diff --git a/.bumpversion.cfg b/.bumpversion.cfg index 0d9bde9..069b8e7 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 6.2.0 +current_version = 6.3.0 commit = True message = Bumps version to {new_version} tag = False diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c6dbdd..9904577 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,11 +4,21 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +### 6.3.0 + +**Released**: 2022.09.01 + +**Commit Delta**: [Change from 6.2.0 release](https://github.com/plus3it/terraform-aws-tardigrade-cloudtrail/compare/6.2.0...6.3.0) + +**Summary**: + +* Adds advanced_event_selectors support + ### 6.2.0 **Released**: 2022.08.22 -**Commit Delta**: [Change from 6.0.0 release](https://github.com/plus3it/terraform-aws-tardigrade-cloudtrail/compare/6.1.0...6.0.0) +**Commit Delta**: [Change from 6.1.0 release](https://github.com/plus3it/terraform-aws-tardigrade-cloudtrail/compare/6.1.0...6.2.0) **Summary**: diff --git a/README.md b/README.md index bcda899..5e2f7ec 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ AWS_PROFILE=xxx make terraform/pytest PYTEST_ARGS="-v --nomock" | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [advanced\_event\_selectors](#input\_advanced\_event\_selectors) | Specifies an advanced event selector for enabling data event logging. Contains an options name for the selector and a list of maps specifying field\_selectors. See https://www.terraform.io/docs/providers/aws/r/cloudtrail.html for more information regarding the field selectors | `list(any)` | `[]` | no | | [cloud\_watch\_logs\_group\_name](#input\_cloud\_watch\_logs\_group\_name) | (Optional) Name of preexisting log group to use; by default the module will create a log group | `string` | `null` | no | | [cloud\_watch\_logs\_role\_arn](#input\_cloud\_watch\_logs\_role\_arn) | (Optional) Specifies the role for the CloudWatch Logs endpoint to assume to write to a user’s log group. | `string` | `null` | no | | [cloudtrail\_bucket](#input\_cloudtrail\_bucket) | Name of S3 bucket to send CloudTrail logs; bucket must already exist | `string` | `null` | no | diff --git a/main.tf b/main.tf index 05392bc..80138a4 100644 --- a/main.tf +++ b/main.tf @@ -79,18 +79,36 @@ resource "aws_cloudtrail" "this" { cloud_watch_logs_role_arn = var.use_cloud_watch_logs ? local.cloud_watch_logs_role_arn : null dynamic "event_selector" { - iterator = event_selectors for_each = var.event_selectors content { - read_write_type = lookup(event_selectors.value, "read_write_type", "All") - include_management_events = lookup(event_selectors.value, "include_management_events", "true") + read_write_type = try(event_selector.value.read_write_type, "All") + include_management_events = try(event_selector.value.include_management_events, "true") dynamic "data_resource" { - iterator = data_resources - for_each = lookup(event_selectors.value, "data_resources", []) + for_each = try(event_selector.value.data_resources, []) content { - type = lookup(data_resources.value, "type", null) - values = lookup(data_resources.value, "values", []) + type = try(data_resource.value.type, null) + values = try(data_resource.value.values, []) + } + } + } + } + + dynamic "advanced_event_selector" { + for_each = var.advanced_event_selectors + content { + name = try(advanced_event_selector.value.name, null) //optional + + dynamic "field_selector" { + for_each = try(advanced_event_selector.value.field_selectors, []) + content { + field = try(field_selector.value.field, null) //required + equals = try(field_selector.value.equals, null) //optional + not_equals = try(field_selector.value.not_equals, null) //optional + starts_with = try(field_selector.value.starts_with, null) //optional + not_starts_with = try(field_selector.value.not_starts_with, null) //optional + ends_with = try(field_selector.value.ends_with, null) //optional + not_ends_with = try(field_selector.value.not_ends_with, null) //optional } } } diff --git a/tests/advanced_event_selector/main.tf b/tests/advanced_event_selector/main.tf new file mode 100644 index 0000000..8be15cf --- /dev/null +++ b/tests/advanced_event_selector/main.tf @@ -0,0 +1,53 @@ +data "aws_partition" "current" {} + +data "terraform_remote_state" "prereq" { + backend = "local" + config = { + path = "prereq/terraform.tfstate" + } +} + +locals { + test_id = data.terraform_remote_state.prereq.outputs.random_name +} + +resource "aws_s3_bucket" "this" { + bucket = local.test_id + force_destroy = true + + policy = templatefile( + "${path.module}/../templates/cloudtrail-bucket-policy.json", + { + bucket = local.test_id + partition = data.aws_partition.current.partition + } + ) +} + +module "advanced_event_selector" { + source = "../../" + + cloudtrail_name = local.test_id + cloudtrail_bucket = aws_s3_bucket.this.id + kms_key_alias = local.test_id + + advanced_event_selectors = [ + { + name = "S3EventSelector" + field_selectors = [ + { + field = "eventCategory" + equals = ["Data"] + }, + { + field = "resources.type" + equals = ["AWS::S3::Object"] + }, + { + field = "resources.ARN" + starts_with = ["arn:aws:s3:::test"] + } + ] + }, + ] +} diff --git a/tests/advanced_event_selector/prereq/main.tf b/tests/advanced_event_selector/prereq/main.tf new file mode 100644 index 0000000..ce23594 --- /dev/null +++ b/tests/advanced_event_selector/prereq/main.tf @@ -0,0 +1,8 @@ +resource "random_id" "name" { + byte_length = 6 + prefix = "tardigrade-cloudtrail-" +} + +output "random_name" { + value = random_id.name.hex +} diff --git a/variables.tf b/variables.tf index 8bbabba..5722e49 100644 --- a/variables.tf +++ b/variables.tf @@ -88,6 +88,12 @@ variable "event_selectors" { default = [] } +variable "advanced_event_selectors" { + description = "Specifies an advanced event selector for enabling data event logging. Contains an options name for the selector and a list of maps specifying field_selectors. See https://www.terraform.io/docs/providers/aws/r/cloudtrail.html for more information regarding the field selectors" + type = list(any) + default = [] +} + variable "tags" { description = "A map of tags to add to the cloudtrail resource" type = map(string)