1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

# IAM role for Config ========================================================

data "aws_partition" "current" {}

data "aws_iam_policy_document" "config_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "config" {
  name               = local.role_name
  assume_role_policy = data.aws_iam_policy_document.config_assume.json

  tags = local.tags
}

resource "aws_iam_role_policy_attachment" "config_managed" {
  for_each = toset([
    "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWS_ConfigRole",
  ])

  role       = aws_iam_role.config.name
  policy_arn = each.value
}

# Recorder ===================================================================

resource "aws_config_configuration_recorder" "this" {
  name     = var.recorder_name
  role_arn = aws_iam_role.config.arn

  recording_group {
    all_supported                 = var.all_supported
    include_global_resource_types = var.include_global_resource_types
  }
}

# Delivery channel -----------------------------------------------------------

resource "aws_config_delivery_channel" "this" {
  name           = var.recorder_name
  s3_bucket_name = var.s3_bucket_name
  s3_key_prefix  = var.s3_key_prefix
  sns_topic_arn  = var.sns_topic_arn

  snapshot_delivery_properties {
    delivery_frequency = var.delivery_frequency
  }

  depends_on = [aws_config_configuration_recorder.this]
}

# Recorder status ------------------------------------------------------------

resource "aws_config_configuration_recorder_status" "this" {
  name       = aws_config_configuration_recorder.this.name
  is_enabled = true

  depends_on = [aws_config_delivery_channel.this]
}

# Organization aggregator ----------------------------------------------------

resource "aws_config_configuration_aggregator" "this" {
  name = var.aggregator_name

  organization_aggregation_source {
    all_regions = true
    role_arn    = aws_iam_role.config.arn
  }

  tags = local.tags

  depends_on = [aws_iam_role_policy_attachment.config_managed]
}

# Managed rules ==============================================================

resource "aws_config_config_rule" "managed" {
  for_each = var.managed_rules

  name        = each.key
  description = each.value.description

  source {
    owner             = "AWS"
    source_identifier = each.value.source_identifier
  }

  input_parameters            = length(each.value.input_parameters) > 0 ? jsonencode(each.value.input_parameters) : null
  maximum_execution_frequency = each.value.maximum_execution_frequency

  depends_on = [aws_config_configuration_recorder_status.this]

  tags = local.tags
}

# Conformance packs ==========================================================

resource "aws_config_conformance_pack" "this" {
  for_each = var.conformance_packs

  name            = each.key
  template_body   = each.value.template_body
  template_s3_uri = each.value.template_s3_uri

  dynamic "input_parameter" {
    for_each = each.value.input_parameters
    content {
      parameter_name  = input_parameter.key
      parameter_value = input_parameter.value
    }
  }

  depends_on = [aws_config_configuration_recorder_status.this]
}