diff --git a/README.md b/README.md
index 621ae76..38f863b 100644
--- a/README.md
+++ b/README.md
@@ -12,14 +12,14 @@ Terraform module for configuring an integration with Lacework and AWS for cloud
| Name | Version |
|------|---------|
| [terraform](#requirement\_terraform) | >= 0.14 |
-| [aws](#requirement\_aws) | >= 3.35.0 |
+| [aws](#requirement\_aws) | >= 3.55.0 |
## Providers
| Name | Version |
|------|---------|
| [archive](#provider\_archive) | n/a |
-| [aws](#provider\_aws) | >= 3.35.0 |
+| [aws](#provider\_aws) | >= 3.55.0 |
## Modules
@@ -77,6 +77,10 @@ No modules.
| [lacework\_subaccount](#input\_lacework\_subaccount) | If Lacework Organizations is enabled, enter the sub-account. Leave blank if Lacework Organizations is not enabled. | `string` | `""` | no |
| [organization\_id](#input\_organization\_id) | AWS Organization ID where these resources are being deployed into | `string` | n/a | yes |
| [organization\_unit](#input\_organization\_unit) | Organizational Unit ID that the stackset will be deployed into | `list(string)` | n/a | yes |
+| [stackset\_failure\_tolerance\_count](#input\_stackset\_failure\_tolerance\_count) | The maxiumum number of failed AWS account integrations to tolerate | `number` | `5` | no |
+| [stackset\_managed\_execution](#input\_stackset\_managed\_execution) | Allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations. | `bool` | `true` | no |
+| [stackset\_max\_concurrent\_count](#input\_stackset\_max\_concurrent\_count) | The maximum number of AWS accounts to deploy to concurrently | `number` | `50` | no |
+| [stackset\_region\_concurrency\_type](#input\_stackset\_region\_concurrency\_type) | Allow stackset instance deployment to run in parallel | `string` | `"PARALLEL"` | no |
## Outputs
diff --git a/main.tf b/main.tf
index 47bbf25..7397f91 100644
--- a/main.tf
+++ b/main.tf
@@ -1,4 +1,16 @@
locals {
+ # Python3.9 support introduced in version 3.55.0
+ # https://github.com/hashicorp/terraform-provider-aws/blob/release/3.x/CHANGELOG.md#3550-august-19-2021
+ python_version = "python3.9"
+
+ # Python3.10 support introduced in version 4.64.0
+ # https://github.com/hashicorp/terraform-provider-aws/blob/release/4.x/CHANGELOG.md#4640-april-20-2023
+ # python_version = "python3.10"
+
+ # Python3.11 support introduced in version 5.11.0
+ # https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#5110-august--3-2023
+ # python_version = "python3.11"
+
kms_key_arn = length(var.kms_key_arn) > 0 ? var.kms_key_arn : aws_kms_key.lacework_kms_key[0].arn
lambda_zip = "LaceworkIntegrationSetup1.1.2.zip"
s3_lambda_key = "${var.cf_s3_prefix}/lambda/${local.lambda_zip}"
@@ -44,9 +56,9 @@ resource "aws_lambda_function" "lacework_copy_zip_files" {
function_name = "lacework_copy_zip_files"
handler = "index.handler"
role = aws_iam_role.lacework_copy_zip_files_role.arn
- runtime = "python3.11"
source_code_hash = data.archive_file.lambda_zip_file.output_base64sha256
timeout = 240
+ runtime = local.python_version
tracing_config {
mode = "Active"
@@ -143,10 +155,10 @@ resource "aws_lambda_function" "lacework_setup_function" {
function_name = "lacework_setup_function"
handler = "lw_integration_lambda_function.handler"
role = aws_iam_role.lacework_setup_function_role.arn
- runtime = "python3.11"
s3_bucket = aws_s3_bucket.lacework_org_lambda.bucket
s3_key = local.s3_lambda_key
timeout = 900
+ runtime = local.python_version
tracing_config {
mode = "Active"
@@ -326,8 +338,7 @@ resource "aws_cloudformation_stack" "lacework_stack" {
}
template_url = "https://s3.amazonaws.com/${var.cf_s3_bucket}/${var.cf_s3_prefix}/templates/lacework-aws-cfg-member.template.yml"
timeout_in_minutes = 30
-
- depends_on = [ // depending on all this ensures the stack can be torn down
+ depends_on = [ // depending on all this ensures the stackinstances can be torn down properly
aws_s3_bucket.lacework_org_lambda,
aws_sns_topic.lacework_sns_topic,
aws_sns_topic_subscription.lacework_sns_subscription,
@@ -353,22 +364,19 @@ resource "aws_cloudformation_stack_set" "lacework_stackset" {
ignore_changes = [administration_role_arn]
}
- operation_preferences {
- failure_tolerance_count = 20
- max_concurrent_percentage = 100
- }
-
parameters = {
LaceworkAccount = var.lacework_account
MainAccountSNS = aws_sns_topic.lacework_sns_topic.arn
ResourceNamePrefix = var.cf_resource_prefix
}
+ managed_execution {
+ active = var.stackset_managed_execution
+ }
+
permission_model = "SERVICE_MANAGED"
template_url = "https://s3.amazonaws.com/${var.cf_s3_bucket}/${var.cf_s3_prefix}/templates/lacework-aws-cfg-member.template.yml"
-
-
- depends_on = [ // depending on all this ensures the stackinstances can be torn down
+ depends_on = [ // depending on all this ensures the stackinstances can be torn down properly
aws_s3_bucket.lacework_org_lambda,
aws_sns_topic.lacework_sns_topic,
aws_sns_topic_subscription.lacework_sns_subscription,
@@ -386,6 +394,21 @@ resource "aws_cloudformation_stack_set_instance" "lacework_stackset_instances" {
organizational_unit_ids = var.organization_unit
}
+ operation_preferences {
+ failure_tolerance_count = var.stackset_failure_tolerance_count
+ max_concurrent_count = var.stackset_max_concurrent_count
+ region_concurrency_type = var.stackset_region_concurrency_type
+ }
+
region = data.aws_region.current.name
stack_set_name = aws_cloudformation_stack_set.lacework_stackset.name
+ depends_on = [ // depending on all this ensures the stackinstances can be torn down properly
+ aws_s3_bucket.lacework_org_lambda,
+ aws_sns_topic.lacework_sns_topic,
+ aws_sns_topic_subscription.lacework_sns_subscription,
+ aws_sns_topic_policy.default,
+ aws_lambda_permission.lacework_lambda_permission,
+ aws_secretsmanager_secret.lacework_api_credentials,
+ aws_lambda_function.lacework_setup_function
+ ]
}
diff --git a/variables.tf b/variables.tf
index 13d0d88..f35a7b5 100644
--- a/variables.tf
+++ b/variables.tf
@@ -95,3 +95,27 @@ variable "kms_key_multi_region" {
default = true
description = "Whether the KMS key is a multi-region or regional key"
}
+
+variable "stackset_max_concurrent_count" {
+ type = number
+ default = 50
+ description = "The maximum number of AWS accounts to deploy to concurrently"
+}
+
+variable "stackset_failure_tolerance_count" {
+ type = number
+ default = 5
+ description = "The maxiumum number of failed AWS account integrations to tolerate"
+}
+
+variable "stackset_region_concurrency_type" {
+ type = string
+ default = "PARALLEL"
+ description = "Allow stackset instance deployment to run in parallel"
+}
+
+variable "stackset_managed_execution" {
+ type = bool
+ default = true
+ description = "Allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations."
+}
diff --git a/versions.tf b/versions.tf
index 33402f0..0738c65 100644
--- a/versions.tf
+++ b/versions.tf
@@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
- version = ">= 3.35.0"
+ version = ">= 3.55.0"
}
}
}