Skip to content

Commit 2aafa5f

Browse files
jheison-rodriguezjheison-rodriguez
committed
add code for AWS Config Custom Rules
1 parent 11fd26e commit 2aafa5f

File tree

3 files changed

+41
-71
lines changed

3 files changed

+41
-71
lines changed

‎README.md

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,20 +123,15 @@ module "aws_config_rules_us_west_2" {
123123
| Name | Type |
124124
|------|------|
125125
| [aws_config_config_rule.aws_managed_rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource |
126-
| [aws_config_config_rule.iam_root_access_key_check](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource |
127-
| [aws_config_config_rule.iam_user_mfa_enabled](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource |
128-
| [aws_config_config_rule.required_tags](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource |
129-
| [aws_config_config_rule.root_account_mfa_enabled](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource |
126+
| [aws_config_config_rule.custom_managed_rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource |
130127

131128
## Inputs
132129

133130
| Name | Description | Type | Default | Required |
134131
|------|-------------|------|---------|:--------:|
135132
| <a name="input_aws_managed_rules"></a> [aws\_managed\_rules](#input\_aws\_managed\_rules) | A list of AWS Managed Rules that should be enabled on the account.<br><br>See the following for a list of possible rules to enable:<br>https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html | <pre>map(object({<br> description = string<br> identifier = string<br> input_parameters = any<br> }))</pre> | `{}` | no |
136-
| <a name="input_include_global_resource_rules"></a> [include\_global\_resource\_rules](#input\_include\_global\_resource\_rules) | True/False to add global resource rules to Config. Default is false | `string` | `false` | no |
133+
| <a name="input_custom_managed_rules"></a> [custom\_managed\_rules](#input\_custom\_managed\_rules) | A list of AWS Managed Custom Rules that should be enabled on the account.<br><br>Reference<br>https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html | `map(any)` | `{}` | no |
137134
| <a name="input_input_tags"></a> [input\_tags](#input\_input\_tags) | Map of tags to apply to resources | `map(any)` | <pre>{<br> "Developer": "StratusGrid",<br> "Provisioner": "Terraform"<br>}</pre> | no |
138-
| <a name="input_required_tags"></a> [required\_tags](#input\_required\_tags) | Map of tag keys, and optionally values, that are required. | `map(any)` | `{}` | no |
139-
| <a name="input_required_tags_enabled"></a> [required\_tags\_enabled](#input\_required\_tags\_enabled) | True/False to add RequiredTags to Config. Default is false | `string` | `false` | no |
140135

141136
## Outputs
142137

‎config-rules.tf

Lines changed: 34 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
# ### Global ###
22
# # Root user account config rules
33

4-
# Deprecated in version ??
5-
4+
# Deprecated in version 2.0.0, remove from code in next release
65
# #https://docs.aws.amazon.com/config/latest/developerguide/root-account-mfa-enabled.html
76
# resource "aws_config_config_rule" "root_account_mfa_enabled" {
87
# name = "root-account-mfa-enabled"
@@ -19,7 +18,7 @@
1918
# }
2019

2120

22-
# Deprecated in version ??
21+
# Deprecated in version 2.0.0, remove from code in next release
2322
# #https://docs.aws.amazon.com/config/latest/developerguide/iam-root-access-key-check.html
2423
# resource "aws_config_config_rule" "iam_root_access_key_check" {
2524
# name = "iam-root-access-key-check"
@@ -36,8 +35,7 @@
3635
# }
3736

3837

39-
# Deprecated in version ??
40-
38+
# Deprecated in version 2.0.0, remove from code in next release
4139
# #https://docs.aws.amazon.com/config/latest/developerguide/iam-user-mfa-enabled.html
4240
# resource "aws_config_config_rule" "iam_user_mfa_enabled" {
4341
# name = "iam-user-mfa-enabled"
@@ -53,7 +51,7 @@
5351
# tags = local.common_tags
5452
# }
5553

56-
# Deprecated in version ??
54+
# Deprecated in version 2.0.0, remove from code in next release
5755
# ### Regional Rules ###
5856
# # https://docs.aws.amazon.com/config/latest/developerguide/required-tags.html
5957
# resource "aws_config_config_rule" "required_tags" {
@@ -85,63 +83,45 @@ resource "aws_config_config_rule" "aws_managed_rules" {
8583
}
8684

8785
input_parameters = length(each.value.input_parameters) > 0 ? jsonencode(each.value.input_parameters) : null
88-
}
8986

90-
# # AWS Managed rules could be a combination of Global and Regional rules for list of available rules check
91-
# # https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
92-
# resource "aws_config_config_rule" "custom_managed_rules" {
93-
# for_each = var.custom_managed_rules != null ? var.custom_managed_rules : {}
94-
95-
# name = each.key
96-
# description = each.value.description
87+
tags = local.common_tags
88+
}
9789

98-
# source {
99-
# owner = "CUSTOM_POLICY"
100-
101-
# dynamic "source_detail" {
102-
# for_each = each.value.source_detail
103-
# content {
104-
# maximum_execution_frequency = each.value.message_type == "ScheduledNotification" ? each.value.maximum_execution_frequency : null
105-
# message_type = each.value.message_type
106-
# }
107-
# }
108-
109-
# dynamic "custom_policy_details" {
110-
# for_each = each.value.custom_policy_details
111-
# content {
112-
# enable_debug_log_delivery = each.value.enable_debug_log_delivery
113-
# policy_runtime = each.value.policy_runtime
114-
# policy_text = each.value.policy_text
115-
# }
116-
# }
117-
# }
118-
# }
90+
# AWS Managed rules could be a combination of Global and Regional rules for list of available rules check
91+
# https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
92+
resource "aws_config_config_rule" "custom_managed_rules" {
93+
for_each = var.custom_managed_rules != null ? var.custom_managed_rules : {}
11994

95+
name = each.key
96+
description = each.value.description
12097

121-
resource "aws_config_config_rule" "example" {
122-
name = "example"
98+
scope {
99+
compliance_resource_id = lookup(each.value.scope, "compliance_resource_id", null)
100+
compliance_resource_types = lookup(each.value.scope, "compliance_resource_types", null)
101+
tag_key = lookup(each.value.scope, "tag_key", null)
102+
tag_value = lookup(each.value.scope, "tag_value", null)
103+
}
123104

124105
source {
125106
owner = "CUSTOM_POLICY"
126-
127-
source_detail {
128-
message_type = "ConfigurationItemChangeNotification"
129-
}
130-
131-
custom_policy_details {
132-
policy_runtime = "guard-2.x.x"
133-
policy_text = <<EOF
134-
rule tableisactive when
135-
resourceType == "AWS::DynamoDB::Table" {
136-
configuration.tableStatus == ['ACTIVE']
107+
dynamic "source_detail" {
108+
for_each = each.value.source.source_detail != null ? [each.value.source.source_detail] : []
109+
content {
110+
maximum_execution_frequency = source_detail.value.message_type == "ScheduledNotification" ? source_detail.value.maximum_execution_frequency : null
111+
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule#message_type
112+
message_type = source_detail.value.message_type
137113
}
114+
}
138115

139-
rule checkcompliance when
140-
resourceType == "AWS::DynamoDB::Table"
141-
tableisactive {
142-
supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus == "ENABLED"
116+
dynamic "custom_policy_details" {
117+
for_each = each.value.source.custom_policy_details != null ? [each.value.source.custom_policy_details] : []
118+
content {
119+
enable_debug_log_delivery = lookup(custom_policy_details.value, "enable_debug_log_delivery", null)
120+
policy_runtime = custom_policy_details.value.policy_runtime
121+
policy_text = custom_policy_details.value.policy_text
143122
}
144-
EOF
145123
}
146124
}
147-
}
125+
126+
tags = local.common_tags
127+
}

‎inputs.tf

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,29 +12,27 @@
1212
# default = ""
1313
# }
1414

15-
# Deprecated in version ??
16-
15+
# Deprecated in version 2.0.0, remove from code in next release
1716
# variable "include_global_resource_rules" {
1817
# description = "True/False to add global resource rules to Config. Default is false"
1918
# type = string
2019
# default = false
2120
# }
2221

23-
# Deprecated in version ??
22+
# Deprecated in version 2.0.0, remove from code in next release
2423
# variable "required_tags_enabled" {
2524
# description = "True/False to add RequiredTags to Config. Default is false"
2625
# type = string
2726
# default = false
2827
# }
2928

30-
# Deprecated in version ??
29+
# Deprecated in version 2.0.0, remove from code in next release
3130
# variable "required_tags" {
3231
# description = "Map of tag keys, and optionally values, that are required."
3332
# type = map(any)
3433
# default = {}
3534
# }
3635

37-
# Deprecated in version ??
3836
variable "input_tags" {
3937
description = "Map of tags to apply to resources"
4038
type = map(any)
@@ -66,9 +64,6 @@ variable "custom_managed_rules" {
6664
Reference
6765
https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html
6866
DOC
69-
type = map(object({
70-
description = string
71-
72-
}))
73-
default = {}
67+
type = map(any)
68+
default = {}
7469
}

0 commit comments

Comments
 (0)