1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

# Variables ====================================================================

variable "enable" {
  description = "Enable or suspend the GuardDuty detector"
  type        = bool
  default     = true
}

variable "finding_publishing_frequency" {
  description = "Frequency of findings export — FIFTEEN_MINUTES, ONE_HOUR, or SIX_HOURS"
  type        = string
  default     = "FIFTEEN_MINUTES"

  validation {
    condition     = contains(["FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS"], var.finding_publishing_frequency)
    error_message = "finding_publishing_frequency must be FIFTEEN_MINUTES, ONE_HOUR, or SIX_HOURS."
  }
}

variable "detector_features" {
  description = "Detector protection features. Key = feature name, status = ENABLED or DISABLED. RUNTIME_MONITORING and EKS_RUNTIME_MONITORING support additional_configuration."
  type = map(object({
    status = string
    additional_configuration = optional(map(object({
      status = string
    })), {})
  }))

  validation {
    condition     = alltrue([for f in values(var.detector_features) : contains(["ENABLED", "DISABLED"], f.status)])
    error_message = "detector_features status must be ENABLED or DISABLED."
  }

  validation {
    condition = alltrue([
      for f in values(var.detector_features) :
      alltrue([
        for ac in values(f.additional_configuration) :
        contains(["ENABLED", "DISABLED"], ac.status)
      ])
    ])
    error_message = "additional_configuration status must be ENABLED or DISABLED."
  }
}

variable "detector_organization_configuration" {
  description = "Organization-wide GuardDuty settings. Set to null to skip. auto_enable_org_members = ALL, NEW, or NONE."
  type = object({
    auto_enable_org_members = string
    features = map(object({
      auto_enable = string
      additional_configuration = optional(map(object({
        auto_enable = string
      })), {})
    }))
  })
  nullable = true
  default  = null

  validation {
    condition = var.detector_organization_configuration == null || contains(
      ["ALL", "NEW", "NONE"],
      var.detector_organization_configuration.auto_enable_org_members
    )
    error_message = "auto_enable_org_members must be ALL, NEW, or NONE."
  }

  validation {
    condition = var.detector_organization_configuration == null || alltrue([
      for f in values(var.detector_organization_configuration.features) :
      contains(["ALL", "NEW", "NONE"], f.auto_enable)
    ])
    error_message = "features auto_enable must be ALL, NEW, or NONE."
  }

  validation {
    condition = var.detector_organization_configuration == null || alltrue([
      for f in values(var.detector_organization_configuration.features) :
      alltrue([
        for ac in values(f.additional_configuration) :
        contains(["ALL", "NEW", "NONE"], ac.auto_enable)
      ])
    ])
    error_message = "additional_configuration auto_enable must be ALL, NEW, or NONE."
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}