Skip to content

Commit 97a1098

Browse files
willfarrellwillfarrell
committed
feat: add in macie baseline
Closes: nozaq#208
1 parent 51d4629 commit 97a1098

File tree

7 files changed

+453
-0
lines changed

7 files changed

+453
-0
lines changed

‎macie_baselines.tf

+298
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,298 @@
1+
# --------------------------------------------------------------------------------------------------
2+
# Macie Baseline
3+
# Needs to be set up in each region.
4+
# This is an extra configuration which is not included in CIS benchmark.
5+
# --------------------------------------------------------------------------------------------------
6+
locals {
7+
macie_master_account_id = var.master_account_id
8+
macie_member_accounts = var.member_accounts
9+
}
10+
11+
module "macie_baseline_ap-northeast-1" {
12+
source = "./modules/macie-baseline"
13+
14+
providers = {
15+
aws = aws.ap-northeast-1
16+
}
17+
18+
enabled = contains(var.target_regions, "ap-northeast-1") && var.macie_enabled
19+
disable_email_notification = var.macie_disable_email_notification
20+
finding_publishing_frequency = var.macie_finding_publishing_frequency
21+
invitation_message = var.macie_invitation_message
22+
master_account_id = local.macie_master_account_id
23+
member_accounts = local.macie_member_accounts
24+
25+
tags = var.tags
26+
}
27+
28+
module "macie_baseline_ap-northeast-2" {
29+
source = "./modules/macie-baseline"
30+
31+
providers = {
32+
aws = aws.ap-northeast-2
33+
}
34+
35+
enabled = contains(var.target_regions, "ap-northeast-2") && var.macie_enabled
36+
disable_email_notification = var.macie_disable_email_notification
37+
finding_publishing_frequency = var.macie_finding_publishing_frequency
38+
invitation_message = var.macie_invitation_message
39+
master_account_id = local.macie_master_account_id
40+
member_accounts = local.macie_member_accounts
41+
42+
tags = var.tags
43+
}
44+
45+
module "macie_baseline_ap-northeast-3" {
46+
source = "./modules/macie-baseline"
47+
48+
providers = {
49+
aws = aws.ap-northeast-3
50+
}
51+
52+
enabled = contains(var.target_regions, "ap-northeast-3") && var.macie_enabled
53+
disable_email_notification = var.macie_disable_email_notification
54+
finding_publishing_frequency = var.macie_finding_publishing_frequency
55+
invitation_message = var.macie_invitation_message
56+
master_account_id = local.macie_master_account_id
57+
member_accounts = local.macie_member_accounts
58+
59+
tags = var.tags
60+
}
61+
62+
module "macie_baseline_ap-south-1" {
63+
source = "./modules/macie-baseline"
64+
65+
providers = {
66+
aws = aws.ap-south-1
67+
}
68+
69+
enabled = contains(var.target_regions, "ap-south-1") && var.macie_enabled
70+
disable_email_notification = var.macie_disable_email_notification
71+
finding_publishing_frequency = var.macie_finding_publishing_frequency
72+
invitation_message = var.macie_invitation_message
73+
master_account_id = local.macie_master_account_id
74+
member_accounts = local.macie_member_accounts
75+
76+
tags = var.tags
77+
}
78+
79+
module "macie_baseline_ap-southeast-1" {
80+
source = "./modules/macie-baseline"
81+
82+
providers = {
83+
aws = aws.ap-southeast-1
84+
}
85+
86+
enabled = contains(var.target_regions, "ap-southeast-1") && var.macie_enabled
87+
disable_email_notification = var.macie_disable_email_notification
88+
finding_publishing_frequency = var.macie_finding_publishing_frequency
89+
invitation_message = var.macie_invitation_message
90+
master_account_id = local.macie_master_account_id
91+
member_accounts = local.macie_member_accounts
92+
93+
tags = var.tags
94+
}
95+
96+
module "macie_baseline_ap-southeast-2" {
97+
source = "./modules/macie-baseline"
98+
99+
providers = {
100+
aws = aws.ap-southeast-2
101+
}
102+
103+
enabled = contains(var.target_regions, "ap-southeast-2") && var.macie_enabled
104+
disable_email_notification = var.macie_disable_email_notification
105+
finding_publishing_frequency = var.macie_finding_publishing_frequency
106+
invitation_message = var.macie_invitation_message
107+
master_account_id = local.macie_master_account_id
108+
member_accounts = local.macie_member_accounts
109+
110+
tags = var.tags
111+
}
112+
113+
module "macie_baseline_ca-central-1" {
114+
source = "./modules/macie-baseline"
115+
116+
providers = {
117+
aws = aws.ca-central-1
118+
}
119+
120+
enabled = contains(var.target_regions, "ca-central-1") && var.macie_enabled
121+
disable_email_notification = var.macie_disable_email_notification
122+
finding_publishing_frequency = var.macie_finding_publishing_frequency
123+
invitation_message = var.macie_invitation_message
124+
master_account_id = local.macie_master_account_id
125+
member_accounts = local.macie_member_accounts
126+
127+
tags = var.tags
128+
}
129+
130+
module "macie_baseline_eu-central-1" {
131+
source = "./modules/macie-baseline"
132+
133+
providers = {
134+
aws = aws.eu-central-1
135+
}
136+
137+
enabled = contains(var.target_regions, "eu-central-1") && var.macie_enabled
138+
disable_email_notification = var.macie_disable_email_notification
139+
finding_publishing_frequency = var.macie_finding_publishing_frequency
140+
invitation_message = var.macie_invitation_message
141+
master_account_id = local.macie_master_account_id
142+
member_accounts = local.macie_member_accounts
143+
144+
tags = var.tags
145+
}
146+
147+
module "macie_baseline_eu-north-1" {
148+
source = "./modules/macie-baseline"
149+
150+
providers = {
151+
aws = aws.eu-north-1
152+
}
153+
154+
enabled = contains(var.target_regions, "eu-north-1") && var.macie_enabled
155+
disable_email_notification = var.macie_disable_email_notification
156+
finding_publishing_frequency = var.macie_finding_publishing_frequency
157+
invitation_message = var.macie_invitation_message
158+
master_account_id = local.macie_master_account_id
159+
member_accounts = local.macie_member_accounts
160+
161+
tags = var.tags
162+
}
163+
164+
module "macie_baseline_eu-west-1" {
165+
source = "./modules/macie-baseline"
166+
167+
providers = {
168+
aws = aws.eu-west-1
169+
}
170+
171+
enabled = contains(var.target_regions, "eu-west-1") && var.macie_enabled
172+
disable_email_notification = var.macie_disable_email_notification
173+
finding_publishing_frequency = var.macie_finding_publishing_frequency
174+
invitation_message = var.macie_invitation_message
175+
master_account_id = local.macie_master_account_id
176+
member_accounts = local.macie_member_accounts
177+
178+
tags = var.tags
179+
}
180+
181+
module "macie_baseline_eu-west-2" {
182+
source = "./modules/macie-baseline"
183+
184+
providers = {
185+
aws = aws.eu-west-2
186+
}
187+
188+
enabled = contains(var.target_regions, "eu-west-2") && var.macie_enabled
189+
disable_email_notification = var.macie_disable_email_notification
190+
finding_publishing_frequency = var.macie_finding_publishing_frequency
191+
invitation_message = var.macie_invitation_message
192+
master_account_id = local.macie_master_account_id
193+
member_accounts = local.macie_member_accounts
194+
195+
tags = var.tags
196+
}
197+
198+
module "macie_baseline_eu-west-3" {
199+
source = "./modules/macie-baseline"
200+
201+
providers = {
202+
aws = aws.eu-west-3
203+
}
204+
205+
enabled = contains(var.target_regions, "eu-west-3") && var.macie_enabled
206+
disable_email_notification = var.macie_disable_email_notification
207+
finding_publishing_frequency = var.macie_finding_publishing_frequency
208+
invitation_message = var.macie_invitation_message
209+
master_account_id = local.macie_master_account_id
210+
member_accounts = local.macie_member_accounts
211+
212+
tags = var.tags
213+
}
214+
215+
module "macie_baseline_sa-east-1" {
216+
source = "./modules/macie-baseline"
217+
218+
providers = {
219+
aws = aws.sa-east-1
220+
}
221+
222+
enabled = contains(var.target_regions, "sa-east-1") && var.macie_enabled
223+
disable_email_notification = var.macie_disable_email_notification
224+
finding_publishing_frequency = var.macie_finding_publishing_frequency
225+
invitation_message = var.macie_invitation_message
226+
master_account_id = local.macie_master_account_id
227+
member_accounts = local.macie_member_accounts
228+
229+
tags = var.tags
230+
}
231+
232+
module "macie_baseline_us-east-1" {
233+
source = "./modules/macie-baseline"
234+
235+
providers = {
236+
aws = aws.us-east-1
237+
}
238+
239+
enabled = contains(var.target_regions, "us-east-1") && var.macie_enabled
240+
disable_email_notification = var.macie_disable_email_notification
241+
finding_publishing_frequency = var.macie_finding_publishing_frequency
242+
invitation_message = var.macie_invitation_message
243+
master_account_id = local.macie_master_account_id
244+
member_accounts = local.macie_member_accounts
245+
246+
tags = var.tags
247+
}
248+
249+
module "macie_baseline_us-east-2" {
250+
source = "./modules/macie-baseline"
251+
252+
providers = {
253+
aws = aws.us-east-2
254+
}
255+
256+
enabled = contains(var.target_regions, "us-east-2") && var.macie_enabled
257+
disable_email_notification = var.macie_disable_email_notification
258+
finding_publishing_frequency = var.macie_finding_publishing_frequency
259+
invitation_message = var.macie_invitation_message
260+
master_account_id = local.macie_master_account_id
261+
member_accounts = local.macie_member_accounts
262+
263+
tags = var.tags
264+
}
265+
266+
module "macie_baseline_us-west-1" {
267+
source = "./modules/macie-baseline"
268+
269+
providers = {
270+
aws = aws.us-west-1
271+
}
272+
273+
enabled = contains(var.target_regions, "us-west-1") && var.macie_enabled
274+
disable_email_notification = var.macie_disable_email_notification
275+
finding_publishing_frequency = var.macie_finding_publishing_frequency
276+
invitation_message = var.macie_invitation_message
277+
master_account_id = local.macie_master_account_id
278+
member_accounts = local.macie_member_accounts
279+
280+
tags = var.tags
281+
}
282+
283+
module "macie_baseline_us-west-2" {
284+
source = "./modules/macie-baseline"
285+
286+
providers = {
287+
aws = aws.us-west-2
288+
}
289+
290+
enabled = contains(var.target_regions, "us-west-2") && var.macie_enabled
291+
disable_email_notification = var.macie_disable_email_notification
292+
finding_publishing_frequency = var.macie_finding_publishing_frequency
293+
invitation_message = var.macie_invitation_message
294+
master_account_id = local.macie_master_account_id
295+
member_accounts = local.macie_member_accounts
296+
297+
tags = var.tags
298+
}

‎modules/macie-baseline/README.md

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# macie-baseline
2+
3+
Enable Macie in all regions.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Requirements
7+
8+
| Name | Version |
9+
|------|---------|
10+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
11+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.0.0 |
12+
13+
## Providers
14+
15+
| Name | Version |
16+
|------|---------|
17+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0.0 |
18+
19+
## Modules
20+
21+
No modules.
22+
23+
## Resources
24+
25+
| Name | Type |
26+
|------|------|
27+
| [aws_macie2_account.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/macie2_account) | resource |
28+
| [aws_macie2_invitation_accepter.master](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/macie2_invitation_accepter) | resource |
29+
| [aws_macie2_member.members](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/macie2_member) | resource |
30+
31+
## Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
|------|-------------|------|---------|:--------:|
35+
| <a name="input_disable_email_notification"></a> [disable\_email\_notification](#input\_disable\_email\_notification) | Boolean whether an email notification is sent to the accounts. | `bool` | `false` | no |
36+
| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
37+
| <a name="input_finding_publishing_frequency"></a> [finding\_publishing\_frequency](#input\_finding\_publishing\_frequency) | Specifies the frequency of notifications sent for subsequent finding occurrences. | `string` | `"SIX_HOURS"` | no |
38+
| <a name="input_invitation_message"></a> [invitation\_message](#input\_invitation\_message) | Message for invitation. | `string` | `"This is an automatic invitation message from guardduty-baseline module."` | no |
39+
| <a name="input_master_account_id"></a> [master\_account\_id](#input\_master\_account\_id) | AWS account ID for master account. | `string` | `""` | no |
40+
| <a name="input_member_accounts"></a> [member\_accounts](#input\_member\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts. | <pre>list(object({<br> account_id = string<br> email = string<br> }))</pre> | `[]` | no |
41+
| <a name="input_tags"></a> [tags](#input\_tags) | Specifies object tags key and value. This applies to all resources created by this module. | `map` | <pre>{<br> "Terraform": true<br>}</pre> | no |
42+
43+
## Outputs
44+
45+
| Name | Description |
46+
|------|-------------|
47+
| <a name="output_macie_account"></a> [macie\_account](#output\_macie\_account) | Macie Account |
48+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/macie-baseline/main.tf

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# --------------------------------------------------------------------------------------------------
2+
# Enables GuardDuty.
3+
# --------------------------------------------------------------------------------------------------
4+
5+
resource "aws_macie2_account" "default" {
6+
count = var.enabled ? 1 : 0
7+
8+
status = "ENABLED"
9+
finding_publishing_frequency = var.finding_publishing_frequency
10+
11+
tags = var.tags
12+
}
13+
14+
resource "aws_macie2_member" "members" {
15+
count = var.enabled ? length(var.member_accounts) : 0
16+
17+
status = "ENABLED"
18+
invite = true
19+
20+
account_id = var.member_accounts[count.index].account_id
21+
invitation_disable_email_notification = var.disable_email_notification
22+
email = var.member_accounts[count.index].email
23+
invitation_message = var.invitation_message
24+
}
25+
26+
resource "aws_macie2_invitation_accepter" "master" {
27+
count = var.enabled && var.master_account_id != "" ? 1 : 0
28+
29+
administrator_account_id = var.master_account_id
30+
}

‎modules/macie-baseline/outputs.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "aws_macie2_account" {
2+
description = "Macie Account"
3+
value = var.enabled ? aws_macie2_account.default[0] : null
4+
}

0 commit comments

Comments
 (0)