You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Removed an empty file, and added a `.gitignore` file to not track artifacts of running `terraform init/plan/apply`
* Ran `terraform 0.12-compatibility` to do a basic 0.11->0.12 conversion.
* Put proper years in license
* Changed input variable structure. This allows for cleaner extension of config if we decide to cover more cloud providers in the future.
* Removed commented out old parameters. Added comments.
* Updated README to reflect new input variable names/structure. Renamed one varable back to its original name. Deleted an obsolete screenshot from the documentation/README.
* Fix a typo in the README and a typo in the variable definition
* Use proper 0.12 syntax
* Fix variable types to string
* Fix more 0.12 syntax issues
* Restructured configuration due to limitations in terraform variable definition syntax.
See: hashicorp/terraform#19898
* Fix a place I didn't correctly rename a variable reference
* Updated code comments and README with correct variable information, and a few typo fixes along the way.
* Add dependency documention for required Terraform providers.
* Fix some docs, and add the defaults for the optional settings
* Remove largely unneeded variable. This also aligns the terraform module more closely to the CloudFormation template.
Setup Threat Stack <-> Control Plane Monitoring integration module
3
3
4
-
This module provides the ability to setup Threat Stack integration via Terraform. This module will setup the following:
4
+
This module provides the ability to define the Threat Stack integration infrastructure via Terraform. Currently only AWS Cloudtrail is supported, and it automates the [AWS Manual Integration Setup](https://threatstack.zendesk.com/hc/en-us/articles/206512364-AWS-Manual-Integration-Setup)
5
+
6
+
This module will create and manage the following:
5
7
6
8
* AWS CloudTrail
7
9
* multi-region trail
@@ -13,61 +15,177 @@ This module provides the ability to setup Threat Stack integration via Terraform
13
15
* AWS SQS queue Threat Stack will check for events
14
16
* Cross account IAM role for Threat Stack
15
17
18
+
## Dependencies
19
+
20
+
This Terraform module currently depends on the following providers as dependencies:
21
+
22
+
*`template`~> 2.1
23
+
*`aws`~> 2.0
16
24
17
25
## Usage
18
-
To use this module you need to create a Terraform configuration that utilizes this module. A basic example configuration would look as follows (Be sure to adjust the git ref in the source value appropriately):
26
+
> **This version of the module is compatible with Terraform 0.12+.** Terraform 0.11 and earlier are not supported, and this module will not work. For a pre-0.12-compatible version of this module, see [v1.0.0 of this module](https://github.com/threatstack/threatstack-terraform/tree/v1.0.0).
27
+
28
+
To use, a user-created module should be defined that _imports_ this module (via the `source` parameter on the `module` setting. Terraform will download and use the source module with the `terraform init` command, so there is no need to download it separately for use. The minimum configuration for the user would look as follows (Be sure to adjust the git ref in the source value appropriately):
In Threat Stack click `Add Profile` under _AWS Profiles_ fill in the relevant output values on the _Integrations_ page under _Settings_ and get the Threat Stack _Account ID_ and _External ID_. Use these values for the `threatstack_account_id` and `threatstack_external_id`. Run Terraform and get the outputs from it.
In Threat Stack click `Add Account` under _AWS Accounts_ fill in the relevant output values on the _Integrations_ page under _Settings_ and get the Threat Stack _Account ID_ and _External ID_. Use these values for the `threatstack.account_id` and `threatstack.external_id` input variables (see below). Run Terraform and get the outputs from it.
35
49
36
-
With the output values, fill in the Threat Stack profile screen.
Record the Terraform output values, and use them to complete the configuration of the Threat Stack platform's side integration. See sections 3 & 6 of the [AWS Manual Integration Setup](https://threatstack.zendesk.com/hc/en-us/articles/206512364-AWS-Manual-Integration-Setup) page for details.
39
53
40
54
## Variables
41
-
*___aws_account:___ Name of AWS account. Used to find remote state information and is prepended to bucket names.
42
55
43
-
*___aws_account_id:___ Account ID, used for CloudTrail integration.
56
+
The module's input variables are defined in their own Terraform variable objects. They are as follows:
57
+
58
+
*___threatstack:___**(REQUIRED)** Threat Stack-specific settings to deploy the integration. The defaults are null, so the integration will fail if not set.
59
+
60
+
*___aws_account_info:___**(REQUIRED)** AWS account specifics to deploy the integration. The defaults are null, so the integration will fail if not set.
61
+
62
+
*___aws_flags:___**(Optional)** The flags have defaults, so the module can work without these explicitly set.
63
+
64
+
*___aws_optional_conf:___**(Optional)** The settings have defaults, so the module can work without these explicitly set.
65
+
66
+
67
+
#### Threat Stack configuration
68
+
69
+
All of the Threat Stack configuration is required. Not explicitly defining these values when using this module will cause the integration to not work as expected.
70
+
71
+
The Threat Stack configuration is defined as follows:
# Strings generated from the Threat Stack Add Account page
78
+
threatstack = {
79
+
80
+
account_id = string
81
+
external_id = string
82
+
83
+
}
84
+
}
85
+
```
44
86
45
-
*___aws_region:___AWS region. Used to find remote state.
87
+
*___threatstack.account_id:___Threat Stack account ID associated with the Threat Stack org. Used to find remote state information and is prepended to bucket names.
46
88
47
-
*___aws_cloudtrail_name (optional):___Name of CloudTrail trail.
89
+
*___threatstack.external_id:___Account ID, used for CloudTrail integration.
48
90
49
-
*___aws_iam_role_name (optional):___ Name of cross account IAM role grating access for Threat Stack to AWS environment.
50
91
51
-
*___aws_sns_topic_name (optional):___ Name of SNS topic used by CloudTrail.
This Terraform input variable is split into 3 sections: required settings, flag settings, and optional settings
54
95
55
-
*___aws_sqs_queue_name (optional):___ Name of SQS queue to forward events to.
96
+
##### Required settings
56
97
57
-
*___s3_bucket_name (optional):___ Name of bucket to create to store logs. Pay attention to the fact that domain name and account name will be prepended to thebucket to help prevent name collisions.
enable_log_file_validation = bool # Defaults to `true`
131
+
include_global_service_events = bool # Defaults to `true`
132
+
is_multi_region_trail = bool # Defaults to `true`
133
+
s3_force_destroy = bool # Defaults to `false`
134
+
135
+
#...
136
+
137
+
}
138
+
}
139
+
140
+
```
141
+
*___aws_flags.enable_logging (optional):___ Enable logging, set to 'false' to pause logging.
142
+
143
+
*___aws_flags.enable_log_file_validation (optional):___ Create signed digest file to validated contents of logs.
144
+
145
+
*___aws_flags.include_global_service_events (optional):___ Include evnets from global services such as IAM.
146
+
147
+
*___aws_flags.is_multi_region_trail (optional):___ Whether the trail is created in all regions or just the current region.
148
+
149
+
*___aws_flags.s3_force_destroy (optional):___ Bucket destroy will fail if the bucket is not empty. Set to `"true"` if you REALLY want to destroy logs on teardown.
cloudtrail_name = string # Defaults to "ThreatStackIntegration"
163
+
iam_role_name = string # Defaults to "ThreatStackIntegration"
164
+
sns_topic_name = string # Defaults to "ThreatStackIntegration"
165
+
sns_topic_display_name = string # Defaults to "Threat Stack integration topic."
166
+
sqs_queue_name = string # Defaults to "ThreatStackIntegration"
167
+
s3_bucket_name = string # Defaults to "threatstack-integration"
168
+
s3_force_destroy = string # Defaults to "/"
169
+
170
+
#...
171
+
172
+
}
173
+
}
174
+
```
58
175
59
-
*___s3_bucket_prefix (optional):___S3 prefix path for logs. Useful is using a bucket used by other services. (Not recommended)
176
+
*___aws_optional_conf.cloudtrail_name (optional):___Name of CloudTrail trail.
60
177
61
-
*___s3_force_destroy (optional):___Bucket destroy will fail if the bucket is not empty. Set to `"true"` if you REALLY want to destroy logs on teardown.
178
+
*___aws_optional_conf.iam_role_name (optional):___Name of cross account IAM role gating access for Threat Stack to AWS environment.
62
179
63
-
*___enable_logging (optional):___Enable logging, set to 'false' to pause logging.
180
+
*___aws_optional_conf.sns_topic_name (optional):___Name of SNS topic used by CloudTrail.
64
181
65
-
*___enable_log_file_validation (optional):___Create signed digest file to validated contents of logs.
*___include_global_service_events (optional):___Include evnets from global services such as IAM.
184
+
*___aws_optional_conf.sqs_queue_name (optional):___Name of SQS queue to forward events to.
68
185
69
-
*___is_multi_region_trail (optional):___Whether the trail is created in all regions or just the current region.
186
+
*___aws_optional_conf.s3_bucket_name (optional):___Name of bucket to create to store logs. Pay attention to the fact that account name will be prepended to the provided bucket name to help prevent name collisions.
70
187
188
+
*___aws_optional_conf.s3_bucket_prefix (optional):___ S3 prefix path for logs. Useful is using a bucket used by other services. (Not recommended)
71
189
72
190
## Outputs
73
191
*___cloudtrail_arn:___ ARN of CloudTrail.
@@ -78,7 +196,7 @@ With the output values, fill in the Threat Stack profile screen.
78
196
79
197
*___cloudwatch_log_group_arn:___ ARN of CloudWatch log group for cloudTrail events.
80
198
81
-
*___iam_role_arn:___ ARN of cross account IAM role granting Threat Stack access to environment. (Enter this value into Threat Stack when setting up.)
199
+
*___iam_role_arn:___ ARN of cross account IAM role granting Threat Stack access to environment. **(Enter this value into Threat Stack when setting up.)**
82
200
83
201
*___iam_role_name:___ Name of cross account IAM role granting Threat Stack access to environment.
84
202
@@ -88,12 +206,12 @@ With the output values, fill in the Threat Stack profile screen.
88
206
89
207
*___s3_bucket_arn:___ ARN of bucket for CloudTrail events.
90
208
91
-
*___s3_bucket_id:___ Name of bucket for CloudTrail events. (Enter this value into Threat Stack when setting up.)
209
+
*___s3_bucket_id:___ Name of bucket for CloudTrail events. **(Enter this value into Threat Stack when setting up.)**
92
210
93
211
*___sns_topic_arn:___ ARN of SNS topic where CloudTrail events are forwarded to.
94
212
95
213
*___sqs_queue_arn:___ ARN of SQS queue Threat Stack reads events from.
96
214
97
215
*___sqs_queue_id:___ SQS queue ID / endpoint.
98
216
99
-
*___sqs_queue_source:___ Name of SQS queue Threat Stack reads events from. (Enter this value into Threat Stack when setting up.)
217
+
*___sqs_queue_source:___ Name of SQS queue Threat Stack reads events from. **(Enter this value into Threat Stack when setting up.)**
0 commit comments