1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

variable "trail_name" {
  description = "Name of the CloudTrail trail"
  type        = string
  default     = "org-trail"
}

variable "s3_bucket_name" {
  description = "Name of the S3 bucket for CloudTrail log delivery"
  type        = string
}

variable "s3_key_prefix" {
  description = "S3 key prefix for CloudTrail log objects"
  type        = string
  default     = "cloudtrail"
}

variable "is_organization_trail" {
  description = "Enable organization-level trail spanning all member accounts"
  type        = bool
  default     = true
}

variable "is_multi_region_trail" {
  description = "Capture events from all regions"
  type        = bool
  default     = true
}

variable "include_global_service_events" {
  description = "Include global service events (IAM, STS, etc.)"
  type        = bool
  default     = true
}

variable "enable_log_file_validation" {
  description = "Enable log file integrity validation"
  type        = bool
  default     = true
}

variable "cloudwatch_logs_retention_days" {
  description = "Retention period in days for the CloudWatch log group"
  type        = number
  default     = 365
}

variable "kms_key_id" {
  description = "KMS key ARN for trail log encryption (optional)"
  type        = string
  default     = null
}

variable "management_events_rw_type" {
  description = "Read/Write type for management events — All, ReadOnly, WriteOnly, or None"
  type        = string
  default     = "All"
}

variable "data_resources" {
  description = <<-EOT
    Data event resources to capture. Map key is a logical name.
    type is the CloudTrail resource type (e.g. AWS::S3::Object).
    values is the list of ARNs or ARN prefixes to include.
    EOT
  type = map(object({
    type   = string
    values = list(string)
  }))
  default = {
    all_s3 = {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }
    all_lambda = {
      type   = "AWS::Lambda::Function"
      values = ["arn:aws:lambda"]
    }
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}