Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Allow CloudTrail logs to be SSE-S3 encrypted #321

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: Allow CloudTrail logs to be SSE-S3 encrypted #321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3fcae77
feat: Allow CloudTrail logs to be SSE-S3 encrypted
wimnat Sep 23, 2023
4287768
Update doc string
wimnat Sep 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion modules/cloudtrail-baseline/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,7 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
}

resource "aws_kms_key" "cloudtrail" {
count = var.cloudtrail_kms_customer_managed || var.cloudtrail_sns_topic_enabled ? 1 : 0
description = "A KMS key to encrypt CloudTrail events."
deletion_window_in_days = var.key_deletion_window_in_days
enable_key_rotation = "true"
Expand Down Expand Up @@ -237,7 +238,7 @@ resource "aws_cloudtrail" "global" {
include_global_service_events = true
is_multi_region_trail = true
is_organization_trail = var.is_organization_trail
kms_key_id = aws_kms_key.cloudtrail.arn
kms_key_id = var.cloudtrail_kms_customer_managed ? aws_kms_key.cloudtrail.arn : null
s3_bucket_name = var.s3_bucket_name
s3_key_prefix = var.s3_key_prefix
sns_topic_name = var.cloudtrail_sns_topic_enabled ? aws_sns_topic.cloudtrail-sns-topic[0].arn : null
Expand Down
6 changes: 6 additions & 0 deletions modules/cloudtrail-baseline/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,12 @@ variable "permissions_boundary_arn" {
default = ""
}

variable "cloudtrail_kms_customer_managed" {
description = "Whether to use SSE-KMS encryption for CloudTrail logs KMS encryption type. With this variable set false, CloudTrail logs are encrypted with SSE-S3. SSE-S3 is AWS managed and incurs no cost. Note that if SNS is enabled, a customer managed KMS key will be created for that topic regardless of this variable option."
type = bool
default = true
}

variable "key_deletion_window_in_days" {
description = "Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 30 days."
type = number
Expand Down