nozaq/terraform-aws-secure-baselineTerraform 모듈로, CIS Amazon Web Services Foundations 및 AWS Foundational Security Best Practices를 기반으로 AWS 계정을 보안 기준 구성으로 설정합니다.
AWS 계정을 적절한 보안 구성 기준으로 설정하기 위한 Terraform 모듈입니다. 대부분의 구성은 [CIS Amazon Web Services Foundations v1.4.0] 및 [AWS Foundational Security Best Practices v1.0.0]을 기반으로 합니다.
다양한 벤치마크에서 어떤 항목이 적용되는지 확인하려면 벤치마크 준수를 참조하세요.
data "aws_caller_identity" "current" {} data "aws_region" "current" {}
module "secure_baseline" { source = "nozaq/secure-baseline/aws"
audit_log_bucket_name = "YOUR_BUCKET_NAME" aws_account_id = data.aws_caller_identity.current.account_id region = data.aws_region.current.name support_iam_role_principal_arns = ["YOUR_IAM_USER"]
providers = { aws = aws aws.ap-northeast-1 = aws.ap-northeast-1 aws.ap-northeast-2 = aws.ap-northeast-2 aws.ap-northeast-3 = aws.ap-northeast-3 aws.ap-south-1 = aws.ap-south-1 aws.ap-southeast-1 = aws.ap-southeast-1 aws.ap-southeast-2 = aws.ap-southeast-2 aws.ca-central-1 = aws.ca-central-1 aws.eu-central-1 = aws.eu-central-1 aws.eu-north-1 = aws.eu-north-1 aws.eu-west-1 = aws.eu-west-1 aws.eu-west-2 = aws.eu-west-2 aws.eu-west-3 = aws.eu-west-3 aws.sa-east-1 = aws.sa-east-1 aws.us-east-1 = aws.us-east-1 aws.us-east-2 = aws.us-east-2 aws.us-west-1 = aws.us-west-1 aws.us-west-2 = aws.us-west-2 } }
Check [the example](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/examples/simple/regions.tf) to understand how these providers are defined.
Note that you need to define a provider for each AWS region and pass them to the module. Currently this is the recommended way to handle multiple regions in one module.
Detailed information can be found at [Providers within Modules - Terraform Docs].
A new S3 bucket to store audit logs is automatically created by default, while the external S3 bucket can be specified. It is useful when you already have a centralized S3 bucket to store all logs. Please see [external-bucket](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/examples/external-bucket) example for more detail.
### Managing multiple accounts in AWS Organization
When you have multiple AWS accounts in your AWS Organization, `secure-baseline` module configures the separated environment for each AWS account. You can change this behavior to centrally manage security information and audit logs from all accounts in one master account.
Check [organization](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/examples/organization) example for more detail.
## Submodules
This module is composed of several submodules and each of which can be used independently.
[Modules in Package Sub-directories - Terraform] describes how to source a submodule.
- [alarm-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/alarm-baseline)
- [analyzer-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/analyzer-baseline)
- [cloudtrail-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/cloudtrail-baseline)
- [config-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/config-baseline)
- [ebs-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/ebs-baseline)
- [guardduty-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/guardduty-baseline)
- [iam-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/iam-baseline)
- [s3-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/s3-baseline)
- [secure-bucket](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/secure-bucket)
- [securityhub-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/securityhub-baseline)
- [vpc-baseline](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/modules/vpc-baseline)
## Compatibility
- Starting from v1.0, this module requires [Terraform Provider for AWS](https://github.com/terraform-providers/terraform-provider-aws) v4.0 or later. [Version 1.0 Upgrade Guide](https://github.com/nozaq/terraform-aws-secure-baseline/blob/main/docs/upgrade-1.0.md) described the recommended procedure after the upgrade.
- Starting from v0.20, this module requires [Terraform Provider for AWS](https://github.com/terraform-providers/terraform-provider-aws) v3.0 or later. Please use v0.19 if you need to use v2.x or earlier.
- Starting from v0.10, this module requires Terraform v0.12 or later. Please use v0.9 if you need to use Terraform v0.11 or ealier.
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
## Requirements
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.4 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.3 |
## Providers
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.3 |