Files

T

History

Jorge Falcon 7b381e0bbb Enforce DENY non-HTTPS requests to s3 buckets (#250 )

- Enforces access over HTTPS to all Fleet-terraform created buckets.
- Fixes vpc-flow-logs log retention; now allows configuring the
retention in days.

2026-06-08 18:37:48 -04:00

.header.md

Enforce DENY non-HTTPS requests to s3 buckets (#250 )

2026-06-08 18:37:48 -04:00

.terraform-docs.yml

Initial migration (#1 )

2025-02-04 10:07:51 -06:00

main.tf

Enforce DENY non-HTTPS requests to s3 buckets (#250 )

2026-06-08 18:37:48 -04:00

outputs.tf

Add S3 bucket outputs for logging destination addons (#146 )

2025-12-03 15:33:31 -05:00

README.md

Enforce DENY non-HTTPS requests to s3 buckets (#250 )

2026-06-08 18:37:48 -04:00

variables.tf

Support custom database user and database names properly (#240 )

2026-05-26 14:23:56 -05:00

README.md

Logging Destination: Firehose

This addon provides a Kinesis Firehose logging destination for Fleet.

S3 Bucket Policy: Deny Non-HTTPS

This module automatically attaches a bucket policy to each S3 bucket (osquery-results, osquery-status, audit) that denies any requests made over plain HTTP. No configuration is required.

Requirements

No requirements.

Providers

Name	Version
aws	6.41.0

Modules

No modules.

Resources

Name	Type
aws_iam_policy.firehose-audit	resource
aws_iam_policy.firehose-logging	resource
aws_iam_policy.firehose-results	resource
aws_iam_policy.firehose-status	resource
aws_iam_role.firehose-audit	resource
aws_iam_role.firehose-results	resource
aws_iam_role.firehose-status	resource
aws_iam_role_policy_attachment.firehose-audit	resource
aws_iam_role_policy_attachment.firehose-results	resource
aws_iam_role_policy_attachment.firehose-status	resource
aws_kinesis_firehose_delivery_stream.audit	resource
aws_kinesis_firehose_delivery_stream.osquery_results	resource
aws_kinesis_firehose_delivery_stream.osquery_status	resource
aws_s3_bucket.audit	resource
aws_s3_bucket.osquery-results	resource
aws_s3_bucket.osquery-status	resource
aws_s3_bucket_lifecycle_configuration.audit	resource
aws_s3_bucket_lifecycle_configuration.osquery-results	resource
aws_s3_bucket_lifecycle_configuration.osquery-status	resource
aws_s3_bucket_policy.deny_insecure_transport_audit	resource
aws_s3_bucket_policy.deny_insecure_transport_osquery_results	resource
aws_s3_bucket_policy.deny_insecure_transport_osquery_status	resource
aws_s3_bucket_public_access_block.audit	resource
aws_s3_bucket_public_access_block.osquery-results	resource
aws_s3_bucket_public_access_block.osquery-status	resource
aws_s3_bucket_server_side_encryption_configuration.audit	resource
aws_s3_bucket_server_side_encryption_configuration.osquery-results	resource
aws_s3_bucket_server_side_encryption_configuration.osquery-status	resource
aws_iam_policy_document.audit_policy_doc	data source
aws_iam_policy_document.deny_insecure_transport_audit	data source
aws_iam_policy_document.deny_insecure_transport_osquery_results	data source
aws_iam_policy_document.deny_insecure_transport_osquery_status	data source
aws_iam_policy_document.firehose-logging	data source
aws_iam_policy_document.osquery_firehose_assume_role	data source
aws_iam_policy_document.osquery_results_policy_doc	data source
aws_iam_policy_document.osquery_status_policy_doc	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
audit_s3_bucket	n/a	object({ name = optional(string, "fleet-audit-archive") expires_days = optional(number, 1) })	{ "expires_days": 1, "name": "fleet-audit-archive" }	no
compression_format	n/a	`string`	`"UNCOMPRESSED"`	no
osquery_results_s3_bucket	n/a	object({ name = optional(string, "fleet-osquery-results-archive") expires_days = optional(number, 1) })	{ "expires_days": 1, "name": "fleet-osquery-results-archive" }	no
osquery_status_s3_bucket	n/a	object({ name = optional(string, "fleet-osquery-status-archive") expires_days = optional(number, 1) })	{ "expires_days": 1, "name": "fleet-osquery-status-archive" }	no
prefix	n/a	`string`	`""`	no

Outputs

Name	Description
fleet_extra_environment_variables	n/a
fleet_extra_iam_policies	n/a
fleet_s3_firehose_audit_config	S3 bucket details - audit
fleet_s3_firehose_osquery_results_config	S3 bucket details - osquery-results
fleet_s3_firehose_osquery_status_config	S3 bucket details - osquery-status