v4.0

v4.0 - add cloudtrail_cw_log_group_name output

v3.4

remove default region value

v3.3

update s3 bucket to a more restricted policy that was tested to still work while enforcing more control on who can send logs to that bucket

v3.2

fix s3 policy for cloudtrail due to issues with last deployment

v3.1

moved delegated admin from module directly to mgmt account

v3

The latest configuration sets up an AWS CloudTrail trail that delivers logs to both an S3 bucket and a CloudWatch Log Group with the necessary IAM role and policy for CloudTrail to write logs to CloudWatch.

v2.1

The latest changes fix a provider warning by adding the required filter block to each rule in the aws_s3_bucket_lifecycle_configuration. Omitting the filter and the deprecated prefix will become an error in future Terraform AWS provider versions.

│ Warning: Invalid Attribute Combination
│
│ with module.cloudtrail_mgmt_acc.aws_s3_bucket_lifecycle_configuration.s3_bucket_lifecycle,
│ on .terraform/modules/cloudtrail_mgmt_acc/s3.tf line 15, in resource "aws_s3_bucket_lifecycle_configuration" "s3_bucket_lifecycle":
│ 15: resource "aws_s3_bucket_lifecycle_configuration" "s3_bucket_lifecycle" {
│
│ No attribute specified when one (and only one) of [rule[0].filter,rule[0].prefix] is required
│
│ This will be an error in a future version of the provider
│
│ (and 2 more similar warnings elsewhere)
╵

v2

Organization cloudtrail managed from security account and sending logs to s3 in audit account

v1

Custom ITGix terraform module for Cloudtrail resources in AWS.