1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

# GuardDuty Detector Configuration ============================================
# Run in the delegated administrator (security) account after the
# governance/organization module registers delegated_administrators
# ["guardduty.amazonaws.com"].

# GuardDuty Detector ----------------------------------------------------------

resource "aws_guardduty_detector" "this" {
  enable                       = var.enable
  finding_publishing_frequency = var.finding_publishing_frequency

  tags = local.tags
}

# Detector Features ------------------------------------------------------------

resource "aws_guardduty_detector_feature" "this" {
  for_each = var.detector_features

  detector_id = aws_guardduty_detector.this.id
  name        = each.key
  status      = each.value.status

  dynamic "additional_configuration" {
    for_each = each.value.additional_configuration
    content {
      name   = additional_configuration.key
      status = additional_configuration.value.status
    }
  }
}

# Organization Configuration ---------------------------------------------------

resource "aws_guardduty_organization_configuration" "this" {
  count = var.detector_organization_configuration != null ? 1 : 0

  auto_enable_organization_members = var.detector_organization_configuration.auto_enable_org_members
  detector_id                      = aws_guardduty_detector.this.id

  depends_on = [aws_guardduty_detector.this]
}

# Organization Features --------------------------------------------------------

resource "aws_guardduty_organization_configuration_feature" "this" {
  for_each = local.organization_features

  detector_id = aws_guardduty_detector.this.id
  name        = each.key
  auto_enable = each.value.auto_enable

  dynamic "additional_configuration" {
    for_each = each.value.additional_configuration
    content {
      name        = additional_configuration.key
      auto_enable = additional_configuration.value.auto_enable
    }
  }

  depends_on = [aws_guardduty_organization_configuration.this]
}