A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0.
See Benchmark Compliance to check which items in various benchmarks are covered.
- Set up IAM Password Policy.
- Create an IAM role for contacting AWS support for incident handling.
- Enable AWS Config rules to audit root account status.
- Enable IAM Access Analyzer in each region.
- Enable S3 account-level Public Access Block configuration.
- Enable CloudTrail in all regions and deliver events to CloudWatch Logs.
- Object-level logging for all S3 buckets is enabled by default.
- CloudTrail Insights event logging is enabled by default.
- CloudTrail logs are encrypted using AWS Key Management Service.
- All logs are stored in the S3 bucket with access logging enabled.
- Logs are automatically archived into Amazon Glacier after the given period(defaults to 90 days).
- Set up CloudWatch alarms to notify you when critical changes happen in your AWS account.
- Enable AWS Config in each regions to automatically take configuration snapshots.
- Enable SecurityHub and subscribe available standards.
- Enable GuardDuty in each regions.
- Remove all rules associated with default route tables, default network ACLs and default security groups in the default VPC in all regions.
- Disable automatic public IP assignments in default subnets.
- Enable AWS Config rules to audit unrestricted common ports in Security Group rules.
- Enable VPC Flow Logs with the default VPC in all regions.
- Enable default EBS encryption for newly created volumes.
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
module "secure_baseline" {
source = "nozaq/secure-baseline/aws"
audit_log_bucket_name = "YOUR_BUCKET_NAME"
aws_account_id = data.aws_caller_identity.current.account_id
region = data.aws_region.current.name
support_iam_role_principal_arns = ["YOUR_IAM_USER"]
providers = {
aws = aws
aws.ap-northeast-1 = aws.ap-northeast-1
aws.ap-northeast-2 = aws.ap-northeast-2
aws.ap-northeast-3 = aws.ap-northeast-3
aws.ap-south-1 = aws.ap-south-1
aws.ap-southeast-1 = aws.ap-southeast-1
aws.ap-southeast-2 = aws.ap-southeast-2
aws.ca-central-1 = aws.ca-central-1
aws.eu-central-1 = aws.eu-central-1
aws.eu-north-1 = aws.eu-north-1
aws.eu-west-1 = aws.eu-west-1
aws.eu-west-2 = aws.eu-west-2
aws.eu-west-3 = aws.eu-west-3
aws.sa-east-1 = aws.sa-east-1
aws.us-east-1 = aws.us-east-1
aws.us-east-2 = aws.us-east-2
aws.us-west-1 = aws.us-west-1
aws.us-west-2 = aws.us-west-2
}
}Check the example to understand how these providers are defined. Note that you need to define a provider for each AWS region and pass them to the module. Currently this is the recommended way to handle multiple regions in one module. Detailed information can be found at Providers within Modules - Terraform Docs.
A new S3 bucket to store audit logs is automatically created by default, while the external S3 bucket can be specified. It is useful when you already have a centralized S3 bucket to store all logs. Please see external-bucket example for more detail.
When you have multiple AWS accounts in your AWS Organization, secure-baseline module configures the separated environment for each AWS account. You can change this behavior to centrally manage security information and audit logs from all accounts in one master account.
Check organization example for more detail.
This module is composed of several submodules and each of which can be used independently. Modules in Package Sub-directories - Terraform describes how to source a submodule.
- alarm-baseline
- analyzer-baseline
- cloudtrail-baseline
- config-baseline
- ebs-baseline
- guardduty-baseline
- iam-baseline
- s3-baseline
- secure-bucket
- securityhub-baseline
- vpc-baseline
- Starting from v1.0, this module requires Terraform Provider for AWS v4.0 or later. Version 1.0 Upgrade Guide described the recommended procedure after the upgrade.
- Starting from v0.20, this module requires Terraform Provider for AWS v3.0 or later. Please use v0.19 if you need to use v2.x or earlier.
- Starting from v0.10, this module requires Terraform v0.12 or later. Please use v0.9 if you need to use Terraform v0.11 or ealier.
| Name | Version |
|---|---|
| terraform | >= 1.1.4 |
| aws | >= 4.3 |
| Name | Version |
|---|---|
| aws | >= 4.3 |
| Name | Description | Type | Required |
|---|---|---|---|
| audit_log_bucket_name | The name of the S3 bucket to store various audit logs. | string |
yes |
| aws_account_id | The AWS Account ID number of the account. | string |
yes |
| region | The AWS region in which global resources are set up. | string |
yes |
| support_iam_role_principal_arns | List of ARNs of the IAM principal elements by which the support role could be assumed. | list(string) |
yes |
| account_type | The type of the AWS account. The possible values are individual, master and member . Specify master and member to set up centalized logging for multiple accounts in AWS Organization. Use individual otherwise. |
string |
no |
| alarm_baseline_enabled | Boolean whether alarm-baseline is enabled. | bool |
no |
| alarm_namespace | The namespace in which all alarms are set up. | string |
no |
| alarm_sns_topic_kms_master_key_id | To enable SNS Topic encryption enter value with the ID of a custom master KMS key that is used for encryption | string |
no |
| alarm_sns_topic_name | The name of the SNS Topic which will be notified when any alarm is performed. | string |
no |
| allow_users_to_change_password | Whether to allow users to change their own password. | bool |
no |
| analyzer_baseline_enabled | Boolean whether analyzer-baseline is enabled. | bool |
no |
| analyzer_name | The name for the IAM Access Analyzer resource to be created. | string |
no |
| audit_log_bucket_custom_policy_json | Override policy for the audit log bucket. Allows addition of extra policies. | string |
no |
| audit_log_bucket_force_destroy | A boolean that indicates all objects should be deleted from the audit log bucket so that the bucket can be destroyed without error. These objects are not recoverable. | bool |
no |
| audit_log_bucket_key_enabled | Whether or not to use Amazon S3 Bucket Keys for encrypting the audit log bucket. | bool |
no |
| audit_log_lifecycle_glacier_transition_days | The number of days after log creation when the log file is archived into Glacier. | number |
no |
| aws_config_changes_enabled | The boolean flag whether the aws_config_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| cloudtrail_baseline_enabled | Boolean whether cloudtrail-baseline is enabled. | bool |
no |
| cloudtrail_cfg_changes_enabled | The boolean flag whether the cloudtrail_cfg_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| cloudtrail_cloudwatch_logs_enabled | Specifies whether the trail is delivered to CloudWatch Logs. | bool |
no |
| cloudtrail_cloudwatch_logs_group_name | The name of CloudWatch Logs group to which CloudTrail events are delivered. | string |
no |
| cloudtrail_dynamodb_event_logging_tables | The list of DynamoDB table ARNs on which to enable event logging. | list(string) |
no |
| cloudtrail_iam_role_name | The name of the IAM Role to be used by CloudTrail to delivery logs to CloudWatch Logs group. | string |
no |
| cloudtrail_iam_role_policy_name | The name of the IAM Role Policy to be used by CloudTrail to delivery logs to CloudWatch Logs group. | string |
no |
| cloudtrail_key_deletion_window_in_days | Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 30 days. | number |
no |
| cloudtrail_lambda_invocation_logging_lambdas | The list of lambda ARNs on which to enable invocation logging. | list(string) |
no |
| cloudtrail_name | The name of the trail. | string |
no |
| cloudtrail_s3_key_prefix | The prefix used when CloudTrail delivers events to the S3 bucket. | string |
no |
| cloudtrail_s3_object_level_logging_buckets | The list of S3 bucket ARNs on which to enable object-level logging. | list(string) |
no |
| cloudtrail_sns_topic_enabled | Specifies whether the trail is delivered to a SNS topic. | bool |
no |
| cloudtrail_sns_topic_name | The name of the SNS topic to link to the trail. | string |
no |
| cloudwatch_logs_retention_in_days | Number of days to retain logs for. CIS recommends 365 days. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely. | number |
no |
| config_aggregator_name | The name of the organizational AWS Config Configuration Aggregator. | string |
no |
| config_aggregator_name_prefix | The prefix of the name for the IAM role attached to the organizational AWS Config Configuration Aggregator. | string |
no |
| config_baseline_enabled | Boolean whether config-baseline is enabled. | bool |
no |
| config_delivery_frequency | The frequency which AWS Config sends a snapshot into the S3 bucket. | string |
no |
| config_global_resources_all_regions | Record global resources in all regions. If false, only default region will record global resources. | bool |
no |
| config_iam_role_name | The name of the IAM Role which AWS Config will use. | string |
no |
| config_iam_role_policy_name | The name of the IAM Role Policy which AWS Config will use. | string |
no |
| config_s3_bucket_key_prefix | The prefix used when writing AWS Config snapshots into the S3 bucket. | string |
no |
| config_sns_topic_kms_master_key_id | To enable SNS Topic encryption enter value with the ID of a custom master KMS key that is used for encryption | string |
no |
| config_sns_topic_name | The name of the SNS Topic to be used to notify configuration changes. | string |
no |
| console_signin_failures_enabled | The boolean flag whether the console_signin_failures alarm is enabled or not. No resources are created when set to false. | bool |
no |
| create_password_policy | Define if the password policy should be created. | bool |
no |
| create_support_role | Define if the support role should be created. | bool |
no |
| disable_or_delete_cmk_enabled | The boolean flag whether the disable_or_delete_cmk alarm is enabled or not. No resources are created when set to false. | bool |
no |
| guardduty_disable_email_notification | Boolean whether an email notification is sent to the accounts. | bool |
no |
| guardduty_enabled | Boolean whether the guardduty-baseline module is enabled or disabled | bool |
no |
| guardduty_finding_publishing_frequency | Specifies the frequency of notifications sent for subsequent finding occurrences. | string |
no |
| guardduty_invitation_message | Message for invitation. | string |
no |
| iam_baseline_enabled | Boolean whether iam-baseline is enabled. | bool |
no |
| iam_changes_enabled | The boolean flag whether the iam_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| master_account_id | The ID of the master AWS account to which the current AWS account is associated. Required if account_type is member. |
string |
no |
| max_password_age | The number of days that an user password is valid. | number |
no |
| member_accounts | A list of IDs and emails of AWS accounts which associated as member accounts. | list(object({ |
no |
| mfa_console_signin_allow_sso | The boolean flag whether the no_mfa_console_signin alarm allows SSO auth to be ignored. | bool |
no |
| minimum_password_length | Minimum length to require for user passwords. | number |
no |
| nacl_changes_enabled | The boolean flag whether the nacl_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| network_gw_changes_enabled | The boolean flag whether the network_gw_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| no_mfa_console_signin_enabled | The boolean flag whether the no_mfa_console_signin alarm is enabled or not. No resources are created when set to false. | bool |
no |
| organizations_changes_enabled | The boolean flag whether the organizations_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| password_reuse_prevention | The number of previous passwords that users are prevented from reusing. | number |
no |
| require_lowercase_characters | Whether to require lowercase characters for user passwords. | bool |
no |
| require_numbers | Whether to require numbers for user passwords. | bool |
no |
| require_symbols | Whether to require symbols for user passwords. | bool |
no |
| require_uppercase_characters | Whether to require uppercase characters for user passwords. | bool |
no |
| root_usage_enabled | The boolean flag whether the root_usage alarm is enabled or not. No resources are created when set to false. | bool |
no |
| route_table_changes_enabled | The boolean flag whether the route_table_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| s3_baseline_enabled | Boolean whether s3-baseline is enabled. | bool |
no |
| s3_block_public_acls | Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to true. | bool |
no |
| s3_block_public_policy | Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to true. | bool |
no |
| s3_bucket_policy_changes_enabled | The boolean flag whether the s3_bucket_policy_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| s3_ignore_public_acls | Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to true. | bool |
no |
| s3_restrict_public_buckets | Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to true. | bool |
no |
| security_group_changes_enabled | The boolean flag whether the security_group_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| securityhub_enable_aws_foundational_standard | Boolean whether AWS Foundations standard is enabled. | bool |
no |
| securityhub_enable_cis_standard | Boolean whether CIS standard is enabled. | bool |
no |
| securityhub_enable_pci_dss_standard | Boolean whether PCI DSS standard is enabled. | bool |
no |
| securityhub_enable_product_arns | List of Security Hub product ARNs, <REGION> will be replaced. See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html for list. |
list(string) |
no |
| securityhub_enabled | Boolean whether the securityhub-baseline module is enabled or disabled | bool |
no |
| support_iam_role_name | The name of the the support role. | string |
no |
| tags | Specifies object tags key and value. This applies to all resources created by this module. | map(string) |
no |
| target_regions | A list of regions to set up with this module. | list(string) |
no |
| turn_off_organization_trail | Specifies whether the disable the organization trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. | bool |
no |
| unauthorized_api_calls_enabled | The boolean flag whether the unauthorized_api_calls alarm is enabled or not. No resources are created when set to false. | bool |
no |
| use_external_audit_log_bucket | A boolean that indicates whether the specific audit log bucket already exists. Create a new S3 bucket if it is set to false. | bool |
no |
| vpc_changes_enabled | The boolean flag whether the vpc_changes alarm is enabled or not. No resources are created when set to false. | bool |
no |
| vpc_enable | Boolean whether the VPC baseline module should be enabled | bool |
no |
| vpc_enable_flow_logs | The boolean flag whether to enable VPC Flow Logs in default VPCs | bool |
no |
| vpc_flow_logs_destination_type | The type of the logging destination. Valid values: cloud-watch-logs, s3 | string |
no |
| vpc_flow_logs_log_group_name | The name of CloudWatch Logs group to which VPC Flow Logs are delivered. | string |
no |
| vpc_flow_logs_retention_in_days | Number of days to retain logs if vpc_log_destination_type is cloud-watch-logs. CIS recommends 365 days. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely. | number |
no |
| vpc_flow_logs_s3_arn | ARN of the S3 bucket to which VPC Flow Logs are delivered if vpc_log_destination_type is s3. | string |
no |
| vpc_flow_logs_s3_key_prefix | The prefix used when VPC Flow Logs delivers logs to the S3 bucket. | string |
no |
| vpc_iam_role_name | The name of the IAM Role which VPC Flow Logs will use. | string |
no |
| vpc_iam_role_policy_name | The name of the IAM Role Policy which VPC Flow Logs will use. | string |
no |
| Name | Description |
|---|---|
| alarm_sns_topic | The SNS topic to which CloudWatch Alarms will be sent. |
| audit_bucket | The S3 bucket used for storing audit logs. |
| cloudtrail | The trail for recording events in all regions. |
| cloudtrail_kms_key | The KMS key used for encrypting CloudTrail events. |
| cloudtrail_log_delivery_iam_role | The IAM role used for delivering CloudTrail events to CloudWatch Logs. |
| cloudtrail_log_group | The CloudWatch Logs log group which stores CloudTrail events. |
| cloudtrail_sns_topic | The sns topic linked to the cloudtrail. |
| config_configuration_recorder | The configuration recorder in each region. |
| config_iam_role | The IAM role used for delivering AWS Config records to CloudWatch Logs. |
| config_sns_topic | The SNS topic) that AWS Config delivers notifications to. |
| default_network_acl | The default network ACL. |
| default_route_table | The default route table. |
| default_security_group | The ID of the default security group. |
| default_vpc | The default VPC. |
| guardduty_detector | The GuardDuty detector in each region. |
| support_iam_role | The IAM role used for the support user. |
| vpc_flow_logs_group | The CloudWatch Logs log group which stores VPC Flow Logs in each region. |
| vpc_flow_logs_iam_role | The IAM role used for delivering VPC Flow Logs to CloudWatch Logs. |