Skip to content

Commit 7239a24

Browse files
cdanilukcdaniluk
authored
Merge pull request #2 from rhythmictech/logging
Logging
2 parents 277f276 + e437e35 commit 7239a24

6 files changed

Lines changed: 110 additions & 12 deletions

File tree

‎README.md‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ A bit about this module
4646

4747
| Name | Version |
4848
|------|---------|
49-
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 3.74 |
50-
| <a name="provider_datadog"></a> [datadog](#provider\_datadog) | ~>3.8 |
49+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 3.74.2 |
50+
| <a name="provider_datadog"></a> [datadog](#provider\_datadog) | 3.8.1 |
5151

5252
## Modules
5353

@@ -60,8 +60,15 @@ A bit about this module
6060
| Name | Type |
6161
|------|------|
6262
| [aws_cloudformation_stack.datadog_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack) | resource |
63+
| [aws_cloudwatch_event_rule.guardduty](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
64+
| [aws_cloudwatch_event_target.guardduty](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
6365
| [aws_iam_policy.datadog](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
6466
| [aws_iam_role.datadog](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
67+
| [aws_iam_role_policy_attachment.cspm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
68+
| [aws_iam_role_policy_attachment.datadog](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
69+
| [aws_lambda_permission.cloudtrail_trigger](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
70+
| [aws_lambda_permission.guardduty_trigger](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
71+
| [aws_s3_bucket_notification.cloudtrail_notification](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |
6572
| [aws_secretsmanager_secret.datadog](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
6673
| [aws_secretsmanager_secret_version.datadog](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
6774
| [datadog_api_key.datadog](https://registry.terraform.io/providers/datadog/datadog/latest/docs/resources/api_key) | resource |
@@ -75,8 +82,10 @@ A bit about this module
7582

7683
| Name | Description | Type | Default | Required |
7784
|------|-------------|------|---------|:--------:|
85+
| <a name="input_cloudtrail_buckets"></a> [cloudtrail\_buckets](#input\_cloudtrail\_buckets) | Bucket(s) to collect CloudTrail logs from | `list(string)` | `[]` | no |
7886
| <a name="input_datadog_account_id"></a> [datadog\_account\_id](#input\_datadog\_account\_id) | DataDog AWS account ID (should not need changed) | `string` | `"464622532012"` | no |
7987
| <a name="input_datadog_site_name"></a> [datadog\_site\_name](#input\_datadog\_site\_name) | DataDog site (e.g., datadoghq.com) | `string` | `"datadoghq.com"` | no |
88+
| <a name="input_enable_guardduty_notifications"></a> [enable\_guardduty\_notifications](#input\_enable\_guardduty\_notifications) | Send GuardDuty notifications to Datadog (`install_log_forwarder` must be true) | `bool` | `true` | no |
8089
| <a name="input_install_log_forwarder"></a> [install\_log\_forwarder](#input\_install\_log\_forwarder) | controls whether log forwarder lambda should be installed | `bool` | `true` | no |
8190
| <a name="input_integration_excluded_regions"></a> [integration\_excluded\_regions](#input\_integration\_excluded\_regions) | Regions to exclude from DataDog monitoring | `list(string)` | `[]` | no |
8291
| <a name="input_integration_filter_tags"></a> [integration\_filter\_tags](#input\_integration\_filter\_tags) | Tags to filter EC2 instances on (see https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/integration_aws) | `list(string)` | `[]` | no |
@@ -89,5 +98,8 @@ A bit about this module
8998

9099
## Outputs
91100

92-
No outputs.
101+
| Name | Description |
102+
|------|-------------|
103+
| <a name="output_iam_role_datadog"></a> [iam\_role\_datadog](#output\_iam\_role\_datadog) | IAM role assumed by Datadog resources |
104+
| <a name="output_lambda_arn_forwarder"></a> [lambda\_arn\_forwarder](#output\_lambda\_arn\_forwarder) | DataDog Lambda Forwarder ARN |
93105
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎cloudtrail.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
resource "aws_lambda_permission" "cloudtrail_trigger" {
2+
for_each = toset(var.cloudtrail_buckets)
3+
4+
action = "lambda:InvokeFunction"
5+
function_name = try(aws_cloudformation_stack.datadog_forwarder[0].outputs.DatadogForwarderArn, "")
6+
principal = "s3.amazonaws.com"
7+
source_arn = "arn:aws:s3:::${each.value}"
8+
statement_id = "CloudTrailTrigger"
9+
}
10+
11+
resource "aws_s3_bucket_notification" "cloudtrail_notification" {
12+
for_each = toset(var.cloudtrail_buckets)
13+
14+
bucket = each.value
15+
16+
lambda_function {
17+
events = ["s3:ObjectCreated:*"]
18+
lambda_function_arn = try(aws_cloudformation_stack.datadog_forwarder[0].outputs.DatadogForwarderArn, "")
19+
}
20+
}

‎guardduty.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
resource "aws_cloudwatch_event_rule" "guardduty" {
2+
count = var.enable_guardduty_notifications ? 1 : 0
3+
4+
name_prefix = substr("gd-finding-${var.name}", 0, 35)
5+
description = "Match on GuardDuty alert (Datadog)"
6+
7+
event_pattern = <<EOT
8+
{
9+
"detail-type": [
10+
"GuardDuty Finding"
11+
],
12+
"source": [
13+
"aws.guardduty"
14+
]
15+
}
16+
EOT
17+
}
18+
19+
resource "aws_cloudwatch_event_target" "guardduty" {
20+
count = var.enable_guardduty_notifications ? 1 : 0
21+
22+
arn = try(aws_cloudformation_stack.datadog_forwarder[0].outputs.DatadogForwarderArn, "")
23+
rule = aws_cloudwatch_event_rule.guardduty[0].name
24+
target_id = "send-to-datadog"
25+
}
26+
27+
resource "aws_lambda_permission" "guardduty_trigger" {
28+
count = var.enable_guardduty_notifications ? 1 : 0
29+
30+
action = "lambda:InvokeFunction"
31+
function_name = try(aws_cloudformation_stack.datadog_forwarder[0].outputs.DatadogForwarderArn, "")
32+
principal = "events.amazonaws.com"
33+
source_arn = aws_cloudwatch_event_rule.guardduty[0].arn
34+
statement_id = "GuardDutyTrigger"
35+
}

‎main.tf‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,9 @@ module "tags" {
1111
}
1212

1313
locals {
14-
account_id = data.aws_caller_identity.current.account_id
15-
managed_policy_arns = var.use_cspm_permissions ? ["arn:aws:iam::aws:policy/SecurityAudit"] : []
16-
policy_file_path = var.use_full_permissions ? "${path.module}/iam-fullperms.json" : "${path.module}/iam-partialperms.json"
17-
tags = module.tags.tags_no_name
14+
account_id = data.aws_caller_identity.current.account_id
15+
policy_file_path = var.use_full_permissions ? "${path.module}/iam-fullperms.json" : "${path.module}/iam-partialperms.json"
16+
tags = module.tags.tags_no_name
1817
}
1918

2019
resource "datadog_api_key" "datadog" {
@@ -30,7 +29,7 @@ resource "datadog_integration_aws" "datadog" {
3029
}
3130

3231
resource "aws_secretsmanager_secret" "datadog" {
33-
name = "${var.name}-api-key"
32+
name_prefix = "${var.name}-api-key"
3433
description = "Datadog API Key"
3534
}
3635

@@ -58,10 +57,9 @@ data "aws_iam_policy_document" "assume" {
5857

5958
resource "aws_iam_role" "datadog" {
6059
# this cannot be a prefix or it will create a cycle with the DD integration
61-
name = "DatadogIntegrationRole"
62-
assume_role_policy = data.aws_iam_policy_document.assume.json
63-
managed_policy_arns = local.managed_policy_arns
64-
tags = local.tags
60+
name = "DatadogIntegrationRole"
61+
assume_role_policy = data.aws_iam_policy_document.assume.json
62+
tags = local.tags
6563
}
6664

6765
resource "aws_iam_policy" "datadog" {
@@ -71,6 +69,18 @@ resource "aws_iam_policy" "datadog" {
7169
tags = local.tags
7270
}
7371

72+
resource "aws_iam_role_policy_attachment" "cspm" { #tfsec:ignore:AVD-AWS-0057
73+
count = var.use_cspm_permissions ? 1 : 0
74+
75+
role = aws_iam_role.datadog.name
76+
policy_arn = "arn:aws:iam::aws:policy/SecurityAudit"
77+
}
78+
79+
resource "aws_iam_role_policy_attachment" "datadog" {
80+
role = aws_iam_role.datadog.name
81+
policy_arn = aws_iam_policy.datadog.arn
82+
}
83+
7484
resource "aws_cloudformation_stack" "datadog_forwarder" {
7585
count = var.install_log_forwarder ? 1 : 0
7686

‎outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "iam_role_datadog" {
2+
description = "IAM role assumed by Datadog resources"
3+
value = aws_iam_role.datadog.name
4+
}
5+
6+
output "lambda_arn_forwarder" {
7+
description = "DataDog Lambda Forwarder ARN"
8+
value = try(aws_cloudformation_stack.datadog_forwarder[0].outputs.DatadogForwarderArn, "")
9+
}

‎variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ variable "tags" {
1010
type = map(string)
1111
}
1212

13+
variable "cloudtrail_buckets" {
14+
default = []
15+
description = "Bucket(s) to collect CloudTrail logs from"
16+
type = list(string)
17+
}
18+
1319
variable "datadog_account_id" {
1420
default = "464622532012"
1521
description = "DataDog AWS account ID (should not need changed)"
@@ -22,6 +28,12 @@ variable "datadog_site_name" {
2228
type = string
2329
}
2430

31+
variable "enable_guardduty_notifications" {
32+
default = true
33+
description = "Send GuardDuty notifications to Datadog (`install_log_forwarder` must be true)"
34+
type = bool
35+
}
36+
2537
variable "install_log_forwarder" {
2638
default = true
2739
description = "controls whether log forwarder lambda should be installed"

0 commit comments

Comments
 (0)