S3 bucket tagging (#268)
This commit is contained in:
Robert Fairburn
@@ -89,22 +89,22 @@ No requirements.
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_archive"></a> [archive](#provider\_archive) | 2.7.1 |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.40.0 |
|
||||
| ---- | ------- |
|
||||
| <a name="provider_archive"></a> [archive](#provider\_archive) | 2.8.0 |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.54.0 |
|
||||
| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| ---- | ------ | ------- |
|
||||
| <a name="module_athena-s3-bucket"></a> [athena-s3-bucket](#module\_athena-s3-bucket) | terraform-aws-modules/s3-bucket/aws | 5.12.0 |
|
||||
| <a name="module_s3_bucket_for_logs"></a> [s3\_bucket\_for\_logs](#module\_s3\_bucket\_for\_logs) | terraform-aws-modules/s3-bucket/aws | 5.12.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| ---- | ---- |
|
||||
| [aws_athena_database.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_database) | resource |
|
||||
| [aws_athena_workgroup.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_workgroup) | resource |
|
||||
| [aws_cloudwatch_event_rule.sweep_reencrypt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
|
||||
@@ -144,7 +144,7 @@ No requirements.
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| ---- | ----------- | ---- | ------- | :------: |
|
||||
| <a name="input_alt_path_prefix"></a> [alt\_path\_prefix](#input\_alt\_path\_prefix) | Used if the prefix inside of the s3 bucket doesn't match the name of the bucket prefix | `string` | `null` | no |
|
||||
| <a name="input_enable_athena"></a> [enable\_athena](#input\_enable\_athena) | n/a | `bool` | `true` | no |
|
||||
| <a name="input_enable_reencrypt_sweep"></a> [enable\_reencrypt\_sweep](#input\_enable\_reencrypt\_sweep) | Enable the sweep and re-encrypt Lambda functions, EventBridge schedule, S3 bucket notification, and associated IAM roles. | `bool` | `false` | no |
|
||||
@@ -155,6 +155,7 @@ No requirements.
|
||||
| <a name="input_kms_base_policy"></a> [kms\_base\_policy](#input\_kms\_base\_policy) | Optional base KMS key-policy statements to apply to module-created CMKs before module-required service access statements are merged in. If null, the module defaults to the historical root `kms:*` statement. | <pre>list(object({<br/> sid = string<br/> effect = string<br/> principals = object({<br/> type = string<br/> identifiers = list(string)<br/> })<br/> actions = list(string)<br/> resources = list(string)<br/> conditions = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })), [])<br/> }))</pre> | `null` | no |
|
||||
| <a name="input_lambda_log_retention_in_days"></a> [lambda\_log\_retention\_in\_days](#input\_lambda\_log\_retention\_in\_days) | CloudWatch log retention in days for the re-encrypt and sweep Lambda functions | `number` | `365` | no |
|
||||
| <a name="input_prefix"></a> [prefix](#input\_prefix) | n/a | `string` | `"fleet"` | no |
|
||||
| <a name="input_s3_bucket_tags"></a> [s3\_bucket\_tags](#input\_s3\_bucket\_tags) | Additional tags to apply to all S3 buckets created by this module. | `map(string)` | `{}` | no |
|
||||
| <a name="input_s3_expiration_days"></a> [s3\_expiration\_days](#input\_s3\_expiration\_days) | n/a | `number` | `90` | no |
|
||||
| <a name="input_s3_newer_noncurrent_versions"></a> [s3\_newer\_noncurrent\_versions](#input\_s3\_newer\_noncurrent\_versions) | n/a | `number` | `5` | no |
|
||||
| <a name="input_s3_noncurrent_version_expiration_days"></a> [s3\_noncurrent\_version\_expiration\_days](#input\_s3\_noncurrent\_version\_expiration\_days) | n/a | `number` | `30` | no |
|
||||
@@ -163,5 +164,5 @@ No requirements.
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| ---- | ----------- |
|
||||
| <a name="output_log_s3_bucket_id"></a> [log\_s3\_bucket\_id](#output\_log\_s3\_bucket\_id) | S3 bucket used by ALB access logging (SSE-S3 on write, re-encrypted to SSE-KMS by Lambda) |
|
||||
|
||||
@@ -260,6 +260,8 @@ module "s3_bucket_for_logs" {
|
||||
|
||||
bucket = local.landing_bucket_name
|
||||
|
||||
tags = var.s3_bucket_tags
|
||||
|
||||
# Allow deletion of non-empty bucket
|
||||
force_destroy = true
|
||||
|
||||
@@ -646,6 +648,8 @@ module "athena-s3-bucket" {
|
||||
|
||||
bucket = "${var.prefix}-alb-logs-athena"
|
||||
|
||||
tags = var.s3_bucket_tags
|
||||
|
||||
# Allow deletion of non-empty bucket
|
||||
force_destroy = true
|
||||
|
||||
|
||||
@@ -86,3 +86,9 @@ variable "extra_s3_athena_policies" {
|
||||
type = list(any)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "s3_bucket_tags" {
|
||||
description = "Additional tags to apply to all S3 buckets created by this module."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
@@ -9,15 +9,7 @@ This addon configures AWS Kinesis Firehose to send Fleet's osquery logs to Datad
|
||||
|
||||
## S3 Bucket Policy: Deny Non-HTTPS
|
||||
|
||||
Set `attach_deny_insecure_transport_policy = true` to attach a bucket policy to the failure S3 bucket that denies any requests made over plain HTTP:
|
||||
|
||||
```hcl
|
||||
module "datadog-logging" {
|
||||
source = "github.com/fleetdm/fleet-terraform//addons/logging-destination-datadog?ref=<tag>"
|
||||
attach_deny_insecure_transport_policy = true
|
||||
# ... other configuration ...
|
||||
}
|
||||
```
|
||||
This module automatically attaches a bucket policy to the failure S3 bucket that denies any requests made over plain HTTP. No configuration is required.
|
||||
|
||||
## How to use
|
||||
|
||||
@@ -132,8 +124,8 @@ No requirements.
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.41.0 |
|
||||
| ---- | ------- |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
|
||||
|
||||
## Modules
|
||||
|
||||
@@ -142,7 +134,7 @@ No modules.
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| ---- | ---- |
|
||||
| [aws_iam_policy.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_policy.firehose-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_role.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
|
||||
@@ -162,18 +154,18 @@ No modules.
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| <a name="input_attach_deny_insecure_transport_policy"></a> [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | When true, attach a bucket policy to the S3 bucket that denies non-SSL requests. | `bool` | `false` | no |
|
||||
| ---- | ----------- | ---- | ------- | :------: |
|
||||
| <a name="input_compression_format"></a> [compression\_format](#input\_compression\_format) | Compression format for the Firehose delivery stream | `string` | `"UNCOMPRESSED"` | no |
|
||||
| <a name="input_datadog_api_key"></a> [datadog\_api\_key](#input\_datadog\_api\_key) | Datadog API key for authentication | `string` | n/a | yes |
|
||||
| <a name="input_datadog_url"></a> [datadog\_url](#input\_datadog\_url) | Datadog HTTP API endpoint URL | `string` | n/a | yes |
|
||||
| <a name="input_log_destinations"></a> [log\_destinations](#input\_log\_destinations) | A map of configurations for Datadog Firehose delivery streams. | <pre>map(object({<br/> name = string<br/> buffering_size = number<br/> buffering_interval = number<br/> s3_buffering_size = number<br/> s3_buffering_interval = number<br/> content_encoding = string<br/> common_attributes = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> }))</pre> | <pre>{<br/> "audit": {<br/> "buffering_interval": 60,<br/> "buffering_size": 2,<br/> "common_attributes": [],<br/> "content_encoding": "NONE",<br/> "name": "fleet-audit-datadog",<br/> "s3_buffering_interval": 400,<br/> "s3_buffering_size": 10<br/> },<br/> "results": {<br/> "buffering_interval": 60,<br/> "buffering_size": 2,<br/> "common_attributes": [],<br/> "content_encoding": "NONE",<br/> "name": "fleet-osquery-results-datadog",<br/> "s3_buffering_interval": 400,<br/> "s3_buffering_size": 10<br/> },<br/> "status": {<br/> "buffering_interval": 60,<br/> "buffering_size": 2,<br/> "common_attributes": [],<br/> "content_encoding": "NONE",<br/> "name": "fleet-osquery-status-datadog",<br/> "s3_buffering_interval": 400,<br/> "s3_buffering_size": 10<br/> }<br/>}</pre> | no |
|
||||
| <a name="input_s3_bucket_config"></a> [s3\_bucket\_config](#input\_s3\_bucket\_config) | Configuration for the S3 bucket used to store failed Datadog delivery attempts | <pre>object({<br/> name_prefix = optional(string, "fleet-datadog-failure")<br/> expires_days = optional(number, 1)<br/> })</pre> | <pre>{<br/> "expires_days": 1,<br/> "name_prefix": "fleet-datadog-failure"<br/>}</pre> | no |
|
||||
| <a name="input_s3_bucket_tags"></a> [s3\_bucket\_tags](#input\_s3\_bucket\_tags) | Additional tags to apply to the S3 failure bucket. | `map(string)` | `{}` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| ---- | ----------- |
|
||||
| <a name="output_fleet_extra_environment_variables"></a> [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | Environment variables to configure Fleet to use Datadog logging via Firehose |
|
||||
| <a name="output_fleet_extra_iam_policies"></a> [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | IAM policies required for Fleet to log to Datadog via Firehose |
|
||||
| <a name="output_fleet_s3_datadog_failure_config"></a> [fleet\_s3\_datadog\_failure\_config](#output\_fleet\_s3\_datadog\_failure\_config) | S3 bucket details - datadog-failure |
|
||||
|
||||
@@ -2,6 +2,7 @@ data "aws_region" "current" {}
|
||||
|
||||
resource "aws_s3_bucket" "datadog-failure" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
|
||||
bucket_prefix = var.s3_bucket_config.name_prefix
|
||||
tags = var.s3_bucket_tags
|
||||
}
|
||||
|
||||
resource "aws_s3_bucket_lifecycle_configuration" "datadog-failure" {
|
||||
|
||||
@@ -70,3 +70,9 @@ variable "datadog_api_key" {
|
||||
description = "Datadog API key for authentication"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "s3_bucket_tags" {
|
||||
description = "Additional tags to apply to the S3 failure bucket."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
@@ -100,8 +100,8 @@ No requirements.
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.41.0 |
|
||||
| ---- | ------- |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
|
||||
|
||||
## Modules
|
||||
|
||||
@@ -110,7 +110,7 @@ No modules.
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| ---- | ---- |
|
||||
| [aws_iam_policy.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_policy.firehose-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_role.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
|
||||
@@ -130,16 +130,17 @@ No modules.
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| ---- | ----------- | ---- | ------- | :------: |
|
||||
| <a name="input_compression_format"></a> [compression\_format](#input\_compression\_format) | Compression format for the Firehose delivery stream | `string` | `"UNCOMPRESSED"` | no |
|
||||
| <a name="input_iam_policy_name"></a> [iam\_policy\_name](#input\_iam\_policy\_name) | n/a | `string` | `"splunk-firehose-policy"` | no |
|
||||
| <a name="input_log_destinations"></a> [log\_destinations](#input\_log\_destinations) | A map of configurations for Splunk Firehose delivery streams. | <pre>map(object({<br/> # hec endpoint/token are logically optional but validated to enforce <br/> name = string<br/> hec_endpoint = optional(string)<br/> hec_token = optional(string)<br/> hec_acknowledgement_timeout = optional(number, 600)<br/> hec_endpoint_type = optional(string, "Raw")<br/> s3_buffering_size = optional(number, 2)<br/> s3_buffering_interval = optional(number, 400)<br/> s3_error_output_prefix = optional(string, null)<br/><br/> }))</pre> | <pre>{<br/> "audit": {<br/> "hec_acknowledgement_timeout": 600,<br/> "hec_endpoint_type": "Raw",<br/> "name": "fleet-audit-splunk",<br/> "s3_buffering_interval": 400,<br/> "s3_buffering_size": 10,<br/> "s3_error_output_prefix": "audit/"<br/> },<br/> "results": {<br/> "hec_acknowledgement_timeout": 600,<br/> "hec_endpoint_type": "Raw",<br/> "name": "fleet-osquery-results-splunk",<br/> "s3_buffering_interval": 400,<br/> "s3_buffering_size": 10,<br/> "s3_error_output_prefix": "results/"<br/> },<br/> "status": {<br/> "hec_acknowledgement_timeout": 600,<br/> "hec_endpoint_type": "Raw",<br/> "name": "fleet-osquery-status-splunk",<br/> "s3_buffering_interval": 400,<br/> "s3_buffering_size": 10,<br/> "s3_error_output_prefix": "status/"<br/> }<br/>}</pre> | no |
|
||||
| <a name="input_s3_bucket_config"></a> [s3\_bucket\_config](#input\_s3\_bucket\_config) | Configuration for the S3 bucket used to store failed Splunk delivery attempts | <pre>object({<br/> name_prefix = optional(string, "fleet-splunk-failure")<br/> expires_days = optional(number, 1)<br/> })</pre> | <pre>{<br/> "expires_days": 1,<br/> "name_prefix": "fleet-splunk-failure"<br/>}</pre> | no |
|
||||
| <a name="input_s3_bucket_tags"></a> [s3\_bucket\_tags](#input\_s3\_bucket\_tags) | Additional tags to apply to the S3 failure bucket. | `map(string)` | `{}` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| ---- | ----------- |
|
||||
| <a name="output_fleet_extra_environment_variables"></a> [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | Environment variables to configure Fleet to use Splunk logging via Firehose |
|
||||
| <a name="output_fleet_extra_iam_policies"></a> [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | IAM policies required for Fleet to log to Splunk via Firehose |
|
||||
| <a name="output_fleet_s3_splunk_failure_config"></a> [fleet\_s3\_splunk\_failure\_config](#output\_fleet\_s3\_splunk\_failure\_config) | S3 bucket details - splunk-failure |
|
||||
|
||||
@@ -3,6 +3,7 @@ data "aws_region" "current" {}
|
||||
resource "aws_s3_bucket" "splunk-failure" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
|
||||
bucket_prefix = var.s3_bucket_config.name_prefix
|
||||
force_destroy = true
|
||||
tags = var.s3_bucket_tags
|
||||
}
|
||||
|
||||
resource "aws_s3_bucket_lifecycle_configuration" "splunk-failure" {
|
||||
|
||||
@@ -71,3 +71,9 @@ variable "compression_format" {
|
||||
default = "UNCOMPRESSED"
|
||||
description = "Compression format for the Firehose delivery stream"
|
||||
}
|
||||
|
||||
variable "s3_bucket_tags" {
|
||||
description = "Additional tags to apply to the S3 failure bucket."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
@@ -21,15 +21,15 @@ This module automatically attaches a bucket policy that denies any requests made
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| ---- | ------- |
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.12.0 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.37.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.41.0 |
|
||||
| ---- | ------- |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.39.0 |
|
||||
|
||||
## Modules
|
||||
|
||||
@@ -38,7 +38,7 @@ No modules.
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| ---- | ---- |
|
||||
| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_kms_alias.osquery_carve](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
|
||||
| [aws_kms_key.osquery_carve](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
@@ -59,12 +59,12 @@ No modules.
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| <a name="input_osquery_carve_s3_bucket"></a> [osquery\_carve\_s3\_bucket](#input\_osquery\_carve\_s3\_bucket) | Configuration for the osquery carve S3 bucket, including optional customer-managed KMS settings. | <pre>object({<br/> name = optional(string, "fleet-osquery-results-archive")<br/> expires_days = optional(number, 1)<br/> kms = optional(object({<br/> kms_key_arn = optional(string, null)<br/> create_kms_key = optional(bool, false)<br/> kms_alias = optional(string, "osquery-carve")<br/> kms_base_policy = optional(list(object({<br/> sid = string<br/> effect = string<br/> principals = object({<br/> type = string<br/> identifiers = list(string)<br/> })<br/> actions = list(string)<br/> resources = list(string)<br/> conditions = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })), [])<br/> })), null)<br/> extra_kms_policies = optional(list(any), [])<br/> fleet_role_name = optional(string, null)<br/> }), {<br/> kms_key_arn = null<br/> create_kms_key = false<br/> kms_alias = "osquery-carve"<br/> kms_base_policy = null<br/> extra_kms_policies = []<br/> fleet_role_name = null<br/> })<br/> })</pre> | <pre>{<br/> "expires_days": 1,<br/> "kms": {<br/> "create_kms_key": false,<br/> "extra_kms_policies": [],<br/> "fleet_role_name": null,<br/> "kms_alias": "osquery-carve",<br/> "kms_base_policy": null,<br/> "kms_key_arn": null<br/> },<br/> "name": "fleet-osquery-results-archive"<br/>}</pre> | no |
|
||||
| ---- | ----------- | ---- | ------- | :------: |
|
||||
| <a name="input_osquery_carve_s3_bucket"></a> [osquery\_carve\_s3\_bucket](#input\_osquery\_carve\_s3\_bucket) | Configuration for the osquery carve S3 bucket, including optional customer-managed KMS settings. | <pre>object({<br/> name = optional(string, "fleet-osquery-results-archive")<br/> expires_days = optional(number, 1)<br/> tags = optional(map(string), {})<br/> kms = optional(object({<br/> kms_key_arn = optional(string, null)<br/> create_kms_key = optional(bool, false)<br/> kms_alias = optional(string, "osquery-carve")<br/> kms_base_policy = optional(list(object({<br/> sid = string<br/> effect = string<br/> principals = object({<br/> type = string<br/> identifiers = list(string)<br/> })<br/> actions = list(string)<br/> resources = list(string)<br/> conditions = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })), [])<br/> })), null)<br/> extra_kms_policies = optional(list(any), [])<br/> fleet_role_name = optional(string, null)<br/> }), {<br/> kms_key_arn = null<br/> create_kms_key = false<br/> kms_alias = "osquery-carve"<br/> kms_base_policy = null<br/> extra_kms_policies = []<br/> fleet_role_name = null<br/> })<br/> })</pre> | <pre>{<br/> "expires_days": 1,<br/> "kms": {<br/> "create_kms_key": false,<br/> "extra_kms_policies": [],<br/> "fleet_role_name": null,<br/> "kms_alias": "osquery-carve",<br/> "kms_base_policy": null,<br/> "kms_key_arn": null<br/> },<br/> "name": "fleet-osquery-results-archive",<br/> "tags": {}<br/>}</pre> | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| ---- | ----------- |
|
||||
| <a name="output_fleet_extra_environment_variables"></a> [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a |
|
||||
| <a name="output_fleet_extra_iam_policies"></a> [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | IAM policies required for Fleet to access the osquery carve S3 bucket. |
|
||||
|
||||
@@ -82,6 +82,7 @@ data "aws_iam_role" "osquery_carve_fleet" {
|
||||
|
||||
resource "aws_s3_bucket" "main" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2028-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2028-07-01
|
||||
bucket = var.osquery_carve_s3_bucket.name
|
||||
tags = var.osquery_carve_s3_bucket.tags
|
||||
}
|
||||
|
||||
resource "aws_s3_bucket_lifecycle_configuration" "main" {
|
||||
|
||||
@@ -2,6 +2,7 @@ variable "osquery_carve_s3_bucket" {
|
||||
type = object({
|
||||
name = optional(string, "fleet-osquery-results-archive")
|
||||
expires_days = optional(number, 1)
|
||||
tags = optional(map(string), {})
|
||||
kms = optional(object({
|
||||
kms_key_arn = optional(string, null)
|
||||
create_kms_key = optional(bool, false)
|
||||
@@ -36,6 +37,7 @@ variable "osquery_carve_s3_bucket" {
|
||||
default = {
|
||||
name = "fleet-osquery-results-archive"
|
||||
expires_days = 1
|
||||
tags = {}
|
||||
kms = {
|
||||
kms_key_arn = null
|
||||
create_kms_key = false
|
||||
|
||||
Reference in New Issue
Block a user