FIXED

- fixed AWSConfigRole to AWS_ConfigRole for AWS Config. - fixed retention_in_days 7 to 14. - fixed tfbackground key. - fixed versioning for s3.
y-miyazaki · Oct 31, 2022 · 43c2242 · 43c2242
1 parent 904055f
commit 43c2242
Show file tree

Hide file tree

Showing 6 changed files with 238 additions and 235 deletions.
diff --git a/modules/aws/recipes/iam/role/config/main.tf b/modules/aws/recipes/iam/role/config/main.tf
@@ -36,218 +36,9 @@ POLICY
   tags                  = local.tags
 }
 #--------------------------------------------------------------
-# Generates an IAM policy document in JSON format for use with resources that expect policy documents such as aws_iam_policy.
-#--------------------------------------------------------------
-#tfsec:ignore:AWS097
-data "aws_iam_policy_document" "this" {
-  statement {
-    effect = "Allow"
-    actions = [
-      "acm:DescribeCertificate",
-      "acm:ListCertificates",
-      "acm:ListTagsForCertificate",
-      "application-autoscaling:DescribeScalableTargets",
-      "application-autoscaling:DescribeScalingPolicies",
-      "autoscaling:DescribeAutoScalingGroups",
-      "autoscaling:DescribeLaunchConfigurations",
-      "autoscaling:DescribeLifecycleHooks",
-      "autoscaling:DescribePolicies",
-      "autoscaling:DescribeScheduledActions",
-      "autoscaling:DescribeTags",
-      "backup:ListBackupPlans",
-      "backup:ListBackupSelections",
-      "backup:GetBackupSelection",
-      "cloudfront:ListTagsForResource",
-      "cloudformation:DescribeType",
-      "cloudformation:ListTypes",
-      "cloudtrail:DescribeTrails",
-      "cloudtrail:GetEventSelectors",
-      "cloudtrail:GetTrailStatus",
-      "cloudtrail:ListTags",
-      "cloudwatch:DescribeAlarms",
-      "codepipeline:GetPipeline",
-      "codepipeline:GetPipelineState",
-      "codepipeline:ListPipelines",
-      "config:BatchGet*",
-      "config:Describe*",
-      "config:Get*",
-      "config:List*",
-      "config:Put*",
-      "config:Select*",
-      "dax:DescribeClusters",
-      "dms:DescribeReplicationInstances",
-      "dynamodb:DescribeContinuousBackups",
-      "dynamodb:DescribeLimits",
-      "dynamodb:DescribeTable",
-      "dynamodb:ListTables",
-      "dynamodb:ListTagsOfResource",
-      "ec2:Describe*",
-      "ec2:GetEbsEncryptionByDefault",
-      "ecr:DescribeRepositories",
-      "ecr:GetLifecyclePolicy",
-      "ecr:GetRepositoryPolicy",
-      "ecr:ListTagsForResource",
-      "ecs:DescribeClusters",
-      "ecs:DescribeServices",
-      "ecs:DescribeTaskDefinition",
-      "ecs:DescribeTaskSets",
-      "ecs:ListClusters",
-      "ecs:ListServices",
-      "ecs:ListTagsForResource",
-      "ecs:ListTaskDefinitions",
-      "eks:DescribeCluster",
-      "eks:DescribeNodegroup",
-      "eks:ListClusters",
-      "eks:ListNodegroups",
-      "elasticache:DescribeCacheClusters",
-      "elasticache:DescribeReplicationGroups",
-      "elasticfilesystem:DescribeFileSystems",
-      "elasticfilesystem:DescribeLifecycleConfiguration",
-      "elasticfilesystem:DescribeMountTargets",
-      "elasticfilesystem:DescribeMountTargetSecurityGroups",
-      "elasticloadbalancing:DescribeListeners",
-      "elasticloadbalancing:DescribeLoadBalancerAttributes",
-      "elasticloadbalancing:DescribeLoadBalancerPolicies",
-      "elasticloadbalancing:DescribeLoadBalancers",
-      "elasticloadbalancing:DescribeRules",
-      "elasticloadbalancing:DescribeTags",
-      "elasticmapreduce:DescribeCluster",
-      "elasticmapreduce:DescribeSecurityConfiguration",
-      "elasticmapreduce:GetBlockPublicAccessConfiguration",
-      "elasticmapreduce:ListClusters",
-      "elasticmapreduce:ListInstances",
-      "es:DescribeElasticsearchDomain",
-      "es:DescribeElasticsearchDomains",
-      "es:ListDomainNames",
-      "es:ListTags",
-      "guardduty:GetDetector",
-      "guardduty:GetFindings",
-      "guardduty:GetMasterAccount",
-      "guardduty:ListDetectors",
-      "guardduty:ListFindings",
-      "iam:GenerateCredentialReport",
-      "iam:GetAccountAuthorizationDetails",
-      "iam:GetAccountPasswordPolicy",
-      "iam:GetAccountSummary",
-      "iam:GetCredentialReport",
-      "iam:GetGroup",
-      "iam:GetGroupPolicy",
-      "iam:GetPolicy",
-      "iam:GetPolicyVersion",
-      "iam:GetRole",
-      "iam:GetRolePolicy",
-      "iam:GetUser",
-      "iam:GetUserPolicy",
-      "iam:ListAttachedGroupPolicies",
-      "iam:ListAttachedRolePolicies",
-      "iam:ListAttachedUserPolicies",
-      "iam:ListEntitiesForPolicy",
-      "iam:ListGroupPolicies",
-      "iam:ListGroupsForUser",
-      "iam:ListInstanceProfilesForRole",
-      "iam:ListPolicyVersions",
-      "iam:ListRolePolicies",
-      "iam:ListUserPolicies",
-      "iam:ListVirtualMFADevices",
-      "kms:DescribeKey",
-      "kms:GetKeyPolicy",
-      "kms:GetKeyRotationStatus",
-      "kms:ListKeys",
-      "kms:ListResourceTags",
-      "lambda:GetAlias",
-      "lambda:GetFunction",
-      "lambda:GetPolicy",
-      "lambda:ListAliases",
-      "lambda:ListFunctions",
-      "logs:DescribeLogGroups",
-      "organizations:DescribeOrganization",
-      "rds:DescribeDBClusters",
-      "rds:DescribeDBClusterSnapshotAttributes",
-      "rds:DescribeDBClusterSnapshots",
-      "rds:DescribeDBInstances",
-      "rds:DescribeDBSecurityGroups",
-      "rds:DescribeDBSnapshotAttributes",
-      "rds:DescribeDBSnapshots",
-      "rds:DescribeDBSubnetGroups",
-      "rds:DescribeEventSubscriptions",
-      "rds:ListTagsForResource",
-      "redshift:DescribeClusterParameterGroups",
-      "redshift:DescribeClusterParameters",
-      "redshift:DescribeClusterSecurityGroups",
-      "redshift:DescribeClusterSnapshots",
-      "redshift:DescribeClusterSubnetGroups",
-      "redshift:DescribeClusters",
-      "redshift:DescribeEventSubscriptions",
-      "redshift:DescribeLoggingStatus",
-      "s3:GetAccelerateConfiguration",
-      "s3:GetAccountPublicAccessBlock",
-      "s3:GetBucketAcl",
-      "s3:GetBucketCORS",
-      "s3:GetBucketLocation",
-      "s3:GetBucketLogging",
-      "s3:GetBucketNotification",
-      "s3:GetBucketObjectLockConfiguration",
-      "s3:GetBucketPolicy",
-      "s3:GetBucketPublicAccessBlock",
-      "s3:GetBucketRequestPayment",
-      "s3:GetBucketTagging",
-      "s3:GetBucketVersioning",
-      "s3:GetBucketWebsite",
-      "s3:GetEncryptionConfiguration",
-      "s3:GetLifecycleConfiguration",
-      "s3:GetReplicationConfiguration",
-      "s3:ListAllMyBuckets",
-      "s3:ListBucket",
-      "sagemaker:DescribeEndpointConfig",
-      "sagemaker:DescribeNotebookInstance",
-      "sagemaker:ListEndpointConfigs",
-      "sagemaker:ListNotebookInstances",
-      "secretsmanager:ListSecrets",
-      "secretsmanager:ListSecretVersionIds",
-      "securityhub:describeHub",
-      "shield:DescribeDRTAccess",
-      "shield:DescribeProtection",
-      "shield:DescribeSubscription",
-      "sns:GetTopicAttributes",
-      "sns:ListSubscriptions",
-      "sns:ListTagsForResource",
-      "sns:ListTopics",
-      "sqs:GetQueueAttributes",
-      "sqs:ListQueues",
-      "sqs:ListQueueTags",
-      "ssm:DescribeAutomationExecutions",
-      "ssm:DescribeDocument",
-      "ssm:GetAutomationExecution",
-      "ssm:GetDocument",
-      "storagegateway:ListGateways",
-      "storagegateway:ListVolumes",
-      "support:DescribeCases",
-      "tag:GetResources",
-      "waf:GetLoggingConfiguration",
-      "waf:GetWebACL",
-      "wafv2:GetLoggingConfiguration",
-      "waf-regional:GetLoggingConfiguration",
-      "waf-regional:GetWebACL",
-      "waf-regional:GetWebACLForResource"
-    ]
-    resources = ["*"]
-  }
-}
-
-#--------------------------------------------------------------
-# Provides an IAM policy.
-#--------------------------------------------------------------
-#tfsec:ignore:AWS099
-resource "aws_iam_policy" "this" {
-  description = lookup(var.aws_iam_policy, "description", null)
-  name        = lookup(var.aws_iam_policy, "name")
-  path        = lookup(var.aws_iam_policy, "path", "/")
-  policy      = data.aws_iam_policy_document.this.json
-}
-#--------------------------------------------------------------
 # Attaches a Managed IAM Policy to an IAM role
 #--------------------------------------------------------------
 resource "aws_iam_role_policy_attachment" "this" {
   role       = aws_iam_role.this.name
-  policy_arn = aws_iam_policy.this.arn
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole"
 }
diff --git a/modules/aws/recipes/lambda/create/variables.tf b/modules/aws/recipes/lambda/create/variables.tf
@@ -17,7 +17,7 @@ variable "aws_cloudwatch_log_group" {
   )
   description = "(Optional) The aws_cloudwatch_log_group."
   default = {
-    retention_in_days = 7
+    retention_in_days = 14
     kms_key_id        = null
   }
 }

diff --git a/modules/aws/recipes/security/config/create-v4/main.tf b/modules/aws/recipes/security/config/create-v4/main.tf
@@ -45,7 +45,8 @@ POLICY
 resource "aws_iam_role_policy_attachment" "config" {
   count      = var.is_enabled ? 1 : 0
   role       = aws_iam_role.config[0].name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
+  # https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/security-iam-awsmanpol.html
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole"
 }
 #--------------------------------------------------------------
 # Provides an AWS Config Configuration Recorder. Please note that this resource does not start the created recorder automatically.

diff --git a/terraform/base/terraform.example.tfbackend b/terraform/base/terraform.example.tfbackend
@@ -1,4 +1,4 @@
 bucket  = "terraform-state-xxxxxxxx"
-key     = "terraform.tfstate"
+key     = "terraform.base.tfstate"
 profile = "default"    # fix for environment
 region  = "ap-northeast-1" # fix for environment