/terraform-aws-vertice-integration

Terraform module to provide Vertice Cloud Cost Optimization with access to your AWS accounts

Primary LanguageHCLMIT LicenseMIT

Terraform module to provide Vertice Cloud Cost Optimization service with access to your AWS accounts

This module handles creating a role to be used by Vertice Cloud Cost Optimization service to access your AWS account and access required services and data within it.

Usage

If the account is your AWS Management account you should configure a Cost and Usage Reports (CUR) export, and then provide the cur_bucket_name variable to allow the role access to the CUR data within S3.

Configure access for your AWS Management Account with Cost and Usage Reports (CUR) export configured

This is an example of creating a role in your AWS Organizations management account (root/payer) where you host your CUR reports in a S3 bucket which will be accessed by the Vertice cross-account IAM role.

Configuring this module to create CUR S3 bucket and CUR report in your AWS Organizations management (root/payer) account is highly recommended.

For the governance IAM role to be created in your account, an ExternalId needs to be set in the governance_role_external_id parameter. You will receive this value from Vertice.

Please note that an aws.us-east-1 provider alias needs to be defined, since Cost and Usage Reports are only supported by AWS in that region.

data "aws_caller_identity" "current" {}

module "vertice_cco_integration_role" {
  source        = "git::https://github.com/VerticeOne/terraform-aws-vertice-integration.git?ref=<release-version>"

  account_type = "billing"
  cur_bucket_enabled = true
  cur_report_enabled = true

  billing_policy_addons = {
    # allow managing EC2 Reserved Instances in billing policy
    ec2_ri = true
  }

  cur_bucket_name = "vertice-cur-reports-athena-${data.aws_caller_identity.current.account_id}"

  cur_report_name      = "athena"
  cur_report_s3_prefix = "cur"

  governance_role_external_id = "<provided ExternalId value>"

  providers = {
    aws = aws

    aws.us-east-1 = aws.us-east-1
  }
}

provider "aws" {
  region = "us-west-2" # Replace with desired region for the CUR S3 bucket
}

# Cost and Usage Report only exists in us-east-1
provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

terraform {
  required_version = ">= 1.1.4"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.64.0"

      # A provider alias for us-east-1 region is needed because CUR is available only there.
      configuration_aliases = [
        aws,
        aws.us-east-1
      ]
    }
  }
}

Requirements

Name Version
terraform >= 1.1.4
aws >= 4.64.0

Providers

No providers.

Inputs

Name Description Type Required
account_type The type of the AWS account. The possible values are billing, member and combined.
Use billing if the target account is only for billing purposes (generating CUR report and exporting it to Vertice via S3 bucket).
Use member if the account contains active workload and you want to allow VerticeGovernance role to perform spend optimization actions in the account on your behalf.
Use combined for both of the above.
string yes
billing_policy_addons Enable optional add-ons for the billing/combined account IAM policy.
object({
ec2_ri = optional(bool, true),
rds_ri = optional(bool, true),
})
no
cur_bucket_enabled Whether to enable the module that creates S3 bucket for Cost Usage Report data. bool no
cur_bucket_force_destroy A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. bool no
cur_bucket_lifecycle_rules List of maps containing configuration of object lifecycle management on the S3 bucket holding CUR data. any no
cur_bucket_name The name of the bucket which will be used to store the CUR data for Vertice. string no
cur_bucket_versioning Map containing versioning configuration on the S3 bucket holding CUR data. map(string) no
cur_report_enabled Whether to enable the module that creates S3 bucket for Cost Usage Report data. bool no
cur_report_name The name of the CUR report for Vertice. string no
cur_report_s3_prefix The prefix for the S3 bucket path to where the CUR data will be saved. string no
governance_role_additional_policy_json Custom additional policy in JSON format to attach to VerticeGovernance role. Default is null for no additional policy. string no
governance_role_enabled Whether to enable the module that creates VerticeGovernance role for the Cloud Cost Optimization. bool no
governance_role_external_id STS external ID value to require for assuming the governance role. Required if the governance IAM role is to be created. You will receive this from Vertice. string no
vertice_account_ids List of Account IDs, which are allowed to access the Vertice cross account role. list(string) no

Outputs

Name Description
cur_report_name Name of the CUR report created.
cur_report_s3_prefix Name of the S3 prefix used by the CUR report.
vertice_account_ids Account IDs of Vertice allowed to access your AWS resources.
vertice_governance_role_arn The ARN of VerticeGovernance role created.
vertice_governance_role_name The name of VerticeGovernance role created.