search

lacework / terraform-aws-agentless-scanning

Terraform module for configuring an integration with Lacework and AWS for agentless scanning
MIT License
4 stars 9 forks source link
terraform-module

readme

terraform-aws-agentless-scanning

GitHub release Codefresh build status

A Terraform Module to configure the Lacework Agentless Scanner.

Requirements

Name Version
terraform >= 0.15.0
aws >= 4.0
lacework ~> 2.0
random >= 2.1

Providers

Name Version
aws >= 4.0
lacework ~> 2.0
null n/a
random >= 2.1

Modules

No modules.

Resources

Name Type
aws_cloudwatch_event_rule.agentless_scan_event_rule resource
aws_cloudwatch_event_target.agentless_scan_event_target resource
aws_cloudwatch_log_group.agentless_scan_log_group resource
aws_default_network_acl.default resource
aws_default_security_group.default resource
aws_ecs_cluster.agentless_scan_ecs_cluster resource
aws_ecs_cluster_capacity_providers.agentless_scan_capacity_providers resource
aws_ecs_task_definition.agentless_scan_task_definition resource
aws_flow_log.agentless_scan_vpc_flow_log resource
aws_iam_policy.agentless_scan_task_policy resource
aws_iam_role.agentless_scan_cross_account_role resource
aws_iam_role.agentless_scan_ecs_event_role resource
aws_iam_role.agentless_scan_ecs_execution_role resource
aws_iam_role.agentless_scan_ecs_task_role resource
aws_iam_role.agentless_scan_snapshot_role resource
aws_iam_service_linked_role.agentless_scan_linked_role resource
aws_internet_gateway.agentless_scan_gateway resource
aws_route.agentless_scan_route resource
aws_route_table.agentless_scan_route_table resource
aws_route_table_association.agentless_scan_route_table_association resource
aws_s3_bucket.agentless_scan_bucket resource
aws_s3_bucket_lifecycle_configuration.agentless_scan_bucket_lifecyle resource
aws_s3_bucket_ownership_controls.agentless_scan_bucket_ownership_controls resource
aws_s3_bucket_policy.agentless_scan_bucket_policy resource
aws_s3_bucket_public_access_block.agentless_scan_bucket_public_access_block resource
aws_s3_bucket_server_side_encryption_configuration.agentless_scan_bucket_encryption resource
aws_s3_bucket_versioning.versioning_example resource
aws_secretsmanager_secret.agentless_scan_secret resource
aws_secretsmanager_secret_version.agentless_scan_secret_version resource
aws_security_group.agentless_scan_sec_group resource
aws_subnet.agentless_scan_public_subnet resource
aws_vpc.agentless_scan_vpc resource
lacework_external_id.aws_iam_external_id resource
lacework_integration_aws_agentless_scanning.lacework_cloud_account resource
lacework_integration_aws_org_agentless_scanning.lacework_cloud_account resource
null_resource.check_organization_requires_global_input resource
random_id.uniq resource
aws_caller_identity.current data source
aws_iam_policy_document.agentless_scan_bucket_policy data source
aws_iam_policy_document.agentless_scan_cross_account_policy data source
aws_iam_policy_document.agentless_scan_task_policy_document data source
aws_iam_policy_document.cross_account_inline_policy_bucket data source
aws_iam_policy_document.cross_account_inline_policy_ecs data source
aws_internet_gateway.selected data source
aws_region.current data source
aws_vpc.selected data source
lacework_metric_module.lwmetrics data source
lacework_user_profile.current data source

Inputs

Name Description Type Default Required
additional_environment_variables Optional list of additional environment variables passed to the ECS task. 
list(object({
    name  = string
    value = string
  }))
 [] no
agentless_scan_ecs_event_role_arn ECS event role ARN. Required input for regional resources. (Deprecated: use global_module_reference) string "" no
agentless_scan_ecs_execution_role_arn ECS execution role ARN. Required input for regional resources. (Deprecated: use global_module_reference) string "" no
agentless_scan_ecs_task_role_arn ECS task role ARN. Required input for regional resources. (Deprecated: use global_module_reference) string "" no
agentless_scan_secret_arn AWS SecretsManager Secret ARN for Lacework Account/Token. Required if Global is false and Regional is true. (Deprecated: use global_module_reference) string "" no
bucket_encryption_enabled Set this to false to disable setting S3 SSE. bool true no
bucket_force_destroy Force destroy bucket. (if disabled, terraform will not be able do destroy non-empty bucket) bool true no
bucket_sse_algorithm The encryption algorithm to use for S3 bucket server-side encryption. string "AES256" no
bucket_sse_key_arn The ARN of the KMS encryption key to be used for S3 (required when bucket_sse_algorithm is aws:kms). string "" no
bucket_tags Optional collection of tags to apply to the bucket map(string) {} no
cross_account_role_arn The IAM cross account role ARN is required when setting use_existing_cross_account_role to true string "" no
cross_account_role_name The IAM cross account role name. Required to match with cross_account_role_arn if use_existing_cross_account_role is set to true string "" no
external_id The external ID configured inside the IAM role used for cross account access string "" no
filter_query_text The LQL query to constrain the scanning to specific resources. If left blank, Lacework will scan all resources available to the account or organization. For more information, see Limit Scanned Workloads. string "" no
global Whether or not to create global resources. Defaults to false. bool false no
global_module_reference A reference to the global lacework_aws_agentless_scanning module for this account. 
object({
    agentless_scan_ecs_task_role_arn      = string
    agentless_scan_ecs_execution_role_arn = string
    agentless_scan_ecs_event_role_arn     = string
    agentless_scan_secret_arn             = string
    lacework_account                      = string
    lacework_domain                       = string
    external_id                           = string
    prefix                                = string
    suffix                                = string
  })
 
{
  "agentless_scan_ecs_event_role_arn": "",
  "agentless_scan_ecs_execution_role_arn": "",
  "agentless_scan_ecs_task_role_arn": "",
  "agentless_scan_secret_arn": "",
  "external_id": "",
  "lacework_account": "",
  "lacework_domain": "",
  "prefix": "",
  "suffix": ""
}
 no
iam_service_linked_role Whether or not to create aws_iam_service_linked_role. Defaults to false. bool false no
image_url The container image url for Lacework sidekick. string "public.ecr.aws/p5r4i7k7/sidekick:latest" no
lacework_account The name of the Lacework account with which to integrate. string "" no
lacework_aws_account_id The Lacework AWS account that the IAM role will grant access. string "434813966438" no
lacework_domain The domain of the Lacework account with with to integrate. string "lacework.net" no
lacework_integration_name The name of the Lacework cloud account integration. string "aws-agentless-scanning" no
org_account_mappings Mapping of AWS accounts to Lacework accounts within a Lacework organization 
list(object({
    default_lacework_account = string
    mapping = list(object({
      lacework_account = string
      aws_accounts     = list(string)
    }))
  }))
 [] no
organization Used for multi-account scanning. Set management_account to the AWS Organizations management account. Set the monitored_accounts list to a list of AWS account IDs or OUs. 
object({
    management_account = string
    monitored_accounts = list(string)
  })
 
{
  "management_account": "",
  "monitored_accounts": []
}
 no
prefix A string to be prefixed to the name of all new resources. string "lacework-agentless-scanning" no
regional Whether or not to create regional resources. Defaults to false. bool false no
scan_containers Whether to includes scanning for containers. Defaults to true. bool true no
scan_frequency_hours How often in hours the scan will run in hours. Defaults to 24. number 24 no
scan_host_vulnerabilities Whether to includes scanning for host vulnerabilities. Defaults to true. bool true no
scan_multi_volume Whether to scan secondary volumes. Defaults to false. bool false no
scan_stopped_instances Whether to scan stopped instances. Defaults to true. bool true no
secretsmanager_kms_key_id ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. string null no
security_group_id The ID of the security group to use for scanning compute resources. Must also set use_existing_security_group to true. string "" no
snapshot_role Whether or not to create an AWS Organization snapshot role. Defaults to false. bool false no
subnet_id The ID of the subnet to use for scanning compute resources. Must also set use_existing_subnet to true. string "" no
suffix A string to be appended to the end of the name of all new resources. string "" no
tags A map/dictionary of Tags to be assigned to created resources map(string) {} no
use_existing_cross_account_role Set this to true to use an existing IAM cross account role bool false no
use_existing_event_role Set this to true to use an existing IAM event role bool false no
use_existing_execution_role Set this to true to use an existing IAM execution role bool false no
use_existing_security_group Set this to true to use an existing security group for scanning compute resources. bool false no
use_existing_subnet Set this to true to use an existing subnet for scanning compute resources. bool false no
use_existing_task_role Set this to true to use an existing IAM task role bool false no
use_existing_vpc Set this to true to use an existing VPC. The VPC must have a Internet Gateway attached, and vpc_cidr_block will be used to create new subnet to isolate scanning resources. bool false no
use_internet_gateway Whether or not you want to use an 'AWS internet gateway' for internet facing traffic. Only set this to false if you route internet traffic using a different approach. bool true no
vpc_cidr_block VPC CIDR block used to isolate scanning VPC and single subnet. string "10.10.32.0/24" no
vpc_id The ID of an existing AWS VPC to use for deploying regional scan resources. Must have an Internet Gateway attached. string "" no

Outputs

Name Description
agentless_scan_ecs_event_role_arn Output ECS event role ARN.
agentless_scan_ecs_execution_role_arn Output ECS execution role ARN.
agentless_scan_ecs_task_role_arn Output ECS task role ARN.
agentless_scan_secret_arn AWS SecretsManager Secret ARN for Lacework Account and Token.
external_id External ID used for assuming snapshot creation and cross-account roles.
lacework_account Lacework Account Name for Integration.
lacework_domain Lacework Domain Name for Integration.
lacework_integration_guid The GUID for the created Lacework integration. This GUID is useful for interacting with this integration from the CLI or API.
prefix Prefix used to add uniqueness to resource names.
suffix Suffix used to add uniqueness to resource names.