1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# locals =====================================================================

data "aws_region" "current" {}
data "aws_partition" "current" {}

locals {
  # tflint-ignore: terraform_unused_declarations
  tags = merge(
    {
      ManagedBy = "terraform"
      Module    = "governance/security-hub"
    },
    var.tags,
  )

  standard_arns = {
    for k, v in var.standards :
    k => "arn:${data.aws_partition.current.partition}:securityhub:${data.aws_region.current.name}::${v}"
  }

  # Flatten disabled controls across standards and build the full control ARN
  # Control ARN = subscription ARN with "subscription" replaced by "control", plus "/<control_id>"
  disabled_control_pairs = flatten([
    for std_key, control_ids in var.disabled_controls : [
      for control_id in control_ids : {
        std_key     = std_key
        control_id  = control_id
        control_arn = "${replace(aws_securityhub_standards_subscription.this[std_key].id, "subscription", "control")}/${control_id}"
      }
    ]
  ])

  disabled_control_map = {
    for pair in local.disabled_control_pairs :
    "${pair.std_key}/${pair.control_id}" => pair
  }
}