terraform-aws-security/modules/cloudtrail-event-data-store/iam.tf at main · tedilabs/terraform-aws-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
data "aws_caller_identity" "this" {}

locals {
  account_id = data.aws_caller_identity.this.account_id
}


###################################################
# IAM Role for CloudTrail Event Data Store
###################################################

module "role" {
  count = var.import_trail_events_iam_role.enabled ? 1 : 0

  source  = "tedilabs/account/aws//modules/iam-role"
  version = "~> 0.33.0"

  name = coalesce(
    var.import_trail_events_iam_role.name,
    "cloudtrail-event-data-store-${local.metadata.name}",
  )
  path        = var.import_trail_events_iam_role.path
  description = var.import_trail_events_iam_role.description

  trusted_service_policies = [
    {
      services = ["cloudtrail.amazonaws.com"]
    }
  ]
  conditions = [
    {
      key       = "aws:SourceAccount"
      condition = "StringEquals"
      values    = [local.account_id]
    },
    {
      key       = "aws:SourceArn"
      condition = "StringEquals"
      values    = [aws_cloudtrail_event_data_store.this.arn]
    },
  ]

  policies = var.import_trail_events_iam_role.policies
  inline_policies = merge(
    {
      "s3" = one(data.aws_iam_policy_document.s3[*].json)
    },
    var.import_trail_events_iam_role.inline_policies
  )
  permissions_boundary = var.import_trail_events_iam_role.permissions_boundary

  force_detach_policies = true
  resource_group = {
    enabled = false
  }
  module_tags_enabled = false

  tags = merge(
    local.module_tags,
    var.tags,
  )
}


###################################################
# IAM Policy to Import CloudTrail Events
###################################################

locals {
  default_s3_bucket = {
    name       = "you-should-configure-source-s3-buckets-to-import"
    key_prefix = ""
  }
  source_s3_buckets = [
    for bucket in coalescelist(var.import_trail_events_iam_role.source_s3_buckets, [local.default_s3_bucket]) : {
      name       = bucket.name
      key_prefix = trim(bucket.key_prefix, "/")

    }
  ]
}

data "aws_iam_policy_document" "s3" {
  count = var.import_trail_events_iam_role.enabled ? 1 : 0

  statement {
    sid = "AWSCloudTrailImportBucketAccess"

    effect  = "Allow"
    actions = ["s3:ListBucket", "s3:GetBucketAcl"]
    resources = [
      for bucket in local.source_s3_buckets :
      "arn:aws:s3:::${bucket.name}"
    ]
  }

  statement {
    sid = "AWSCloudTrailImportObjectAccess"

    effect  = "Allow"
    actions = ["s3:GetObject"]
    resources = flatten([
      for bucket in local.source_s3_buckets : [
        join("/", compact(["arn:aws:s3:::${bucket.name}", bucket.key_prefix])),
        join("/", compact(["arn:aws:s3:::${bucket.name}", bucket.key_prefix, "*"])),
      ]
    ])
  }
}