diff --git a/README.md b/README.md index 4dd6c25a..cd653dfa 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,7 @@ See [Benchmark Compliance](./compliance.md) to check which items in various benc - Enable AWS Config in each regions to automatically take configuration snapshots. - Enable SecurityHub and subscribe available standards. - Enable GuardDuty in each regions. +- Enable Macie. ### Networking & Computing @@ -100,6 +101,7 @@ This module is composed of several submodules and each of which can be used inde - [ebs-baseline](./modules/ebs-baseline) - [guardduty-baseline](./modules/guardduty-baseline) - [iam-baseline](./modules/iam-baseline) +- [macie-baseline](./modules/macie-baseline) - [s3-baseline](./modules/s3-baseline) - [secure-bucket](./modules/secure-bucket) - [securityhub-baseline](./modules/securityhub-baseline) @@ -195,6 +197,7 @@ This module is composed of several submodules and each of which can be used inde | [guardduty\_baseline\_us-west-1](#module\_guardduty\_baseline\_us-west-1) | ./modules/guardduty-baseline | n/a | | [guardduty\_baseline\_us-west-2](#module\_guardduty\_baseline\_us-west-2) | ./modules/guardduty-baseline | n/a | | [iam\_baseline](#module\_iam\_baseline) | ./modules/iam-baseline | n/a | +| [macie\_baseline](#module\_macie\_baseline) | ./modules/macie-baseline | n/a | | [s3\_baseline](#module\_s3\_baseline) | ./modules/s3-baseline | n/a | | [securityhub\_baseline\_ap-northeast-1](#module\_securityhub\_baseline\_ap-northeast-1) | ./modules/securityhub-baseline | n/a | | [securityhub\_baseline\_ap-northeast-2](#module\_securityhub\_baseline\_ap-northeast-2) | ./modules/securityhub-baseline | n/a | @@ -330,6 +333,10 @@ This module is composed of several submodules and each of which can be used inde | [require\_uppercase\_characters](#input\_require\_uppercase\_characters) | Whether to require uppercase characters for user passwords. | `bool` | `false` | no | | [root\_usage\_enabled](#input\_root\_usage\_enabled) | The boolean flag whether the root\_usage alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no | | [route\_table\_changes\_enabled](#input\_route\_table\_changes\_enabled) | The boolean flag whether the route\_table\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no | +| [macie\_disable\_email\_notification](#input\_macie\_disable\_email\_notification) | Boolean whether an email notification is sent to the accounts. | `bool` | `false` | no | +| [macie\_enabled](#input\_macie\_enabled) | Boolean whether the macie-baseline module is enabled or disabled | `bool` | `true` | no | +| [macie\_finding\_publishing\_frequency](#input\_macie\_finding\_publishing\_frequency) | Specifies the frequency of notifications sent for subsequent finding occurrences. | `string` | `"SIX_HOURS"` | no | +| [macie\_invitation\_message](#input\_macie\_invitation\_message) | Message for invitation. | `string` | `"This is an automatic invitation message from macie-baseline module."` | no | | [s3\_block\_public\_acls](#input\_s3\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to true. | `bool` | `true` | no | | [s3\_block\_public\_policy](#input\_s3\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to true. | `bool` | `true` | no | | [s3\_bucket\_policy\_changes\_enabled](#input\_s3\_bucket\_policy\_changes\_enabled) | The boolean flag whether the s3\_bucket\_policy\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no | diff --git a/main.tf b/main.tf index c8eaab1d..713a64bf 100644 --- a/main.tf +++ b/main.tf @@ -119,6 +119,23 @@ module "alarm_baseline" { tags = var.tags } +# -------------------------------------------------------------------------------------------------- +# Macie Baseline +# -------------------------------------------------------------------------------------------------- + +module "macie_baseline" { + source = "./modules/macie-baseline" + + enabled = contains(var.target_regions, "ap-northeast-1") && var.macie_enabled + disable_email_notification = var.macie_disable_email_notification + finding_publishing_frequency = var.macie_finding_publishing_frequency + invitation_message = var.macie_invitation_message + master_account_id = var.master_account_id + member_accounts = var.member_accounts + + tags = var.tags +} + # -------------------------------------------------------------------------------------------------- # S3 Baseline # -------------------------------------------------------------------------------------------------- diff --git a/modules/macie-baseline/README.md b/modules/macie-baseline/README.md new file mode 100644 index 00000000..cda0ca82 --- /dev/null +++ b/modules/macie-baseline/README.md @@ -0,0 +1,48 @@ +# macie-baseline + +Enable Macie in all regions. + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.13 | +| [aws](#requirement\_aws) | >= 3.0.0 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | >= 3.0.0 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_macie2_account.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/macie2_account) | resource | +| [aws_macie2_invitation_accepter.master](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/macie2_invitation_accepter) | resource | +| [aws_macie2_member.members](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/macie2_member) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [disable\_email\_notification](#input\_disable\_email\_notification) | Boolean whether an email notification is sent to the accounts. | `bool` | `false` | no | +| [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no | +| [finding\_publishing\_frequency](#input\_finding\_publishing\_frequency) | Specifies the frequency of notifications sent for subsequent finding occurrences. | `string` | `"SIX_HOURS"` | no | +| [invitation\_message](#input\_invitation\_message) | Message for invitation. | `string` | `"This is an automatic invitation message from guardduty-baseline module."` | no | +| [master\_account\_id](#input\_master\_account\_id) | AWS account ID for master account. | `string` | `""` | no | +| [member\_accounts](#input\_member\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts. |
list(object({
account_id = string
email = string
})) | `[]` | no |
+| [tags](#input\_tags) | Specifies object tags key and value. This applies to all resources created by this module. | `map` | {
"Terraform": true
} | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [macie\_account](#output\_macie\_account) | Macie Account |
+
diff --git a/modules/macie-baseline/main.tf b/modules/macie-baseline/main.tf
new file mode 100644
index 00000000..b794ad61
--- /dev/null
+++ b/modules/macie-baseline/main.tf
@@ -0,0 +1,28 @@
+# --------------------------------------------------------------------------------------------------
+# Enables GuardDuty.
+# --------------------------------------------------------------------------------------------------
+
+resource "aws_macie2_account" "default" {
+ count = var.enabled ? 1 : 0
+
+ status = "ENABLED"
+ finding_publishing_frequency = var.finding_publishing_frequency
+}
+
+resource "aws_macie2_member" "members" {
+ count = var.enabled ? length(var.member_accounts) : 0
+
+ status = "ENABLED"
+ invite = true
+
+ account_id = var.member_accounts[count.index].account_id
+ invitation_disable_email_notification = var.disable_email_notification
+ email = var.member_accounts[count.index].email
+ invitation_message = var.invitation_message
+}
+
+resource "aws_macie2_invitation_accepter" "master" {
+ count = var.enabled && var.master_account_id != "" ? 1 : 0
+
+ administrator_account_id = var.master_account_id
+}
diff --git a/modules/macie-baseline/outputs.tf b/modules/macie-baseline/outputs.tf
new file mode 100644
index 00000000..0c60df33
--- /dev/null
+++ b/modules/macie-baseline/outputs.tf
@@ -0,0 +1,4 @@
+output "aws_macie2_account" {
+ description = "Macie Account"
+ value = var.enabled ? aws_macie2_account.default[0] : null
+}
diff --git a/modules/macie-baseline/variables.tf b/modules/macie-baseline/variables.tf
new file mode 100644
index 00000000..0aa9d673
--- /dev/null
+++ b/modules/macie-baseline/variables.tf
@@ -0,0 +1,40 @@
+variable "enabled" {
+ description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
+ default = true
+}
+
+variable "disable_email_notification" {
+ description = "Boolean whether an email notification is sent to the accounts."
+ default = false
+}
+
+variable "finding_publishing_frequency" {
+ description = "Specifies the frequency of notifications sent for subsequent finding occurrences."
+ default = "SIX_HOURS"
+}
+
+variable "invitation_message" {
+ description = "Message for invitation."
+ default = "This is an automatic invitation message from guardduty-baseline module."
+}
+
+variable "master_account_id" {
+ description = "AWS account ID for master account."
+ default = ""
+}
+
+variable "member_accounts" {
+ description = "A list of IDs and emails of AWS accounts which associated as member accounts."
+ type = list(object({
+ account_id = string
+ email = string
+ }))
+ default = []
+}
+
+variable "tags" {
+ description = "Specifies object tags key and value. This applies to all resources created by this module."
+ default = {
+ "Terraform" = true
+ }
+}
diff --git a/modules/macie-baseline/versions.tf b/modules/macie-baseline/versions.tf
new file mode 100644
index 00000000..02acfe6e
--- /dev/null
+++ b/modules/macie-baseline/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 0.13"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 3.0.0"
+ }
+ }
+}
diff --git a/variables.tf b/variables.tf
index ae94dbef..526002bb 100644
--- a/variables.tf
+++ b/variables.tf
@@ -475,6 +475,29 @@ variable "guardduty_invitation_message" {
default = "This is an automatic invitation message from guardduty-baseline module."
}
+# --------------------------------------------------------------------------------------------------
+# Variables for macie-baseline module.
+# --------------------------------------------------------------------------------------------------
+variable "macie_enabled" {
+ description = "Boolean whether the macie-baseline module is enabled or disabled"
+ default = true
+}
+
+variable "macie_disable_email_notification" {
+ description = "Boolean whether an email notification is sent to the accounts."
+ default = false
+}
+
+variable "macie_finding_publishing_frequency" {
+ description = "Specifies the frequency of notifications sent for subsequent finding occurrences."
+ default = "SIX_HOURS"
+}
+
+variable "macie_invitation_message" {
+ description = "Message for invitation."
+ default = "This is an automatic invitation message from macie-baseline module."
+}
+
# --------------------------------------------------------------------------------------------------
# Variables for s3-baseline module.
# --------------------------------------------------------------------------------------------------