docs: Added documentation for malware protection.

Author: jamesiarmes

malware.tf

@@ -1,10 +1,10 @@
 resource "aws_iam_role" "malware" {
   for_each = var.enable_malware_protection ? toset(["this"]) : toset([])
 
-  name = "${local.bucket_name}-malware"
+  name        = "${local.bucket_name}-malware"
   description = "Role for malware protection plan for S3 bucket ${local.bucket_name}"
-  path = "/service-role/"
-  tags = local.tags
+  path        = "/service-role/"
+  tags        = local.tags
 
   assume_role_policy = jsonencode(yamldecode(templatefile("${path.module}/templates/malware-trust-policy.yaml.tftpl", {
     account : data.aws_caller_identity.identity.account_id

outputs.tf

@@ -20,3 +20,11 @@ output "kms_key_arn" {
   description = "ARN of the KMS key used for bucket encryption."
   value       = local.kms_key_arn
 }
+
+output "malware_protection_plan_arn" {
+  description = <<-EOT
+    ARN of the GuardDuty malware protection plan, if malware protection is
+    enabled.
+    EOT
+  value       = var.enable_malware_protection ? aws_guardduty_malware_protection_plan.this["this"].arn : null
+}