malware.tf

resource "aws_iam_role" "malware_scanning" {
  for_each = var.malware_scanning.enabled ? toset(["this"]) : toset([])

  # bucket_name can be up to 63 characters, so use a truncated prefix and let
  # AWS append a unique suffix to stay within the 64-character role name limit.
  name_prefix = substr("${local.bucket_name}-scan-", 0, 38)
  description = "Role for GuardDuty malware protection of bucket ${local.bucket_name}"
  path        = "/service-role/"

  assume_role_policy = jsonencode(yamldecode(templatefile("${path.module}/templates/malware-scan-trust.yaml.tftpl", {
    account   = data.aws_caller_identity.identity.account_id
    partition = data.aws_partition.current.partition
    region    = data.aws_region.current.region
  })))

  tags = var.tags
}

resource "aws_iam_role_policy" "malware_scanning" {
  for_each = var.malware_scanning.enabled ? toset(["this"]) : toset([])

  # bucket_name can be up to 63 characters, so use a truncated prefix and let
  # AWS append a unique suffix to stay within the 64-character role name limit.
  name_prefix = substr("${local.bucket_name}-scan-", 0, 38)
  role        = aws_iam_role.malware_scanning["this"].id

  policy = jsonencode(yamldecode(templatefile("${path.module}/templates/malware-scan-policy.yaml.tftpl", {
    account     = data.aws_caller_identity.identity.account_id
    bucket      = local.bucket_name
    kms_key_arn = local.kms_key_arn
    partition   = data.aws_partition.current.partition
    region      = data.aws_region.current.region
  })))
}

resource "aws_guardduty_malware_protection_plan" "this" {
  for_each = var.malware_scanning.enabled ? toset(["this"]) : toset([])

  role = aws_iam_role.malware_scanning["this"].arn

  protected_resource {
    s3_bucket {
      bucket_name     = aws_s3_bucket.this.id
      object_prefixes = length(var.malware_scanning.object_prefixes) > 0 ? var.malware_scanning.object_prefixes : null
    }
  }

  actions {
    tagging {
      status = var.malware_scanning.tag_objects ? "ENABLED" : "DISABLED"
    }
  }

  tags = var.tags
}