Name		Name	Last commit message	Last commit date
parent directory ..
README.md		README.md
iam.tf		iam.tf
main.tf		main.tf
outputs.tf		outputs.tf
resource-group.tf		resource-group.tf
variables.tf		variables.tf
versions.tf		versions.tf

README.md

cloudtrail-event-data-store

This module creates following resources.

aws_cloudtrail_event_data_store
aws_iam_role (optional)
aws_iam_role_policy (optional)
aws_iam_role_policy_attachment (optional)

Requirements

Name	Version
terraform	>= 1.12
aws	>= 6.12

Providers

Name	Version
aws	6.33.0

Modules

Name	Source	Version
resource_group	tedilabs/misc/aws//modules/resource-group	~> 0.12.0
role	tedilabs/account/aws//modules/iam-role	~> 0.33.0

Resources

Name	Type
aws_cloudtrail_event_data_store.this	resource
aws_caller_identity.this	data source
aws_iam_policy_document.s3	data source

Inputs

Name	Description	Type	Default	Required
management_event_selector	(Optional) A configuration of management event selector to use to select the events for the event data store. Only used if `event_type` is `CLOUDTRAIL_EVENTS`. `management_event_selector` block as defined below. (Optional) `enabled` - Whether to capture management events. Defaults to `false`. (Optional) `scope` - The type of events to log. Valid values are `ALL`, `READ` and `WRITE`. Defaults to `ALL`. (Optional) `exclude_event_sources` - A set of event sources to exclude. Valid values are `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `management_event_selector.enabled` must be set to true to allow this.	object({ enabled = optional(bool, false) scope = optional(string, "ALL") exclude_event_sources = optional(set(string), []) })	n/a	yes
name	(Required) The name of the event data store.	`string`	n/a	yes
billing_mode	(Optional) The billing mode for the event data store. Valid values are `EXTENDABLE_RETENTION_PRICING` and `FIXED_RETENTION_PRICING`. Defaults to `EXTENDABLE_RETENTION_PRICING`.	`string`	`"EXTENDABLE_RETENTION_PRICING"`	no
data_event_selectors	(Optional) A configuration of event selectors to use to select the data events for the event data store. Each item of `data_event_selectors` block as defined below. (Optional) `name` - A name of the advanced event selector. (Optional) `resource_type` - A resource type to log data events to log. Valid values are one of the following: - `AWS::DynamoDB::Table` - `AWS::Lambda::Function` - `AWS::S3::Object` - `AWS::AppConfig::Configuration` - `AWS::B2BI::Transformer` - `AWS::Bedrock::AgentAlias` - `AWS::Bedrock::KnowledgeBase` - `AWS::Cassandra::Table` - `AWS::CloudFront::KeyValueStore` - `AWS::CloudTrail::Channel` - `AWS::CodeWhisperer::Customization` - `AWS::CodeWhisperer::Profile` - `AWS::Cognito::IdentityPool` - `AWS::DynamoDB::Stream` - `AWS::EC2::Snapshot` - `AWS::EMRWAL::Workspace` - `AWS::FinSpace::Environment` - `AWS::Glue::Table` - `AWS::GreengrassV2::ComponentVersion` - `AWS::GreengrassV2::Deployment` - `AWS::GuardDuty::Detector` - `AWS::IoT::Certificate` - `AWS::IoT::Thing` - `AWS::IoTSiteWise::Asset` - `AWS::IoTSiteWise::TimeSeries` - `AWS::IoTTwinMaker::Entity` - `AWS::IoTTwinMaker::Workspace` - `AWS::KendraRanking::ExecutionPlan` - `AWS::KinesisVideo::Stream` - `AWS::ManagedBlockchain::Network` - `AWS::ManagedBlockchain::Node` - `AWS::MedicalImaging::Datastore` - `AWS::NeptuneGraph::Graph` - `AWS::PCAConnectorAD::Connector` - `AWS::QBusiness::Application` - `AWS::QBusiness::DataSource` - `AWS::QBusiness::Index` - `AWS::QBusiness::WebExperience` - `AWS::RDS::DBCluster` - `AWS::S3::AccessPoint` - `AWS::S3ObjectLambda::AccessPoint` - `AWS::S3Outposts::Object` - `AWS::SageMaker::Endpoint` - `AWS::SageMaker::ExperimentTrialComponent` - `AWS::SageMaker::FeatureGroup` - `AWS::ServiceDiscovery::Namespace` - `AWS::ServiceDiscovery::Service` - `AWS::SCN::Instance` - `AWS::SNS::PlatformEndpoint` - `AWS::SNS::Topic` - `AWS::SWF::Domain` - `AWS::SQS::Queue` - `AWS::SSMMessages::ControlChannel` - `AWS::ThinClient::Device` - `AWS::ThinClient::Environment` - `AWS::Timestream::Database` - `AWS::Timestream::Table` - `AWS::VerifiedPermissions::PolicyStore` (Optional) `scope` - The type of events to log. Valid values are `ALL`, `READ` and `WRITE`. Defaults to `WRITE`. (Optional) `conditions` - A configuration of field conditions to filter events by the ARN of resource and the event name. Each item of `conditions` as defined below. (Required) `field` - A field to compare by the field condition. Valid values are `eventName`, `eventSource`, `eventType`, `resources.ARN`, `sessionCredentialFromConsole` and `userIdentity.arn`. (Required) `operator` - An operator of the field condition. Valid values are `equals`, `not_equals`, `starts_with`, `not_starts_with`, `ends_with`, `not_ends_with`. (Required) `values` - A set of values of the field condition to compare.	list(object({ name = optional(string) resource_type = string scope = optional(string, "WRITE") conditions = optional(list(object({ field = string operator = string values = set(string) })), []) }))	`[]`	no
enabled	(Optional) Whether to enable ingesting new events into the event data store. If set to `false`, ingestion is suspended while maintaining the ability to query existing events. If set to `true`, ingestion is active. Defaults to `true`.	`bool`	`true`	no
encryption	(Optional) A configuration to encrypt the events delivered by CloudTrail. By default, the event data store is encrypted with a KMS key that AWS owns and manages.`encryption` as defined below. (Optional) `kms_key` - The ID of AWS KMS key to use to encrypt the events delivered by CloudtTrail. The value can be an alias name prefixed by 'alias/', a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.	object({ kms_key = optional(string) })	`{}`	no
event_type	(Required) A type of event to be collected by the event data store. Valid values are `CLOUDTRAIL_EVENTS`, `CONFIG_CONFIGURATION_ITEMS`. Defaults to `CLOUDTRAIL_EVENTS`.	`string`	`"CLOUDTRAIL_EVENTS"`	no
import_trail_events_iam_role	(Optional) A configuration of IAM Role for importing CloudTrail events from S3 Bucket. `import_trail_events_iam_role` as defined below. (Optional) `enabled` - Indicates whether you want to create IAM Role to import trail events. Defaults to `true`. (Optional) `name` - The name of the iam role. Defaults to `cloudtrail-event-data-store-${name}`. (Optional) `path` - The path of the iam role. Defaults to `/`. (Optional) `description` - The description of the iam role. (Optional) `policies` - A list of IAM policy ARNs to attach to the iam role. Defaults to `[]`. (Optional) `inline_policies` - A Map of inline IAM policies to attach to the iam role. (`name` => `policy`). (Optional) `permissions_boundary` - The ARN of the IAM policy to use as permissions boundary for the iam role. (Optional) `source_s3_buckets` - A list of source S3 buckets to import events from. Each item of `source_s3_buckets` as defined below. (Required) `name` - A name of source S3 bucket. (Optional) `key_prefix` - A key prefix of source S3 bucket.	object({ enabled = optional(bool, true) name = optional(string) path = optional(string, "/") description = optional(string, "Managed by Terraform.") policies = optional(list(string), []) inline_policies = optional(map(string), {}) permissions_boundary = optional(string) source_s3_buckets = optional(list(object({ name = string key_prefix = optional(string, "/") })), []) })	`{}`	no
level	(Optional) The level of the event data store to decide whether the event data store collects events logged for an organization in AWS Organizations. Can be created in the management account or delegated administrator account. Valid values are `ACCOUNT` and `ORGANIZATION`. Defaults to `ACCOUNT`.	`string`	`"ACCOUNT"`	no
module_tags_enabled	(Optional) Whether to create AWS Resource Tags for the module informations.	`bool`	`true`	no
region	(Optional) The region in which to create the module resources. If not provided, the module resources will be created in the provider's configured region.	`string`	`null`	no
resource_group	(Optional) A configurations of Resource Group for this module. `resource_group` as defined below. (Optional) `enabled` - Whether to create Resource Group to find and group AWS resources which are created by this module. Defaults to `true`. (Optional) `name` - The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. If not provided, a name will be generated using the module name and instance name. (Optional) `description` - The description of Resource Group. Defaults to `Managed by Terraform.`.	object({ enabled = optional(bool, true) name = optional(string, "") description = optional(string, "Managed by Terraform.") })	`{}`	no
retention_in_days	(Optional) The retention period of the event data store, in days. You can set a retention period of up to 2557 days. Defaults to `2555` days (7 years).	`number`	`2555`	no
scope	(Optional) The scope of the event data store to decide whether the event data store includes events from all regions, or only from the region in which the event data store is created. Supported values are `REGIONAL` or `ALL`. Defaults to `ALL`.	`string`	`"ALL"`	no
tags	(Optional) A map of tags to add to all resources.	`map(string)`	`{}`	no
termination_protection_enabled	(Optional) Whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Defaults to `true`.	`bool`	`true`	no

Outputs

Name	Description
arn	The Amazon Resource Name (ARN) of the event data store.
billing_mode	The billing mode for the event data store.
data_event_selectors	The event selectors to use to select the data events for the event data store.
enabled	Whether the event data store is enabled.
encryption	The configuration for the encryption of the event data store.
event_type	The type of event to be collected by the event data store.
id	The ID of the event data store.
import_trail_events_iam_role	A configuration of IAM Role for importing CloudTrail events from S3 Bucket.
level	The level of the event data store to decide whether the event data store collects events logged for an organization in AWS Organizations.
management_event_selector	The event selector to use to select the management events for the event data store.
name	The name of the event data store.
region	The AWS region this module resources resides in.
resource_group	The resource group created to manage resources in this module.
retention_in_days	The retention period of the event data store, in days.
scope	The scope of the event data store to decide whether the event data store includes events from all regions, or only from the region in which the event data store is created.
termination_protection_enabled	Whether termination protection is enabled for the event data store.