Terraform AWS Landing Zone Baseline

Description

The purpose of this module is to provision the baseline requirements for a landing zone environment, and to provide a pattern moving forward for pipeline access.

Usage

Add example usage here

## Provision the Landing Zone Access permissions
module "landing_zone" {
  source  = "appvia/cloudaccess-lza/aws"
  version = "0.0.1"

  aws_accounts = {
    network    = var.aws_accounts["network"]
    management = var.aws_accounts["management"]
  }
  repositories = {
    accelerator_repository_url  = var.landing_zone_repositories.accelerator_repository_url
    connectivity_repository_url = var.landing_zone_repositories.connectivity_repository_url
    firewall_repository_url     = var.landing_zone_repositories.firewall_repository_url
    identity_repository_url     = var.landing_zone_repositories.identity_repository_url
  }
  tags = var.tags

  providers = {
    management = aws.management
    network    = aws.network
  }
}

CIS Alarms & Notifications

This module can configure CIS alarms and notifications. To enable this functionality, set the enable_cis_alarms variable to true. These will use a CloudWatch log group, defaulting to the AWS Control Tower organizational trail. In order to receive notifications on this events

1. Use the notifications_emails variable to specify a list of email addresses to send notifications to.

enable_cis_alarms = true
enable_email_notifications = true
notifications = {
  email = {
    addresses = ["security@example.com"]
  }
}

For notifications to slack

1. Configuration the notifications block accordingly

enable_email_notifications = true
notifications = {
  slack = {
    webhook_url = "https://hooks.slack.com/services/..."
    channel = "cloud-notifications"
  }
}
accounts_id_to_name = {
  "1234567890" = "mgmt"
}
cloudwatch_log_group_retention = 3
identity_center_start_url = "<your identity center start url - if relevant>"
identity_center_role = "<your your identity center role - consistent across accounts typically read only - if relevant>"

Tagging Enforcement

The tagging enforcement feature updates the default IAM boundaries deployed by this module to include additional policy blocking the creation of resources without the required tags; defined in the var.enforcable_tags variable. The restrictions will be applied to all actions found in the var.enforcable_tagging_actions. These are the same IAM boundaries which are intended to be used by machine roles (i.e. CI/CD).

Switching on the feature will also deploy a stackset across the entire organization implementing the tagging policy deny logic. This should be referenced by roles within the account.

The IAM policy which is used to enforce the tagging policy follows the below template

- Sid: EnforceTaggingPolicy
  Effect: Deny
  Action:
    %{ for action in actions ~}
    - "${action}"
    %{ endfor ~}
  Resource: [
    %{ for resource in resources ~}
    - "${resource}"
    %{ endfor ~}
  Condition:
      Null:
        %{ for tag in tags ~}
        "aws:RequestTag/${tag}": "true"
        %{ endfor ~}

An example supplying the following tags - Environment, Product, Owner, GitRepo and using the default actions defined in the variables would render to.

- Sid: EnforceTaggingPolicy
  Effect: Deny
  Action:
    - ec2:CreateInternetGateway
    - ec2:CreateVolume
    - ec2:CreateVpcPeeringConnection
    - ec2:RunInstances
    - ecs:CreateCluster
    - ecs:CreateService
    - ecs:CreateTaskSet
    - eks:CreateCluster
    - elasticfilesystem:CreateAccessPoint
    - elasticfilesystem:CreateFileSystem
    - elasticloadbalancing:CreateListener
    - elasticloadbalancing:CreateLoadBalancer
    - elasticloadbalancing:CreateRule
    - elasticloadbalancing:CreateTargetGroup
    - elasticloadbalancing:CreateTrustStore
    - network-firewall:CreateFirewall
    - network-firewall:CreateFirewallPolicy
    - network-firewall:CreateRuleGroup
    - ram:CreatePermission
    - ram:CreateResourceShare
    - redshift:CreateCluster
    - redshift:CreateClusterParameterGroup
    - redshift:CreateClusterSecurityGroup
    - redshift:CreateClusterSubnetGroup
    - route53:CreateHostedZone
    - secretsmanager:CreateSecret
  Resource: ["*"]
  Condition:
    Null:
      "aws:RequestTag/Environment": "true"
      "aws:RequestTag/Product": "true"
      "aws:RequestTag/Owner": "true"
      "aws:RequestTag/GitRepo": "true"

Update Documentation

The terraform-docs utility is used to generate this README. Follow the below steps to update:

1. Make changes to the .terraform-docs.yml file
2. Fetch the terraform-docs binary (https://terraform-docs.io/user-guide/installation/)
3. Run terraform-docs markdown table --output-file ${PWD}/README.md --output-mode inject .

Requirements

Name	Version
terraform	>= 1.1.4
archive	~> 2.0
aws	~> 5.0

Providers

Name	Version
archive	2.6.0
aws	5.67.0
aws.audit	5.67.0
aws.management	5.67.0
aws.network	5.67.0

Modules

Name	Source	Version
alarm_baseline	appvia/alarm-baseline/aws	0.2.5
cost_management	appvia/oidc/aws//modules/role	1.3.2
default_boundary	appvia/boundary-stack/aws	0.1.7
management_landing_zone	appvia/oidc/aws//modules/role	1.3.2
management_sso_identity	appvia/oidc/aws//modules/role	1.3.2
network_inspection_vpc_admin	appvia/oidc/aws//modules/role	1.3.2
network_transit_gateway_admin	appvia/oidc/aws//modules/role	1.3.2
permissive_boundary	appvia/boundary-stack/aws	0.1.7
securityhub_notifications	appvia/notifications/aws	1.0.4
tagging_boundary	appvia/boundary-stack/aws	0.1.7

Resources

Name	Type
aws_cloudformation_stack.aws_support_stack_instance_management_account	resource
aws_cloudformation_stack_set.aws_support_stack	resource
aws_cloudformation_stack_set.identity_stackset	resource
aws_cloudformation_stack_set_instance.aws_support_stack_instance	resource
aws_cloudformation_stack_set_instance.identity_stack	resource
aws_cloudwatch_event_rule.securityhub_findings	resource
aws_cloudwatch_event_target.security_hub_findings_target	resource
aws_cloudwatch_log_group.securityhub_lambda_log_group	resource
aws_iam_group.breakglass	resource
aws_iam_group_policy_attachment.breakglass	resource
aws_iam_group_policy_attachment.test-attach	resource
aws_iam_policy.breakglass	resource
aws_iam_policy.code_contributor	resource
aws_iam_policy.code_release	resource
aws_iam_policy.cost_iam_boundary	resource
aws_iam_policy.costs_admin	resource
aws_iam_policy.costs_viewer	resource
aws_iam_policy.ipam_admin	resource
aws_iam_policy.user_management	resource
aws_iam_role.securityhub_lambda_role	resource
aws_iam_user.breakglass	resource
aws_iam_user_group_membership.breakglass	resource
aws_lambda_function.securityhub_lambda_function	resource
aws_lambda_permission.securityhub_event_bridge	resource
archive_file.securityhub_lambda_package	data source
aws_caller_identity.current	data source
aws_iam_policy_document.breakglass	data source
aws_iam_policy_document.lambda_assume_role_policy	data source
aws_iam_policy_document.securityhub_lambda_cloudwatch_logs_policy	data source
aws_iam_policy_document.securityhub_notifications_policy	data source
aws_kms_alias.securityhub_kms_key	data source
aws_organizations_organization.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
accounts_id_to_name	A mapping of account id and account name - used by notification lamdba to map an account ID to a human readable name	map(string)	{}	no
aws_accounts	Map of AWS account names to their account IDs	object({ network_account_id = optional(string, "") remoteaccess_account_id = optional(string, "") })	n/a	yes
aws_support_role_name	Name of the AWS Support role	string	"AWSSupportAccessRole"	no
breakglass_users	The number of breakglass users to create	number	2	no
cloudaccess_terraform_state_ro_policy_name	Name of the IAM policy to attach to the CloudAccess Terraform state role	string	"lza-cloudaccess-tfstate-ro"	no
cloudaccess_terraform_state_rw_policy_name	Name of the IAM policy to attach to the CloudAccess Terraform state role	string	"lza-cloudaccess-tfstate-rw"	no
cloudwatch_identity_center_role	The name of the role to use when redirecting through Identity Center for cloudwatch events	string	null	no
costs_boundary_name	Name of the IAM policy to use as a permissions boundary for cost-related roles	string	"lza-costs-boundary"	no
default_permissions_boundary_name	Name of the default IAM policy to use as a permissions boundary	string	"lza-default-boundary"	no
enable_aws_support	Indicates if we should enable AWS Support role	bool	true	no
enable_breakglass	Indicates if we should enable breakglass users and group	bool	false	no
enable_cis_alarms	Indicates if we should enable CIS alerts	bool	true	no
enable_securityhub_alarms	Indicates if we should enable SecurityHub alarms	bool	true	no
enforcable_tagging_actions	List of enforceable tagging actions	list(string)	[ "ec2:CreateInternetGateway", "ec2:CreateVolume", "ec2:CreateVpcPeeringConnection", "ec2:RunInstances", "ecs:CreateCluster", "ecs:CreateService", "ecs:CreateTaskSet", "eks:CreateCluster", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:CreateFileSystem", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:CreateTrustStore", "network-firewall:CreateFirewall", "network-firewall:CreateFirewallPolicy", "network-firewall:CreateRuleGroup", "ram:CreatePermission", "ram:CreateResourceShare", "redshift:CreateCluster", "redshift:CreateClusterParameterGroup", "redshift:CreateClusterSecurityGroup", "redshift:CreateClusterSubnetGroup", "route53:CreateHostedZone", "secretsmanager:CreateSecret" ]	no
enforcable_tagging_policy_name	Name of the IAM policy to use as a permissions boundary for enforceable tags	string	"lza-enforceable-tags-boundary"	no
enforcable_tagging_resources	List of enforceable tagging resources	list(string)	[ "*" ]	no
enforcable_tags	List of enforceable tags	list(string)	[]	no
identity_center_start_url	The start URL of your Identity Center instance	string	null	no
notifications	Configuration for the notifications	object({ email = optional(object({ addresses = list(string) }), null) slack = optional(object({ webhook_url = string }), null) teams = optional(object({ webhook_url = string }), null) })	{ "email": { "addresses": [] }, "slack": null, "teams": null }	no
permissive_permissions_boundary_name	Name of the permissive IAM policy to use as a permissions boundary	string	"lza-permissive-boundary"	no
repositories	List of repository locations for the pipelines	object({ accelerator = optional(object({ url = string role_name = optional(string, "lza-accelerator") }), null) connectivity = optional(object({ url = string role_name = optional(string, "lza-connectivity") }), null) cost_management = optional(object({ url = string role_name = optional(string, "lza-cost-management") }), null) firewall = optional(object({ url = string role_name = optional(string, "lza-firewall") }), null) identity = optional(object({ url = string role_name = optional(string, "lza-identity") }), null) })	{}	no
scm_name	Name of the source control management system (github or gitlab)	string	"github"	no
security_hub_identity_center_role	The name of the role to use when redirecting through Identity Center for security hub events	string	null	no
securityhub_event_bridge_rule_name	Display name of the EventBridge rule for Security Hub findings	string	"lza-securityhub-alerts"	no
securityhub_lambda_function_name	Name of the Security Hub Lambda function	string	"lza-securityhub-lambda-forwarder"	no
securityhub_lambda_log_group_kms_alias	Name of the KMS alias for the CloudWatch log group	string	"alias/accelerator/kms/cloudwatch/key"	no
securityhub_lambda_role_name	Name of the IAM role for the Security Hub Lambda function	string	"lza-securityhub-lambda-role"	no
securityhub_lambda_runtime	Runtime for the Security Hub Lambda function	string	"python3.12"	no
securityhub_severity_filter	Indicates if we should enable SecurityHub	list(string)	[ "CRITICAL", "HIGH" ]	no
securityhub_sns_topic_name	Name of the SNS topic to send Security Hub findings to	string	"lza-securityhub-alerts"	no
tags	Tags to apply to all resources	map(string)	n/a	yes

Outputs

Name	Description
cloudaccess_terraform_state_ro_policy_name	Name of the IAM policy to attach to the CloudAccess Terraform state role
cloudaccess_terraform_state_rw_policy_name	Name of the IAM policy to attach to the CloudAccess Terraform state role
default_permission_boundary_name	The name of the default permissions iam boundary
default_permissive_boundary_name	The name of the default permissive iam boundary
identity_role_ro_name	The name of the IAM readonly role which can be assumed by the identity stack in all accounts
identity_role_rw_name	The name of the IAM readwrite role which can be assumed by the identity stack in all accounts
identity_stack_name	The name of the identity stack