southeast-2
    aws.ca-central-1   = aws.ca-central-1
    aws.eu-central-1   = aws.eu-central-1
    aws.eu-north-1     = aws.eu-north-1
    aws.eu-west-1      = aws.eu-west-1
    aws.eu-west-2      = aws.eu-west-2
    aws.eu-west-3      = aws.eu-west-3
    aws.sa-east-1      = aws.sa-east-1
    aws.us-east-1      = aws.us-east-1
    aws.us-east-2      = aws.us-east-2
    aws.us-west-1      = aws.us-west-1
    aws.us-west-2      = aws.us-west-2
  }
}

Check the example to understand how these providers are defined. Note that you need to define a provider for each AWS region and pass them to the module. Currently this is the recommended way to handle multiple regions in one module. Detailed information can be found at Providers within Modules - Terraform Docs.

A new S3 bucket to store audit logs is automatically created by default, while the external S3 bucket can be specified. It is useful when you already have a centralized S3 bucket to store all logs. Please see external-bucket example for more detail.

Managing multiple accounts in AWS Organization

When you have multiple AWS accounts in your AWS Organization, secure-baseline module configures the separated environment for each AWS account. You can change this behavior to centrally manage security information and audit logs from all accounts in one master account. Check organization example for more detail.

Submodules

This module is composed of several submodules and each of which can be used independently. Modules in Package Sub-directories - Terraform describes how to source a submodule.

Compatibility

Starting from v1.0, this module requires Terraform Provider for AWS v4.0 or later. Version 1.0 Upgrade Guide described the recommended procedure after the upgrade.
Starting from v0.20, this module requires Terraform Provider for AWS v3.0 or later. Please use v0.19 if you need to use v2.x or earlier.
Starting from v0.10, this module requires Terraform v0.12 or later. Please use v0.9 if you need to use Terraform v0.11 or ealier.

Requirements

Name	Version
terraform	>= 1.1.4
aws	>= 4.3

Providers

Name	Version
aws	>= 4.3

Inputs

Name	Description	Type	Required
audit_log_bucket_name	The name of the S3 bucket to store various audit logs.	`string`	yes
aws_account_id	The AWS Account ID number of the account.	`string`	yes
region	The AWS region in which global resources are set up.	`string`	yes
support_iam_role_principal_arns	List of ARNs of the IAM principal elements by which the support role could be assumed.	`list(string)`	yes
account_type	The type of the AWS account. The possible values are `individual`, `master` and `member` . Specify `master` and `member` to set up centalized logging for multiple accounts in AWS Organization. Use individual `otherwise.`	`string`	no
alarm_baseline_enabled	Boolean whether alarm-baseline is enabled.	`bool`	no
alarm_namespace	The namespace in which all alarms are set up.	`string`	no
alarm_sns_topic_kms_master_key_id	To enable SNS Topic encryption enter value with the ID of a custom master KMS key that is used for encryption	`string`	no
alarm_sns_topic_name	The name of the SNS Topic which will be notified when any alarm is performed.	`string`	no
allow_users_to_change_password	Whether to allow users to change their own password.	`bool`	no
analyzer_baseline_enabled	Boolean whether analyzer-baseline is enabled.	`bool`	no
analyzer_name	The name for the IAM Access Analyzer resource to be created.	`string`	no
audit_log_bucket_access_logs_name	The name of the S3 bucket to store various audit logs.	`string`	no
audit_log_bucket_custom_policy_json	Override policy for the audit log bucket. Allows addition of extra policies.	`string`	no
audit_log_bucket_force_destroy	A boolean that indicates all objects should be deleted from the audit log bucket so that the bucket can be destroyed without error. These objects are not recoverable.	`bool`	no
audit_log_bucket_key_enabled	Whether or not to use Amazon S3 Bucket Keys for encrypting the audit log bucket.	`bool`	no
audit_log_lifecycle_glacier_transition_days	The number of days after log creation when the log file is archived into Glacier. Setting to zero disables the transition.	`number`	no
aws_config_changes_enabled	The boolean flag whether the aws_config_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
cloudtrail_baseline_enabled	Boolean whether cloudtrail-baseline is enabled.	`bool`	no
cloudtrail_cfg_changes_enabled	The boolean flag whether the cloudtrail_cfg_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
cloudtrail_cloudwatch_logs_enabled	Specifies whether the trail is delivered to CloudWatch Logs.	`bool`	no
cloudtrail_cloudwatch_logs_group_name	The name of CloudWatch Logs group to which CloudTrail events are delivered.	`string`	no
cloudtrail_dynamodb_event_logging_tables	The list of DynamoDB table ARNs on which to enable event logging.	`list(string)`	no
cloudtrail_iam_role_name	The name of the IAM Role to be used by CloudTrail to delivery logs to CloudWatch Logs group.	`string`	no
cloudtrail_iam_role_policy_name	The name of the IAM Role Policy to be used by CloudTrail to delivery logs to CloudWatch Logs group.	`string`	no
cloudtrail_key_deletion_window_in_days	Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 30 days.	`number`	no
cloudtrail_lambda_invocation_logging_lambdas	The list of lambda ARNs on which to enable invocation logging.	`list(string)`	no
cloudtrail_name	The name of the trail.	`string`	no
cloudtrail_s3_key_prefix	The prefix used when CloudTrail delivers events to the S3 bucket.	`string`	no
cloudtrail_s3_object_level_logging_buckets	The list of S3 bucket ARNs on which to enable object-level logging.	`list(string)`	no
cloudtrail_sns_topic_enabled	Specifies whether the trail is delivered to a SNS topic.	`bool`	no
cloudtrail_sns_topic_name	The name of the SNS topic to link to the trail.	`string`	no
cloudwatch_logs_retention_in_days	Number of days to retain logs for. CIS recommends 365 days. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely.	`number`	no
config_aggregator_name	The name of the organizational AWS Config Configuration Aggregator.	`string`	no
config_aggregator_name_prefix	The prefix of the name for the IAM role attached to the organizational AWS Config Configuration Aggregator.	`string`	no
config_baseline_enabled	Boolean whether config-baseline is enabled.	`bool`	no
config_delivery_frequency	The frequency which AWS Config sends a snapshot into the S3 bucket.	`string`	no
config_global_resources_all_regions	Record global resources in all regions. If false, only default region will record global resources.	`bool`	no
config_iam_role_name	The name of the IAM Role which AWS Config will use.	`string`	no
config_iam_role_policy_name	The name of the IAM Role Policy which AWS Config will use.	`string`	no
config_s3_bucket_key_prefix	The prefix used when writing AWS Config snapshots into the S3 bucket.	`string`	no
config_sns_topic_kms_master_key_id	To enable SNS Topic encryption enter value with the ID of a custom master KMS key that is used for encryption	`string`	no
config_sns_topic_name	The name of the SNS Topic to be used to notify configuration changes.	`string`	no
console_signin_failures_enabled	The boolean flag whether the console_signin_failures alarm is enabled or not. No resources are created when set to false.	`bool`	no
create_password_policy	Define if the password policy should be created.	`bool`	no
create_support_role	Define if the support role should be created.	`bool`	no
disable_or_delete_cmk_enabled	The boolean flag whether the disable_or_delete_cmk alarm is enabled or not. No resources are created when set to false.	`bool`	no
guardduty_disable_email_notification	Boolean whether an email notification is sent to the accounts.	`bool`	no
guardduty_enabled	Boolean whether the guardduty-baseline module is enabled or disabled	`bool`	no
guardduty_finding_publishing_frequency	Specifies the frequency of notifications sent for subsequent finding occurrences.	`string`	no
guardduty_invitation_message	Message for invitation.	`string`	no
iam_baseline_enabled	Boolean whether iam-baseline is enabled.	`bool`	no
iam_changes_enabled	The boolean flag whether the iam_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
master_account_id	The ID of the master AWS account to which the current AWS account is associated. Required if `account_type` is `member`.	`string`	no
max_password_age	The number of days that an user password is valid.	`number`	no
member_accounts	A list of IDs and emails of AWS accounts which associated as member accounts.	list(object({ account_id = string email = string }))	no
mfa_console_signin_allow_sso	The boolean flag whether the no_mfa_console_signin alarm allows SSO auth to be ignored.	`bool`	no
minimum_password_length	Minimum length to require for user passwords.	`number`	no
nacl_changes_enabled	The boolean flag whether the nacl_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
network_gw_changes_enabled	The boolean flag whether the network_gw_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
no_mfa_console_signin_enabled	The boolean flag whether the no_mfa_console_signin alarm is enabled or not. No resources are created when set to false.	`bool`	no
organizations_changes_enabled	The boolean flag whether the organizations_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
password_reuse_prevention	The number of previous passwords that users are prevented from reusing.	`number`	no
permissions_boundary_arn	The permissions boundary ARN for all IAM Roles, provisioned by this module	`string`	no
require_lowercase_characters	Whether to require lowercase characters for user passwords.	`bool`	no
require_numbers	Whether to require numbers for user passwords.	`bool`	no
require_symbols	Whether to require symbols for user passwords.	`bool`	no
require_uppercase_characters	Whether to require uppercase characters for user passwords.	`bool`	no
root_usage_enabled	The boolean flag whether the root_usage alarm is enabled or not. No resources are created when set to false.	`bool`	no
route_table_changes_enabled	The boolean flag whether the route_table_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
s3_baseline_enabled	Boolean whether s3-baseline is enabled.	`bool`	no
s3_block_public_acls	Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to true.	`bool`	no
s3_block_public_policy	Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to true.	`bool`	no
s3_bucket_policy_changes_enabled	The boolean flag whether the s3_bucket_policy_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
s3_ignore_public_acls	Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to true.	`bool`	no
s3_restrict_public_buckets	Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to true.	`bool`	no
security_group_changes_enabled	The boolean flag whether the security_group_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
securityhub_enable_aws_foundational_standard	Boolean whether AWS Foundations standard is enabled.	`bool`	no
securityhub_enable_cis_standard	Boolean whether CIS standard is enabled.	`bool`	no
securityhub_enable_pci_dss_standard	Boolean whether PCI DSS standard is enabled.	`bool`	no
securityhub_enable_product_arns	List of Security Hub product ARNs, `<REGION>` will be replaced. See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html for list.	`list(string)`	no
securityhub_enabled	Boolean whether the securityhub-baseline module is enabled or disabled	`bool`	no
support_iam_role_name	The name of the the support role.	`string`	no
tags	Specifies object tags key and value. This applies to all resources created by this module.	`map(string)`	no
target_regions	A list of regions to set up with this module.	`list(string)`	no
turn_off_organization_trail	Specifies whether the disable the organization trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account.	`bool`	no
unauthorized_api_calls_enabled	The boolean flag whether the unauthorized_api_calls alarm is enabled or not. No resources are created when set to false.	`bool`	no
use_external_audit_log_bucket	A boolean that indicates whether the specific audit log bucket already exists. Create a new S3 bucket if it is set to false.	`bool`	no
vpc_changes_enabled	The boolean flag whether the vpc_changes alarm is enabled or not. No resources are created when set to false.	`bool`	no
vpc_enable	Boolean whether the VPC baseline module should be enabled	`bool`	no
vpc_enable_flow_logs	The boolean flag whether to enable VPC Flow Logs in default VPCs	`bool`	no
vpc_flow_logs_destination_type	The type of the logging destination. Valid values: cloud-watch-logs, s3	`string`	no
vpc_flow_logs_log_group_name	The name of CloudWatch Logs group to which VPC Flow Logs are delivered.	`string`	no
vpc_flow_logs_retention_in_days	Number of days to retain logs if vpc_log_destination_type is cloud-watch-logs. CIS recommends 365 days. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely.	`number`	no
vpc_flow_logs_s3_arn	ARN of the S3 bucket to which VPC Flow Logs are delivered if vpc_log_destination_type is s3.	`string`	no
vpc_flow_logs_s3_key_prefix	The prefix used when VPC Flow Logs delivers logs to the S3 bucket.	`string`	no
vpc_iam_role_name	The name of the IAM Role which VPC Flow Logs will use.	`string`	no
vpc_iam_role_policy_name	The name of the IAM Role Policy which VPC Flow Logs will use.	`string`	no

Outputs

Name	Description
alarm_sns_topic	The SNS topic to which CloudWatch Alarms will be sent.
audit_bucket	The S3 bucket used for storing audit logs.
cloudtrail	The trail for recording events in all regions.
cloudtrail_kms_key	The KMS key used for encrypting CloudTrail events.
cloudtrail_log_delivery_iam_role	The IAM role used for delivering CloudTrail events to CloudWatch Logs.
cloudtrail_log_group	The CloudWatch Logs log group which stores CloudTrail events.
cloudtrail_sns_topic	The sns topic linked to the cloudtrail.
config_configuration_recorder	The configuration recorder in each region.
config_iam_role	The IAM role used for delivering AWS Config records to CloudWatch Logs.
config_sns_topic	The SNS topic) that AWS Config delivers notifications to.
default_network_acl	The default network ACL.
default_route_table	The default route table.
default_security_group	The ID of the default security group.
default_vpc	The default VPC.
guardduty_detector	The GuardDuty detector in each region.
support_iam_role	The IAM role used for the support user.
vpc_flow_logs_group	The CloudWatch Logs log group which stores VPC Flow Logs in each region.
vpc_flow_logs_iam_role	The IAM role used for delivering VPC Flow Logs to CloudWatch Logs.

terraform-aws-secure-baseline's People

Contributors

Stargazers

Watchers

Forkers

qafro1 erikpaasonen mr-brody qlikcoe manojchalise govtechsg joaquinrinaudo-olx sharmaansh21 sholaj franklinharry berez23 awsyadav edryan04 ddsloan96 megafork gillisda marklaszlo9 gabe-martinez-zz dwsmith23 agiza catalin-costras duckwed jonkyops houey bmacauley-reward cloudwafs essels kmcquade l1ahim changwuf31 ayoneeyee navistone mpoletaev denmat clanbc poeblu pravishj mf-melco linux-place ngocngv hyprnz ausmartway alphawhiskey knightniwrem ik-terraform chsjiang seongkki arvink vigaeatery sohailnajar adambarthelson abhishekbiyala kitepro40 ejschaefer muyenzo oatesp dheerajjoshi gannino gibbsie digarok baileymooreatx jcaxmacher clavery-chef marcin-duszynski calijason76 kabisa awslab scalefree bahtiyarb-torba tsenay binbashar fr34k8 bmetea c0rdis damonpetta gannino-aevi frankiefinancial anthonyangel george-angel akshayfinney vairamuthu-shanmugaraj wrestcody workivate vivekthakker jhbarnett dailymuse bikranz4u prasannamoharana dannyvargas23 snayler0 bamarb work-barryleonard faishal nimishmehta8779 djoker0702 victor-josho-w cogentcloud sunilsinghal84 skel84 loffelmacher

terraform-aws-secure-baseline's Issues

Security Hub throws ResourceConflictException for "master" accounts

Hi there,

Upgrading to 0.18.0, I had an issue with my account set up in the following way (some variables redacted, let me know if they are important):

module "secure_baseline" {
  source  = "nozaq/secure-baseline/aws"
  version = "0.18.0"

  aws_account_id                         = "..."
  region                                 = "..."
  account_type                           = "master"
  audit_log_bucket_name                  = "..."
  config_sns_topic_name                  = "..."
  cloudwatch_logs_retention_in_days      = "7"
  cloudtrail_name                        = "multi-region"
  cloudtrail_iam_role_name               = "..."
  cloudtrail_iam_role_policy_name        = "..."
  cloudtrail_key_deletion_window_in_days = "7"
  support_iam_role_principal_arns        = [...]

  target_regions = ["us-west-2"]
}

I received an exception like the following for each region even though I only had a single region in target_regions:

Error: Error enabling Security Hub for account: ResourceConflictException: Account is already subscribed to Security Hub
{
  Code_: "ResourceConflictException",
  Message_: "Account is already subscribed to Security Hub"
}

  on .terraform/modules/secure_baseline/terraform-aws-secure-baseline-0.18.0/modules/securityhub-baseline/main.tf line 4, in resource "aws_securityhub_account" "main":
   4: resource "aws_securityhub_account" "main" {



Error: Error enabling Security Hub for account: ResourceConflictException: Account is already subscribed to Security Hub
{
  Code_: "ResourceConflictException",
  Message_: "Account is already subscribed to Security Hub"
}

  on .terraform/modules/secure_baseline/terraform-aws-secure-baseline-0.18.0/modules/securityhub-baseline/main.tf line 4, in resource "aws_securityhub_account" "main":
   4: resource "aws_securityhub_account" "main" {

...

It appears to be related to #105.

Terraform 0.12

The new stable version is released and a few things need to be upgraded!

ResourceConflictException: Account is already subscribed to Security Hub

Hi,

I just setupped your module (0.21.0), which is quite awesome 👍

I however get these errors (1 for each region) in my master organization account:

Error: Error enabling Security Hub for account: ResourceConflictException: Account is already subscribed to Security Hub
{
  RespMetadata: {
    StatusCode: 409,
    RequestID: "xxx"
  },
  Code_: "ResourceConflictException",
  Message_: "Account is already subscribed to Security Hub"
}

Config is:

module "secure-baseline" {
  source  = "nozaq/secure-baseline/aws"
  version = "0.21.0"

  account_type    = "master"
  member_accounts = local.member_accounts

  audit_log_bucket_name = local.audit_log_bucket_name

  aws_account_id           = data.aws_caller_identity.current.account_id
  region                          = local.main_region
  support_iam_role_principal_arns = [data.aws_caller_identity.current.arn]

  tags = {
    terraform   = "true"
    customer    = "xxx"
    environment = "prod"
  }

  providers = {
    aws                = aws
    aws.ap-northeast-1 = aws.ap-northeast-1
    aws.ap-northeast-2 = aws.ap-northeast-2
    aws.ap-northeast-3 = aws.ap-northeast-3
    aws.ap-south-1     = aws.ap-south-1
    aws.ap-southeast-1 = aws.ap-southeast-1
    aws.ap-southeast-2 = aws.ap-southeast-2
    aws.ca-central-1   = aws.ca-central-1
    aws.eu-central-1   = aws.eu-central-1
    aws.eu-north-1     = aws.eu-north-1
    aws.eu-west-1      = aws.eu-west-1
    aws.eu-west-2      = aws.eu-west-2
    aws.eu-west-3      = aws.eu-west-3
    aws.sa-east-1      = aws.sa-east-1
    aws.us-east-1      = aws.us-east-1
    aws.us-east-2      = aws.us-east-2
    aws.us-west-1      = aws.us-west-1
    aws.us-west-2      = aws.us-west-2
  }
}

Allow sending VPC flow logs directly S3 instead of CloudWatch

This would be great for cost considerations. See - https://aws.amazon.com/cloudwatch/pricing/

Using S3 is twice as cheap.

Case when bucket is not in master account

Given:

a root/master aws account
a "logs" account
a bunch of other accounts

I'd like to maintain the audit logs bucket in the "logs" account, and have the master and other accounts ship logs there. This seems to be a combination of "external-bucket" and "organization" examples.

Which account should have account_type = master ? The actual master/root account or the logs account?

Simple example fails.

Hi,

Good day.

I get the following error for the simple example:

Error: Error describing organization: AWSOrganizationsNotInUseException: Your account is not a member of an organization.
	status code: 400, request id: 3e449e5a-082f-4c16-99a4-65ef6cdb07d8

  on .terraform/modules/secure-baseline_example_simple/nozaq-terraform-aws-secure-baseline-bb9cc79/bucket.tf line 40, in data "aws_organizations_organization" "org":
  40: data "aws_organizations_organization" "org" {}

In my main.tf:

module "secure-baseline_example_simple" {
  source  = "nozaq/secure-baseline/aws//examples/simple"
  version = "0.16.0"
  access_key = "qwer"
  audit_s3_bucket_name = "zxcv"
  secret_key = "asdf"
}

Regards.

Create Topic Policy for alarm-baseline SNS Topic

Add a topic policy to only allow alarms created in the module to write to the topic.

Feature suggestion: consistency with aws_organizations_account

Problems managing ACL on default VPC

These lines prevent any rules from being defined on the default ACL.

At the same time, by reattaching the ACL with the default subnets, they prevent you from defining custom ACLs on those subnets.

Any ideas how we can work around this?

I think a better solution is to remove the subnet_ids line and add

  lifecycle {
    ignore_changes = ["subnet_ids"]
  }

AWS IAM Check 1.18 Ensure IAM Master and IAM Manager roles are active had been deleted

I see you have also implemented

1.18 - Ensure IAM Master and IAM Manager roles are active (deleted)
on https://raw.githubusercontent.com/nozaq/terraform-aws-secure-baseline/master/modules/iam-baseline/main.tf

This requirement was deleted with -ticket 6371 ( https://workbench.cisecurity.org/tickets/6371 can only be seen with creating free account)

while it does not hurt but it can be deleted.

How to get member accounts object?

What is the recommended way to get the member_accounts input value?

I ask because below would be really simple to get, however, your variable doesn't allow name and arn in.

data "aws_organizations_organization" "main" {}
output "member_accounts" {
  value = data.aws_organizations_organization.main.non_master_accounts
}
/*
Outputs:
member_accounts = [
  {
    "arn" = "arn:aws:organizations::******:account/o-********/**********"
    "email" = "[email protected]"
    "id" = "*********"
    "name" = "testing"
  }
]
*/

Feature suggestion: disable unused Regions

Hi @nozaq

Thanks again for putting me on the right track with my S3 bucket issue.

This TF module really does a nice job at securing an AWS account. It just occurred to me that it might be nice if your users could specify a list of AWS Regions to disable (or, alternatively, a shorter list of AWS Regions that they want to use).

I think you could add such a feature to your IAM submodule, ala the following:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws-enable-disable-regions.html

So, rather than having to enable all the protective measures herein for EVERY region, you could start by disabling any unused Regions, and simplify the process. Just a thought. Thanks again for all your hard work!

Upgrade CIS AWS benchmark to 1.3.0

according to https://www.cisecurity.org/benchmark/amazon_web_services/ 1.3.0 is available.

Allow changing default VPC by passing a VPC arn/id/name

AWS Organization Support

CloudTrail, AWS Config and GuardDuty support aggregating reports/logs from multiple accounts into one central account.
This module should support the configuration both for master accounts and member accounts.

Reference

terraform-provider-aws v3.0.0 breaks aws_cloudwatch_log_group output

Just thought I'd open an issue, as I'm not sure the best way to implement a fix, while remaining backwards compatible with terraform-provider-aws 2.x.

Please see:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-3-upgrade#removal-of-arn-wildcard-suffix

Ultimately, the fix is to update this line:
https://github.com/nozaq/terraform-aws-secure-baseline/blob/master/modules/cloudtrail-baseline/main.tf#L243

To:

cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail_events[0].arn}:*"

If you wish to remain compatible with 2.x, I guess you could do something like

cloud_watch_logs_group_arn = replace("${aws_cloudwatch_log_group.cloudtrail_events[0].arn}:*", ":*:*", ":*")

Link is dead - Check the example (on usage section)

The link to your example is not found.
See the sentence below in your main read me file.
Check the example to understand how

Under usage

https://github.com/nozaq/terraform-aws-secure-baseline/blob/master/examples/root-example/regions.tf

member_accounts is a list, which causes aws_guardduty_member replacements

The member_accounts variable is a list(object), see https://github.com/nozaq/terraform-aws-secure-baseline/blob/master/variables.tf#L23-L30

When the list of member accounts changes, it results in churning of the aws_guardduty_member resources as they are force replaced due to the fact that the order of the items changes.

The way to fix this in tf >= 12 is to use a for_each with a map(object), the keys of the map could be the account_id.

This should be possible to support without breaking changes by preferring member_accounts if it is defined, else using the new map(object) perhaps named member_accounts_map

Bucket.tf code is dependent on aws_organization

The creation of an audit log bucket is currently dependent on an AWS organization.

Right now, if an account is not the start of the OU, it is impossible to create a master account and adding members to them, since said master account needs access to the aws_organization, which is impossible, if it's not at the top of the OU.

This is an issue for accounts already created, and in an already established OU. In addition, the master account would be the one that collects the logs instead of a dedicated 'logs' account, separating it with other access restrictions and permissions such as how AWS Landing Zone does things.

A better set-up would be that the bucket module doesn't make use of the aws_organization_organizations datasource, and using the member_accounts input, leaving free choice as to what accounts to grant access.

Or optionalizing this, since this is the only part of the code that makes use of reading out all the account-IDs related to the organization.

Deprecation Warnings on terraform 0.13

Warning: Interpolation-only expressions are deprecated

  on .terraform/modules/security/bucket.tf line 119, in data "aws_iam_policy_document" "audit_log":
 119:       "${module.audit_log_bucket.this_bucket.arn}",

Terraform 0.11 and earlier required all non-constant expressions to be
provided via interpolation syntax, but this pattern is now deprecated. To
silence this warning, remove the "${ sequence from the start and the }"
sequence from the end of this expression, leaving just the inner expression.

Template interpolation syntax is still used to construct strings from
expressions when the template includes multiple interpolation sequences or a
mixture of literal strings and interpolations. This deprecation applies only
to templates that consist entirely of a single interpolation sequence.

(and 4 more similar warnings elsewhere)
``

TF error on S3 policy

Any clue?

module.secure_baseline.module.config_baseline_ap-southeast-2.aws_config_config_rule.restricted_ports: Creation complete after 4s [id=RestrictedIncomingTraffic]

Error: configuration for module.secure_baseline.data.aws_iam_policy_document.recoder_publish_policy still contains unknown values during apply (this is a bug in Terraform; please report it!)



Error: Error putting S3 policy: InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, PutBucketPolicyInput.Bucket.


  on ../../bucket.tf line 37, in resource "aws_s3_bucket_policy" "audit_log":
  37: resource "aws_s3_bucket_policy" "audit_log" {



Error: InvalidS3BucketNameException: Bucket name should be between 3 and 63 characters long: 
	status code: 400, request id: f7a4bae2-1a88-4948-98f5-0c0e28d93b4a

  on ../../modules/cloudtrail-baseline/main.tf line 158, in resource "aws_cloudtrail" "global":
 158: resource "aws_cloudtrail" "global" {



Error: Creating Delivery Channel failed: NoSuchBucketException: Cannot find a s3 bucket with an empty bucket name.
	status code: 400, request id: 62a2dbac-f351-43ec-b279-e265e0c41f16

  on ../../modules/config-baseline/main.tf line 20, in resource "aws_config_delivery_channel" "bucket":
  20: resource "aws_config_delivery_channel" "bucket" {

...

S3 bucket Authorization Header Malformed

Hi @nozaq

I had commented on closed issue #48; however, I now realize that I should have made it a new issue in the first place.

This issue may (or may not) be related to the the "force destroy" option that you put in place for the audit bucket.

Now when I run the secure-baseline module, everything works except for the bucket-related tasks. I get the following error after running terragrunt apply:

Error: Error creating S3 bucket: AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'us-west-2'
        status code: 400, request id: EF33E2B670A47024, host id: QV0D2p0NuiJ8cuELIyKcJVyu7d19WLO1SNe+IbEBCa8VcVTB1Yxbb9yDGwlj6jEHwljzA6onKmc=

I'm passing in region = "us-east-1" as one of the inputs in my terragrunt.hcl file. These inputs seem to work fine when used as part of the sub-modules like vpc-baseline; for example, the Default VPC gets changed correctly in each region. However, it appears that any sub-module that depends on creating an S3 bucket (i.e., secure-bucket) - about 45 of the 251 actions - does not work. Any ideas?

BadRequestException for log groups and GuardDuty

We have tried enabling this module using the below configuration:

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

module "secure-baseline" {
  source  = "nozaq/secure-baseline/aws"
  version = "0.9.0"

  # insert the 4 required variables here
  audit_log_bucket_name          = "${var.client}.${var.stage}-cloudwatch-logs"
  aws_account_id                 = "${data.aws_caller_identity.current.account_id}"
  region                         = "${data.aws_region.current.name}"
  support_iam_role_principal_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/SomethingSomethingAdministrator"
}

Running terraform apply was unsuccessful.

Below is the error messages:

* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 39236d11-5b8d-11e9-b912-db18f0fda047:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_ap-south-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 394c2a9a-5b8d-11e9-82f0-079f92f291ce:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_us-east-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 3927d9c8-5b8d-11e9-82f0-079f92f291ce:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.guardduty_baseline_us-east-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 388cd2a0-5b8d-11e9-bcba-f9c17b376a5f
* module.secure-baseline.module.guardduty_baseline_ap-southeast-2.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 39326183-5b8d-11e9-8260-13e36b5f3390
* module.secure-baseline.module.guardduty_baseline_ap-northeast-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 3948a815-5b8d-11e9-9ecc-ddb290e7f0c2
* module.secure-baseline.module.vpc_baseline_ap-northeast-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 393fa81a-5b8d-11e9-a0f1-b3dd1ae35edf:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.guardduty_baseline_us-east-2.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 38e26bff-5b8d-11e9-a515-737af496302a
* module.secure-baseline.module.vpc_baseline_us-east-2.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 392282d6-5b8d-11e9-b852-5ff5b1767983:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.audit_log_bucket.aws_s3_bucket.access_log: 1 error(s) occurred:
* aws_s3_bucket.access_log: Error creating S3 bucket: BucketAlreadyOwnedByYou: Your previous request to create the named bucket succeeded and you already own it.
    status code: 409, request id: 8665EC6287ABDA3E, host id: 64W3mdLPTgyjx0YjOcV7yUM1JgZzciz3+QGRMSDRynHJ/KFEB+oDdkWZtHcVxda88ACjs7sJMHY=
* module.secure-baseline.module.guardduty_baseline_us-west-2.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 38f2e738-5b8d-11e9-85e3-dbb00e6dba04
* module.secure-baseline.module.guardduty_baseline_ap-southeast-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 38d06a98-5b8d-11e9-962a-f7841804025e
* module.secure-baseline.module.guardduty_baseline_ap-northeast-2.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 3922aa05-5b8d-11e9-93fe-af52707faa87
* module.secure-baseline.module.guardduty_baseline_eu-central-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 39376a98-5b8d-11e9-af5f-b36cc1cb7a95
* module.secure-baseline.module.guardduty_baseline_ap-south-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 394d3ca8-5b8d-11e9-b7b0-8d305d83bc6b
* module.secure-baseline.module.guardduty_baseline_eu-west-3.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 3943ed87-5b8d-11e9-bb7c-f1886c601912
* module.secure-baseline.module.vpc_baseline_ap-southeast-2.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 393287eb-5b8d-11e9-90e6-bd28cc14ba49:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.aws_iam_role.recorder: 1 error(s) occurred:
* aws_iam_role.recorder: Error creating IAM Role Config-Recorder: EntityAlreadyExists: Role with name Config-Recorder already exists.
    status code: 409, request id: 38b716a2-5b8d-11e9-85bf-f1422f566699
* module.secure-baseline.module.vpc_baseline_sa-east-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 39245743-5b8d-11e9-95f3-a7b2d1ae7ec7:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.guardduty_baseline_eu-west-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 39426730-5b8d-11e9-93fe-af52707faa87
* module.secure-baseline.module.vpc_baseline_us-west-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 3931c51e-5b8d-11e9-ac40-a1deac0117ba:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_us-west-2.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 3925ddf4-5b8d-11e9-96f5-e7fe73a60eee:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_eu-west-2.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 3931501b-5b8d-11e9-b912-db18f0fda047:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_eu-north-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 39231f1b-5b8d-11e9-b852-5ff5b1767983:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_eu-west-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 393fa81b-5b8d-11e9-a0f1-b3dd1ae35edf:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.guardduty_baseline_us-west-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 388e5915-5b8d-11e9-a3cd-274b24e3c410
* module.secure-baseline.module.vpc_baseline_eu-west-3.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 39465e13-5b8d-11e9-82f0-079f92f291ce:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.vpc_baseline_ap-northeast-2.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 39236d23-5b8d-11e9-a00b-3721a4259847:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.guardduty_baseline_ca-central-1.aws_guardduty_detector.default: 1 error(s) occurred:
* aws_guardduty_detector.default: Creating GuardDuty Detector failed: BadRequestException: The request is rejected because a detector already exists for the current account.
    status code: 400, request id: 391b7d57-5b8d-11e9-8f4d-4f105a9996e8
* module.secure-baseline.module.vpc_baseline_eu-central-1.aws_cloudwatch_log_group.default_vpc_flow_logs: 1 error(s) occurred:
* aws_cloudwatch_log_group.default_vpc_flow_logs: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
    status code: 400, request id: 39376a86-5b8d-11e9-a0f1-b3dd1ae35edf:  The CloudWatch Log Group 'default-vpc-flow-logs' already exists.
* module.secure-baseline.module.guardduty_baseline_eu-west-2.aws_guardduty_detector.default: 1 error(s) occurred:

We couldn't figure what happened here. Seek your assistance.

Add in option to enable PCI DSS support

As fate would have it, the arn is in a different format as cis and requires the region. Here is a possible implementation:

resource "aws_securityhub_standards_subscription" "cis" {
  count               = contains(var.subscriptions, "cis") ? 1 : 0
  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
}

resource "aws_securityhub_standards_subscription" "pci-dss" {
  count               = contains(var.subscriptions, "pci-dss") ? 1 : 0
  depends_on    = [aws_securityhub_account.main]
  standards_arn = "arn:aws:securityhub:${local.region}::standards/pci-dss/v/3.2.1"
}

Add aws_securityhub_account in Organization - master account

You can add SecurityHub members in the master account when you pass down the list of members accounts:

This could be a quick PR
you can use for_each with variable of type map instead of count in Terraform version 0.12 and later

resource "aws_securityhub_account" "this" {}

resource "aws_securityhub_member" "this" {
  depends_on = [aws_securityhub_account.this]
  count      = var.enable_securityhub_member ? length(var.securityhub_member) : 0
  account_id = lookup(var.securityhub_member[count.index], "account_id")
  email      = lookup(var.securityhub_member[count.index], "email")
  invite     = lookup(var.securityhub_member[count.index], "invite")
}

variable "securityhub_member" {
  description = "Provides a Security Hub member resource."
  type        = list(map(string))
  default = [
    {
      account_id = ""
      email      = ""
      invite     = false
    }
  ]
}

secure-bucket module should enable aws_s3_bucket_public_access_block

Add aws_s3_bucket_public_access_block resources for S3 buckets created by secure-bucket module.

Allow disabling VPC flow log completely

This would be great for cost considerations. See - aws.amazon.com/cloudwatch/pricing

Disabling VPC flow log fails the plan when target_regions is set

When target_regions = ["us-east-1", "us-west-2"] is set together with vpc_enable_flow_logs = false TF apply fails for all other regions:

Error: Invalid index

  on .terraform/modules/secure-baseline/vpc_baselines.tf line 134, in module "vpc_baseline_ap-southeast-1":
 134:   flow_logs_iam_role_arn      = local.is_cw_logs ? aws_iam_role.flow_logs_publisher[0].arn : null
    |----------------
    | aws_iam_role.flow_logs_publisher is empty tuple

The given key does not identify an element in this collection value.

Is this a setting I am missing or it's a bug?

Ability to use a central s3 bucket for audit logs when using a multi account organization

We could use an option to provide a bucket ARN instead of a name which would enable this module to have multiple accounts send audit logs to a single s3 bucket when in a multiple account organization.

Add User Tags to default ACL and default security group

Currently only name tags are added to those resources. merge the current Name tag with the tags variable.

Region Issue

I have been trying to integrate the module within my project and I keep running into a problem with the regions. I am getting an error for each of the different regions flow logs that read: "aws_flow_log.default_vpc_flow_logs: Error creating Flow Log for (vpc-e5602182), error: InvalidParameter: LogDestination must be in the same region as the API caller."

Any help would be very appreciated!

Individual account Security Hub enabled?

Does Security Hub get enabled after running terraform apply?
I just looked at all my regions and looks like I still have to manually enable it, or am I missing something?

vpc-baseline module tags error.

Hi.

Looking at the modules separately. Came across this when trying to use the vpc-baseline module.

Error: Unsupported block type

  on .terraform/modules/secure-baseline_vpc-baseline/nozaq-terraform-aws-secure-baseline-b6a76d9/modules/vpc-baseline/main.tf line 4, in resource "aws_default_vpc" "default":
   4:   tags {

Blocks of type "tags" are not expected here. Did you mean to define argument
"tags"? If so, use the equals sign to assign it a value.

Regards.
Jarrett

Inconsistent file structure and naming

Maybe this issue is a bit nit-picky. The standard module structure states:
main.tf, variables.tf, outputs.tf. These are the recommended filenames for a minimal module, even if they're empty. main.tf should be the primary entrypoint. For a simple module, this may be where all the resources are created. For a complex module, resource creation may be split into multiple files but any nested module calls should be in the main file.

This repo is calling some modules in the main.tf file, whereas others have specific .tf files (which are not consistently named, ie. analyzer.tf vs config_baselines.tf). IMO it should either have everything in main, or everything in resource-specific files.

Error: Invalid index in module guardduty-baseline

After successfully applying the module, I'm now getting this error on future plans / applies:

Error: Invalid index

on .terraform/modules/global.secure_baseline/nozaq-terraform-aws-secure-baseline-46c9702/modules/guardduty-baseline/outputs.tf line 3, in output "guardduty_detector":
3: value = var.enabled ? aws_guardduty_detector.default[0] : null
|----------------
| aws_guardduty_detector.default is empty tuple

The given key does not identify an element in this collection value.

make: *** [apply] Error 1

Error deleting S3 Bucket

When running terraform destroy using this very cool module, I get the following error:

Error: error deleting S3 Bucket (clienta-us-east-1-audit-logs): BucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket.

Given you've updated to Terraform 0.12, I think (TF newbie here) you could add the force_destroy = true option to all the places you use the aws_s3_bucket resource.

See hashicorp/terraform-provider-aws#208

Provide option to disable autoassign ipv4

Currently autoassign ipv4 is on by default, can an option be given to disable this

Generate documents in pre-commit hook

Enable terraform_docs to automatically generate terraform docs in pre-commit hook.
Blocked until terraform-docs supports HCL2 syntax.

Reference Issues:

SecurityHub support

Activate SecurityHub and setup the CIS benchmark compliance check.

SecurityHub support is being implemented here.

Question about Cloudwatch Alarm

Thx for this great project.
One question regarding Cloudwatch alarms. For example: S3BucketPolicyChanges.

What is the best and fastest way to see WHY an alarm was triggered? In the cloudwatch alarm history I only see the post to the sns topic, but there is no log or something with Cloudtrail in it. Any tips?
Keep up the good work!

Move the modules to separate repositories

Hi! Excellent work putting all of this together!

Currently, the structure of the repository means that if someone wants to use anything they need to use everything or copy-paste the code into a separate module. Maybe you could create an organization and put modules into different repositories? This will allow using only what the person needs, and if it wants to use it all there still can be a repo that holds all of the modules.

Suggestions: Make all iam roles/policies to be optional

I was trying it out and a few things on our account are already managed by other modules, so it will be great to not have more roles and policies that we already have.
For that, I've put a few more variables on the iam-baseline sub-module so we could disable the roles/policies creation.
This doesn't affect the people that are already using the module since the default value is set to create all roles but could help others that will try to use it on an account already in use.

I'll open a PR with the changes to review!

Thanks for the work on that, it's a pretty good module and will help us a lot!

New SecurityHub standards support

There are two new standards in SecurityHub - "PCI DSS" and "AWS Foundational Security Best Practices". It would be nice to add their support to this module.

It would also be good to allow each standard to be enabled / disabled independently using module variables.

Encrypt SNS

Probably a good idea to encrypt the sns using kms_master_key_id = "alias/aws/sns" or the KMS key used for CloudTrail.

Suggestions: Make support_iam_role_principal_arn = optional

Thank you! Great work.
While trying it out, I have another modules that manages my users/groups/iam policies etc... and in that case forcing to create user for support_iam_role_principal_arn doesn't fit really well as I will end up with 2 different modules managing users.

So it will be great if support_iam_role_principal_arn could be an optional feature.
What do you think? if so I could open a PR for it.

Thanks 👍

Suggestion: S3 Bucket Encryption

When using local buckets, they do not have server-side encryption enabled by default.

Allow for non-creation of IAM user-roles

The system I am working on does not need IAM policies as its managed in other ways, is there any way you would consider adding a variable to disable the non-service IAM at top module level?

Error: Creating Delivery Channel failed: InsufficientDeliveryPolicyException: Insufficient delivery policy to s3 bucket

I got the following error when I ran the secure baseline module as master defined in the account type attribute.

Error: Error creating CloudTrail: InsufficientS3BucketPolicyException: Incorrect S3 bucket policy is detected for bucket: audit-logs-XXXX3454-us-west-2

  on .terraform/modules/secure_baseline/terraform-aws-secure-baseline-0.17.0/modules/cloudtrail-baseline/main.tf line 223, in resource "aws_cloudtrail" "global":
 223: resource "aws_cloudtrail" "global" {

What I see in the output is that are trying to create the cloudtrail resource before creating the s3 bucket policy.

1 - Creating cloudtrail resource 
module.secure_baseline.module.cloudtrail_baseline.aws_cloudtrail.global[0]: Creating...

2 - Creating s3 bucket policy

module.secure_baseline.aws_s3_bucket_policy.audit_log[0]: Creating...

3 - Complete policy bucket

module.secure_baseline.aws_s3_bucket_policy.audit_log[0]: Creation comple

Error: missing provider provider.aws.ap-northeast-1

Error: missing provider provider.aws.ap-northeast-1
terraform 12.20

provider "aws" {
version = "=2.47.0"
data "aws_caller_identity" "current" {
}

data "aws_region" "current" {
}

module "secure-baseline" {
source = "nozaq/secure-baseline/aws"
version = "0.17.0"
audit_log_bucket_name = "audit-log-pipelines-cloud-${var.environment}"
aws_account_id = data.aws_caller_identity.current.account_id
region = data.aws_region.current.name
support_iam_role_principal_arns = ["[email protected]"]
target_regions = data.aws_region.current.name

providers = {
aws = aws
aws.ap-northeast-1 = aws.ap-northeast-1
aws.ap-northeast-2 = aws.ap-northeast-2
aws.ap-south-1 = aws.ap-south-1
aws.ap-southeast-1 = aws.ap-southeast-1
aws.ap-southeast-2 = aws.ap-southeast-2
aws.ca-central-1 = aws.ca-central-1
aws.eu-central-1 = aws.eu-central-1
aws.eu-north-1 = aws.eu-north-1
aws.eu-west-1 = aws.eu-west-1
aws.eu-west-2 = aws.eu-west-2
aws.eu-west-3 = aws.eu-west-3
aws.sa-east-1 = aws.sa-east-1
aws.us-east-1 = aws.us-east-1
aws.us-east-2 = aws.us-east-2
aws.us-west-1 = aws.us-west-1
aws.us-west-2 = aws.us-west-2
}
}

Cathing up on re:invent 2019 updates...

Figure out which updates to handle in this module.

IAM Access Analyzer
Detective

https://aws.amazon.com/new/reinvent/?hp=r&awsf.announcements-categories=category-type%23security-id-compliance%7Ccategory-type%23management-governance