Terraform AWS Config

This module sets up AWS Config, and a s3 bucket for historical configuration changes. Also have the option to set up config on all regions or multiple regions via the aggregator resource. With the aggregator resource you also have the ability to set up multi accounts, and even organization wide if you have the permissions.
Read more about data aggregation in the aws docs.

Provisional Instructions

Minimal

module "test" {
  source         = "playgroundtech/config/aws"
  version        = "1.0.0"
  s3_bucket_name = "unique-name-of-your-s3-bucket"
}

With account aggregator

module "account_aggregation" {
  source                     = "playgroundtech/config/aws"
  version                    = "1.0.0"
  s3_bucket_name             = "unique-name-of-your-s3-bucket"
  create_aggregator          = true
  account_aggregation_source = ({
    account_ids = ["123456789101"]
    all_regions = false
    regions     = ["eu-north-1","eu-west-1"]
  })
}

With organization aggregator

module "organization_aggregation" {
  source                          = "playgroundtech/config/aws"
  version                         = "1.0.0"
  s3_bucket_name                  = "unique-name-of-your-s3-bucket"
  create_aggregator               = true
  organization_aggregation_source = ({
    all_regions = true
    regions     = null
    role_arn    = module.organization_aggregation.aws_config_role_arn
  })
}

With already existing bucket

module "existing_bucket" {
  source                     = "playgroundtech/config/aws"
  version                    = "1.0.0"
  s3_bucket_name             = var.s3_bucket_name
  create_bucket              = false
  create_aggregator          = true
  account_aggregation_source = ({
    account_ids = ["123456789101"]
    all_regions = true
    regions     = null
  })
}

Variables:

s3_bucket_name | (Required) - String
S3 bucket name to store AWS logs in.
versioning | (Optional) - Bool
Enable versioning on s3 bucket.
Default: true
create_bucket | (Optional) - Bool
Set to true to create a new bucket or to use an existing one to send logs to.
Default: true
config_delivery_frequency | (Optional) - String
How often config will send snapshots to S3 bucket vpc endpoints.
Default: "Six_Hours"
Valid Values: One_Hour | Three_Hours | Six_Hours | Twelve_Hours | TwentyFour_Hours
standard_transition_days | (Optional) - Number
Number of days to persist in the standard storage tier before moving to the infrequent access tier.
Default: 30
glacier_transition_days | (Optional) - Number
Number of days after which to move the data to the glacier storage tier
Default: 60
enable_glacier_transition | (Optional) - Bool
Enables the transition to AWS Glacier which can cause unnecessary costs for huge amount of small files
Default: true
expiration_days | (Optional) - Number
Number of days after which to expunge the objects
Default: 90
config_name | (Optional) - String
The name of the aws config instance
Default: "aws_config"
s3_tags | (Optional) - Map(String)
Map tags to be used on s3 bucket
Default: {}
agg_tags | (Optional) - Map(String)
Map tags to be used on aggregation resource
Default: {}
create_aggregator | (Optional) - Bool
Enable this to aggregate with either account or organization source. If set to true, account_aggregation_source or organization_aggregation_source must also be set.
Default: false
account_aggregation_source | (Optional) - Object
- account_ids = list(string)
  A list of all account IDs.
- all_regions = bool
  If true, aggregate existing AWS Config regions and future regions. Conflicts with regions.
- regions = list(string)
  List of source regions to be aggregated. Conflicts with all_regions
Object of account sources to aggregate. Either regions or all_regions must be specified.
If used, create_aggregator must be set to true.
If all_regions is set to true, regions must be null.
Default: Null
Look at this example
organization_aggregation_source | (Optional) - Object
- all_regions = bool
  If true, aggregate existing AWS Config regions and future regions. Conficts with regions.
- regions = list(string)
  List of source regions being aggregated. Conficts with all_regions
- role_arn = string
  The role arn with organization permissions. EG "service-role/AWSConfigRoleForOrganizations"
Object with the AWS Organization configuration for the Config Aggregator. Either regions or all_regions must be specified.
If used, create_aggregator must be set to true.
If all_regions is set to true, regions must be null. Default: Null
Look at this example
config_role_name | (Optional) - String
The name of the config role.
Default: "config_role"
config_iam_policy_name | (Optional) - String
The name of the config role policy.
Default: "allow_s3_policy_to_config_role"

Outputs

aws_logs_bucket_arn
aws_config_role_arn
aws_config_role_name
aws_config_role_id

playgroundtech/terraform-aws-config