terraform-aws-audit

This terraform module creates buckets that save cloudtrail and guardduty logs from all accounts.

The following resources will be created:

• IAM roles
• S3 buckets to save cloudtrail logs
• S3 buckets to save guardduty logs

In addition you have the options to:

• Set How many days before transitioning files to Glacier.
  • The default value is 90 days
• Create a read-only role for accessing audit account

Requirements

Name	Version
terraform	>= 0.12.0

Providers

Name	Version
aws	n/a

Inputs

Name	Description	Type	Default	Required
account_ids	AWS Account IDs under Auditing for the organization	list	[]	no
create_audit_role	Create a read-only role for accessing audit account	bool	true	no
idp_account_id	Account ID of IDP account (required when create_audit_role=true)	string	""	no
master_account_id	Master account ID	any	n/a	yes
org_name	Name for this organization (not actually used in API call)	any	n/a	yes
organization_id	Organization ID for CloudTrail access	any	n/a	yes
s3_days_until_glacier	How many days before transitioning files to Glacier	number	90	no

Outputs

Name	Description
cloudtrail_s3_bucket_id	ID of S3 bucket for cloudtrail
guardduty_s3_bucket_id	ID of S3 bucket for guardduty

Author

Module managed by DNX Solutions.

License

Apache 2 Licensed. See LICENSE for full details.