README.yaml

---
#
# This is the canonical configuration for the `README.md`
# Run `make readme` to rebuild the `README.md`
#

# Name of this project
name: terraform-aws-firewall-manager

# Logo for this project
#logo: docs/logo.png

# License of this project
license: "APACHE2"

# Copyrights
copyrights:
  - name: "Cloud Posse, LLC"
    url: "https://cloudposse.com"
    year: "2021"

# Canonical GitHub repo
github_repo: cloudposse/terraform-aws-firewall-manager

# Badges to display
badges:
  - name: "Latest Release"
    image: "https://img.shields.io/github/release/cloudposse/terraform-aws-firewall-manager.svg"
    url: "https://github.com/cloudposse/terraform-aws-firewall-manager/releases/latest"
  - name: "Slack Community"
    image: "https://slack.cloudposse.com/badge.svg"
    url: "https://slack.cloudposse.com"
  - name: "Discourse Forum"
    image: "https://img.shields.io/discourse/https/ask.sweetops.com/posts.svg"
    url: "https://ask.sweetops.com/"

# List any related terraform modules that this module may be used with or that this module depends on.
related:
  - name: "terraform-null-label"
    description:
      "Terraform module designed to generate consistent names and tags for resources. Use terraform-null-label to
      implement a strict naming convention."
    url: "https://github.com/cloudposse/terraform-null-label"

# List any resources helpful for someone to get started. For example, link to the hashicorp documentation or AWS documentation.
references:
  - name: "Terraform Standard Module Structure"
    description:
      "HashiCorp's standard module structure is a file and directory layout we recommend for reusable modules
      distributed in separate repositories."
    url: "https://www.terraform.io/docs/modules/index.md#standard-module-structure"
  - name: "Terraform Module Requirements"
    description:
      "HashiCorp's guidance on all the requirements for publishing a module. Meeting the requirements for publishing a
      module is extremely easy."
    url: "https://www.terraform.io/docs/registry/modules/publish.html#requirements"
  - name: "Terraform `random_integer` Resource"
    description:
      "The resource random_integer generates random values from a given range, described by the min and max attributes
      of a given resource."
    url: "https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer"
  - name: "Terraform Version Pinning"
    description:
      "The required_version setting can be used to constrain which versions of the Terraform CLI can be used with your
      configuration"
    url: "https://www.terraform.io/docs/configuration/terraform.html#specifying-a-required-terraform-version"

# Short description of this project
description: |-
  Terraform module to create and manage AWS Firewall Manager policies.

# Introduction to the project
#introduction: |-
#  This is an introduction.

# How to use this module. Should be an easy example to copy and paste.
usage: |-
  For a complete example, see [examples/complete](examples/complete).

  For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest)
  (which tests and deploys the example on AWS), see [test](test).

  ```hcl
  module "label" {
    source = "cloudposse/label/null"
    # Cloud Posse recommends pinning every module to a specific version
    # version = "x.x.x"

    namespace = "eg"
    stage     = "prod"
    name      = "fms"
    delimiter = "-"

    tags = {
      "BusinessUnit" = "XYZ",
    }
  }

  module "vpc" {
    source  = "cloudposse/vpc/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version = "x.x.x"

    cidr_block = "10.0.0.0/16"

    context = module.label.context
  }

  provider "aws" {
    region = "us-east-2"
  }

  provider "aws" {
    region = "us-east-2"
    alias  = "admin"
    assume_role {
      role_arn = "arn:aws:xyz"
    }
  }

  module "fms" {
    source = "cloudposse/firewall-manager/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version = "x.x.x"

    providers = {
      aws.admin = aws.admin
      aws       = aws
    }

    security_groups_usage_audit_policies = [
      {
        name               = "unused-sg"
        resource_type_list = ["AWS::EC2::SecurityGroup"]

        policy_data = {
          delete_unused_security_groups      = false
          coalesce_redundant_security_groups = false
        }
      }
    ]

    security_groups_content_audit_policies = [
      {
        name               = "maxmimum-allowed"
        resource_type_list = ["AWS::EC2::SecurityGroup"]

        policy_data = {
          security_group_action = "allow"
          security_groups       = [module.vpc.security_group_id]
        }
      }
    ]

    security_groups_common_policies = [
      {
        name               = "disabled-all"
        resource_type_list = ["AWS::EC2::SecurityGroup"]

        policy_data = {
          revert_manual_security_group_changes         = false
          exclusive_resource_security_group_management = false
          apply_to_all_ec2_instance_enis               = false
          security_groups                              = [module.vpc.security_group_id]
        }
      }
    ]

    waf_v2_policies = [
      {
        name               = "linux-policy"
        resource_type_list = ["AWS::ElasticLoadBalancingV2::LoadBalancer", "AWS::ApiGateway::Stage"]

        policy_data = {
          default_action                        = "allow"
          override_customer_web_acl_association = false
          pre_process_rule_groups = [
            {
              "managedRuleGroupIdentifier" : {
                "vendorName" : "AWS",
                "managedRuleGroupName" : "AWSManagedRulesLinuxRuleSet",
                "version" : null
              },
              "overrideAction" : { "type" : "NONE" },
              "ruleGroupArn" : null,
              "excludeRules" : [],
              "ruleGroupType" : "ManagedRuleGroup"
            }
          ]
        }
      }
    ]

    context = module.label.context
  }
  ```

# Example usage
examples: |-
  Here is an example of using this module:
  - [`examples/complete`](https://github.com/cloudposse/terraform-aws-firewall-manager/examples/complete) - complete example of using this module

# How to get started quickly
#quickstart: |-
#  Here's how to get started...

# Other files to include in this README from the project folder
include:
  - "docs/targets.md"
  - "docs/terraform.md"

# Contributors to this project
contributors:
  - name: Vladimir Syromyatnikov
    github: SweetOps
  - name: Benjamin Smith
    github: Benbentwo
  - name: RB
    github: nitrocode
  - name: Luis M. Gallardo D.
    github: lgallard