config

Deploys AWS Config with an organization aggregator, delivery channel, managed rules, and conformance packs.

Creates a Config recorder and delivery channel backed by a central S3 bucket, configures an organization-wide aggregator, and provisions a default set of managed rules covering root MFA, password policy, CloudTrail, S3 public access, EBS encryption, and GuardDuty. Additional managed rules and conformance packs are configurable via variables. Requires the storage/s3-bucket module for the delivery bucket and the governance/organization module to have trusted-access for config.amazonaws.com enabled.

Usage

module "config" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/config/aws"
  version = "0.1.0"

  s3_bucket_name = module.config_bucket.id
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_config_config_rule.managed	resource
aws_config_configuration_aggregator.this	resource
aws_config_configuration_recorder.this	resource
aws_config_configuration_recorder_status.this	resource
aws_config_conformance_pack.this	resource
aws_config_delivery_channel.this	resource
aws_iam_role.config	resource
aws_iam_role_policy_attachment.config_managed	resource

Inputs

Name	Description	Type	Default	Required
s3_bucket_name	S3 bucket name for AWS Config delivery	string	n/a	yes
aggregator_name	Name for the organization Config aggregator	string	"org-aggregator"	no
all_supported	Record all supported resource types	bool	true	no
conformance_packs	Map of conformance pack names to S3 template URI or inline template body	map(object({ template_body = optional(string, null) template_s3_uri = optional(string, null) input_parameters = optional(map(string), {}) }))	{}	no
delivery_frequency	Frequency for Config configuration snapshots	string	"TwentyFour_Hours"	no
include_global_resource_types	Include global resource types (IAM) in recording	bool	true	no
managed_rules	Map of managed Config rules to deploy	map(object({ source_identifier = string description = string input_parameters = optional(map(string), {}) maximum_execution_frequency = optional(string, null) }))	{ "cloudtrail_enabled": { "description": "Ensure CloudTrail is enabled", "source_identifier": "CLOUD_TRAIL_ENABLED" }, "ebs_encryption": { "description": "Ensure EBS encryption by default is enabled", "source_identifier": "EC2_EBS_ENCRYPTION_BY_DEFAULT" }, "guardduty_enabled": { "description": "Ensure GuardDuty is enabled", "source_identifier": "GUARDDUTY_ENABLED_CENTRALIZED" }, "iam_password_policy": { "description": "Ensure IAM password policy meets minimum requirements", "input_parameters": { "MaxPasswordAge": "90", "MinimumPasswordLength": "14", "PasswordReusePrevention": "24", "RequireLowercaseCharacters": "true", "RequireNumbers": "true", "RequireSymbols": "true", "RequireUppercaseCharacters": "true" }, "source_identifier": "IAM_PASSWORD_POLICY" }, "root_mfa_enabled": { "description": "Ensure MFA is enabled for the root account", "source_identifier": "ROOT_ACCOUNT_MFA_ENABLED" }, "s3_bucket_public_access": { "description": "Ensure S3 account-level public access blocks are enabled", "source_identifier": "S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS" }}	no
recorder_name	Name for the AWS Config recorder	string	"org-recorder"	no
s3_key_prefix	S3 key prefix for Config snapshots and history	string	"config"	no
sns_topic_arn	SNS topic ARN for Config change notifications (optional)	string	null	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
aggregator_arn	Config aggregator ARN
aggregator_id	Config aggregator name
managed_rule_arns	Map of managed rule logical key to rule ARN
recorder_id	AWS Config recorder name
role_arn	IAM role ARN used by Config