feat: 각 계정별 guardduty 활성화

dev-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-dev-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-dev-lock"
+  }
+}

dev-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

dev-team-account/state/dynamodb/main.tf

@@ -19,7 +19,8 @@ locals {
     "ssm",
     "cloudwatch",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }
 

identity-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-identity-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-identity-lock"
+  }
+}

identity-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

identity-team-account/state/dynamodb/main.tf

@@ -18,7 +18,8 @@ locals {
     "ssoadmin",
     "identitystore",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }
 

management-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-management-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-management-lock"
+  }
+}

management-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

management-team-account/state/dynamodb/main.tf

@@ -16,7 +16,8 @@ locals {
   resources = [
     "cloudtrail",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }
 

modules/guardduty-detector/main.tf

@@ -0,0 +1,3 @@
+resource "aws_guardduty_detector" "this" {
+  enable = var.enable
+}

modules/guardduty-detector/outputs.tf

@@ -0,0 +1,4 @@
+output "guardduty_detector_id" {
+  description = "The ID of the GuardDuty detector"
+  value       = aws_guardduty_detector.this.id
+}

modules/guardduty-detector/variables.tf

@@ -0,0 +1,5 @@
+variable "enable" {
+  type        = bool
+  description = "Whether to enable GuardDuty"
+  default     = true
+}

operation-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-operation-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-operation-lock"
+  }
+}

operation-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

operation-team-account/state/dynamodb/main.tf

@@ -21,7 +21,8 @@ locals {
     "eventbridge",
     "lambda",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }
 

prod-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-prod-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-prod-lock"
+  }
+}

prod-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

prod-team-account/state/dynamodb/main.tf

@@ -22,7 +22,8 @@ locals {
     "codedeploy",
     "deploy",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }
 

security-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-security-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-security-lock"
+  }
+}

security-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

security-team-account/state/dynamodb/main.tf

@@ -20,7 +20,8 @@ locals {
     "securityhub",
     "config",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }
 

stage-team-account/guardduty-detector/backend.tf

@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "cloudfence-stage-state"
+    key            = "guardduty-detector/guardduty.tfstate"
+    region         = "ap-northeast-2"
+    encrypt        = true
+    dynamodb_table = "guardduty-stage-lock"
+  }
+}

stage-team-account/guardduty-detector/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "operation"
+  region = "ap-northeast-2"
+}
+
+module "guardduty-detector" {
+  source = "../../modules/guardduty-detector"
+  enable = true
+}

stage-team-account/state/dynamodb/main.tf

@@ -22,7 +22,8 @@ locals {
     "codedeploy",
     "deploy",
     "dynamodb",
-    "s3"
+    "s3",
+    "guardduty"
   ]
 }