# config Deploys AWS Config with an organization aggregator, delivery channel, managed rules, and conformance packs. Creates a Config recorder and delivery channel backed by a central S3 bucket, configures an organization-wide aggregator, and provisions a default set of managed rules covering root MFA, password policy, CloudTrail, S3 public access, EBS encryption, and GuardDuty. Additional managed rules and conformance packs are configurable via variables. Requires the `storage/s3-bucket` module for the delivery bucket and the `governance/organization` module to have trusted-access for `config.amazonaws.com` enabled. ## Usage ```hcl module "config" { source = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/config/aws" version = "0.1.0" s3_bucket_name = module.config_bucket.id } ``` ## Requirements | Name | Version | | ---- | ------- | | [terraform](#requirement_terraform) | ~> 1.5 | | [aws](#requirement_aws) | ~> 6.50 | ## Providers | Name | Version | | ---- | ------- | | [aws](#provider_aws) | 6.50.0 | ## Resources | Name | Type | | ---- | ---- | | [aws_config_config_rule.managed](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_config_rule) | resource | | [aws_config_configuration_aggregator.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_configuration_aggregator) | resource | | [aws_config_configuration_recorder.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_configuration_recorder) | resource | | [aws_config_configuration_recorder_status.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_configuration_recorder_status) | resource | | [aws_config_conformance_pack.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_conformance_pack) | resource | | [aws_config_delivery_channel.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_delivery_channel) | resource | | [aws_iam_role.config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy_attachment.config_managed](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | ## Inputs | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | [s3_bucket_name](#input_s3_bucket_name) | S3 bucket name for AWS Config delivery | `string` | n/a | yes | | [aggregator_name](#input_aggregator_name) | Name for the organization Config aggregator | `string` | `"org-aggregator"` | no | | [all_supported](#input_all_supported) | Record all supported resource types | `bool` | `true` | no | | [conformance_packs](#input_conformance_packs) | Map of conformance pack names to S3 template URI or inline template body |

map(object({
    template_body    = optional(string, null)
    template_s3_uri  = optional(string, null)
    input_parameters = optional(map(string), {})
  }))

| `{}` | no | | [delivery_frequency](#input_delivery_frequency) | Frequency for Config configuration snapshots | `string` | `"TwentyFour_Hours"` | no | | [include_global_resource_types](#input_include_global_resource_types) | Include global resource types (IAM) in recording | `bool` | `true` | no | | [managed_rules](#input_managed_rules) | Map of managed Config rules to deploy |

map(object({
    source_identifier           = string
    description                 = string
    input_parameters            = optional(map(string), {})
    maximum_execution_frequency = optional(string, null)
  }))

{
  "cloudtrail_enabled": {
    "description": "Ensure CloudTrail is enabled",
    "source_identifier": "CLOUD_TRAIL_ENABLED"
  },
  "ebs_encryption": {
    "description": "Ensure EBS encryption by default is enabled",
    "source_identifier": "EC2_EBS_ENCRYPTION_BY_DEFAULT"
  },
  "guardduty_enabled": {
    "description": "Ensure GuardDuty is enabled",
    "source_identifier": "GUARDDUTY_ENABLED_CENTRALIZED"
  },
  "iam_password_policy": {
    "description": "Ensure IAM password policy meets minimum requirements",
    "input_parameters": {
      "MaxPasswordAge": "90",
      "MinimumPasswordLength": "14",
      "PasswordReusePrevention": "24",
      "RequireLowercaseCharacters": "true",
      "RequireNumbers": "true",
      "RequireSymbols": "true",
      "RequireUppercaseCharacters": "true"
    },
    "source_identifier": "IAM_PASSWORD_POLICY"
  },
  "root_mfa_enabled": {
    "description": "Ensure MFA is enabled for the root account",
    "source_identifier": "ROOT_ACCOUNT_MFA_ENABLED"
  },
  "s3_bucket_public_access": {
    "description": "Ensure S3 account-level public access blocks are enabled",
    "source_identifier": "S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS"
  }
}

| no | | [recorder_name](#input_recorder_name) | Name for the AWS Config recorder | `string` | `"org-recorder"` | no | | [s3_key_prefix](#input_s3_key_prefix) | S3 key prefix for Config snapshots and history | `string` | `"config"` | no | | [sns_topic_arn](#input_sns_topic_arn) | SNS topic ARN for Config change notifications (optional) | `string` | `null` | no | | [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no | ## Outputs | Name | Description | | ---- | ----------- | | [aggregator_arn](#output_aggregator_arn) | Config aggregator ARN | | [aggregator_id](#output_aggregator_id) | Config aggregator name | | [managed_rule_arns](#output_managed_rule_arns) | Map of managed rule logical key to rule ARN | | [recorder_id](#output_recorder_id) | AWS Config recorder name | | [role_arn](#output_role_arn) | IAM role ARN used by Config |