Module - SIEM - Dev siem aws cloudtrail datasource

thinkstack-co / terraform-modules

Terraform modules

MIT License

7 stars 4 forks source link

Module - SIEM - Dev siem aws cloudtrail datasource #101

Closed zachreborn closed 2 years ago

zachreborn commented 2 years ago

This change to the SIEM module is in order to automate the deployment and configuration for Cloudtrail log monitoring in a SIEM platform, such as Securonix or Elastic.

This module has a new boolean trigger 'enable_siem_cloudtrail_logs' which when set to 'true' will create the following resources:

KMS Key
SQS Queue
S3 Bucket
Cloudtrail trail
IAM Group
IAM Policy
IAM User

zachreborn commented 2 years ago

This can be seen working successfully within the following runs:

https://app.terraform.io/app/thinkstack-co/workspaces/ventura_prod_snypr/runs/run-ibGsxFkmmwTtAhfv https://app.terraform.io/app/thinkstack-co/workspaces/ventura_prod_snypr/runs/run-a5mBkipdsTkdH96G

jakeasarus commented 2 years ago

This really was a big one!

Looks good, but you are 2 commits behind master. Pull master and merge into your branch to catch it up and I will approve.

zachreborn commented 2 years ago

This really was a big one!

Looks good, but you are 2 commits behind master. Pull master and merge into your branch to catch it up and I will approve.

Completed! Guess I didn't fetch on merge or something.