forked from cloudposse/terraform-aws-firewall-manager
-
Notifications
You must be signed in to change notification settings - Fork 2
/
main.tf
42 lines (40 loc) · 3.05 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
locals {
enabled = module.this.enabled
security_groups_common_policies = local.enabled && length(var.security_groups_common_policies) > 0 ? { for policy in flatten(var.security_groups_common_policies) : policy.name => policy } : {}
security_groups_content_audit_policies = local.enabled && length(var.security_groups_content_audit_policies) > 0 ? { for policy in flatten(var.security_groups_content_audit_policies) : policy.name => policy } : {}
security_groups_usage_audit_policies = local.enabled && length(var.security_groups_usage_audit_policies) > 0 ? { for policy in flatten(var.security_groups_usage_audit_policies) : policy.name => policy } : {}
shield_advanced_global_policies = local.enabled && length(var.shield_advanced_global_policies) > 0 ? { for policy in flatten(var.shield_advanced_global_policies) : policy.name => policy } : {}
shield_advanced_regional_policies = local.enabled && length(var.shield_advanced_regional_policies) > 0 ? { for policy in flatten(var.shield_advanced_regional_policies) : policy.name => policy } : {}
waf_regional_policies = local.enabled && length(var.waf_regional_policies) > 0 ? { for policy in flatten(var.waf_regional_policies) : policy.name => policy } : {}
waf_v2_regional_policies = local.enabled && length(var.waf_v2_regional_policies) > 0 ? { for policy in flatten(var.waf_v2_regional_policies) : policy.name => policy } : {}
waf_global_policies = local.enabled && length(var.waf_global_policies) > 0 ? { for policy in flatten(var.waf_global_policies) : policy.name => policy } : {}
waf_v2_global_policies = local.enabled && length(var.waf_v2_global_policies) > 0 ? { for policy in flatten(var.waf_v2_global_policies) : policy.name => policy } : {}
dns_firewall_policies = local.enabled && length(var.dns_firewall_policies) > 0 ? { for policy in flatten(var.dns_firewall_policies) : policy.name => policy } : {}
network_firewall_policies = local.enabled && length(var.network_firewall_policies) > 0 ? { for policy in flatten(var.network_firewall_policies) : policy.name => policy } : {}
logging_config_firehose_arn = {
logDestinationConfigs : [var.firehose_arn],
redactedFields : [{
redactedFieldType : "SingleHeader",
redactedFieldValue : "Cookies"
},
{
redactedFieldType : "Method"
}]
}
logging_config_firehose_enabled = {
logDestinationConfigs : [join("", aws_kinesis_firehose_delivery_stream.firehose_stream.*.id)],
redactedFields : [{
redactedFieldType : "SingleHeader",
redactedFieldValue : "Cookies"
},
{
redactedFieldType : "Method"
}]
}
logging_configuration = local.enabled ? (var.firehose_enabled ? local.logging_config_firehose_enabled : (var.firehose_arn != null ? local.logging_config_firehose_arn : null)) : null
}
resource "aws_fms_admin_account" "default" {
count = local.enabled && var.admin_account_enabled ? 1 : 0
provider = aws.admin
account_id = var.admin_account_id
}