rhythmictech/terraform-aws-cloudtrail-logging

Configure CloudTrail logging to CloudWatch Logs and S3

terraform-aws-cloudtrail-logging

Configure CloudTrail logging to CloudWatch Logs and S3. When used with CloudTrail Bucket module, this properly configures CloudTrail logging with a KMS CMK as required by CIS.

Logs can easily be centralized to a central security logging account by creating a bucket in a single account and referencing the bucket and KMS key.

Usage

module "cloudtrail-logging" {
  source            = "git::https://github.com/rhythmictech/terraform-cloudtrail-logging"
  region            = var.region
  cloudtrail_bucket = module.cloudtrail-bucket.bucket_name
  kms_key_id        = module.cloudtrail-bucket.kms_key_id
}

Requirements

Name	Version
terraform	>= 0.12.20

Providers

Name	Version
aws	n/a

Inputs

Name	Description	Type	Default	Required
cloudtrail_bucket	Name of bucket for CloudTrail logs	string	n/a	yes
kms_key_id	KMS key ARN to use for encrypting CloudTrail logs	string	n/a	yes
region	Region that CloudWatch logging and the S3 bucket will live in	string	n/a	yes
cloudtrail_name	Name for the CloudTrail	string	"cloudtrail-all"	no
iam_path	Path under which to put the IAM role. Should begin and end with a '/'.	string	"/"	no
lambda_functions	Lambda functions to log. Specify ["arn:aws:lambda"] for all, or [ ] for none.	list	[]	no
log_group_name	Name for CloudTrail log group	string	"cloudtrail2cwl"	no
retention_in_days	How long should CloudTrail logs be retained in CloudWatch (does not affect S3 storage). Set to -1 for indefinite storage.	number	7	no
s3_object_level_buckets	ARNs of buckets for which to enable object level logging. Specify ["arn:aws:s3:::"] for all, or [ ] for none. If listing ARNs, make sure to end each one with a /.	list	[]	no
tags	Mapping of any extra tags you want added to resources	map(string)	{}	no

Outputs

Name	Description
cloudwatch_loggroup_arn	The arn of the CloudWatch log group
cloudwatch_loggroup_name	The name of the CloudWatch log group

Related Projects

• CloudTrail Bucket module

terraform-aws-cloudtrail-logging's Issues

[BUG] doesn't support aws provider v3

Describe the bug
The AWS provider v3 doesn't add *, see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-3-upgrade#resource-aws_cloudwatch_log_group

To Reproduce

>  tf version                                                                                                                                                                                                             
Terraform v0.12.24
+ provider.aws v3.0.0
+ provider.errorcheck v2.0.3

# maint.tf
module "cloudtrail_logging" {
  source            = "rhythmictech/cloudtrail-logging/aws"
  version           = "1.1.0"
  region            = var.region
  cloudtrail_bucket = module.cloudtrail_bucket.s3_bucket_name
  kms_key_id        = module.cloudtrail_bucket.kms_key_id
}