AWS Config Terraform module

Enables AWS Config and adds managed config rules with good defaults.

Supported AWS Config Rules

ACM

• acm-certificate-expiration-check: Ensure ACM Certificates in your account are marked for expiration within the specified number of days.

AMI

• approved-amis-by-tag: Checks whether running instances are using specified AMIs.

CloudTrail

• cloudtrail-enabled: Ensure CloudTrail is enabled.
• cloud-trail-encryption-enabled: Ensure CloudTrail is configured to use server side encryption (SSE) with AWS KMS or CMK encryption.
• cloud-trail-log-file-validation-enabled: Checks whether AWS CloudTrail creates a signed digest file with logs.
• multi-region-cloud-trail-enabled: Ensure that there is at least one multi-region AWS CloudTrail enabled.

CloudWatch Logs

• cloudwatch-log-group-encryption: Ensure that CloudWatch Logs are encrypted.

EC2

• ec2-encrypted-volumes: Evaluates whether EBS volumes that are in an attached state are encrypted.
• ec2-volume-inuse-check: Checks whether EBS volumes are attached to EC2 instances.
• ebs-snapshot-public-restorable-check: Checks whether Amazon Elastic Block Store snapshots are not publicly restorable.

VPC

• eip-attached: Checks whether all EIP addresses that are allocated to a VPC are attached to EC2 or in-use ENIs.
• instances-in-vpc: Ensure all EC2 instances run in a VPC.
• vpc-default-security-group-closed: Checks that the default security group of any Amazon Virtual Private Cloud (VPC) does not allow inbound or outbound traffic.

GuardDuty

• guardduty-enabled-centralized: Checks whether Amazon GuardDuty is enabled in your AWS account and region.

IAM

• iam-password-policy: Ensure the account password policy for IAM users meets the specified requirements.
• iam-user-no-policies-check: Ensure that none of your IAM users have policies attached; IAM users must inherit permissions from IAM groups or roles.
• iam-group-has-users-check: Checks whether IAM groups have at least one IAM user.
• root-account-mfa-enabled: Ensure root AWS account has MFA enabled.
• iam-root-access-key: Ensure root AWS account does not have Access Keys.

Tagging

• required-tags: Checks if resources are deployed with configured tags.

RDS

• rds-instance-public-access-check: Checks whether the Amazon Relational Database Service (RDS) instances are not publicly accessible.
• rds-snapshots-public-prohibited: Checks if Amazon Relational Database Service (Amazon RDS) snapshots are public.
• rds-storage-encrypted: Checks whether storage encryption is enabled for your RDS DB instances.

S3

• s3-bucket-public-write-prohibited: Checks that your S3 buckets do not allow public write access.
• s3-bucket-ssl-requests-only: Checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL).

Terraform Versions

Terraform 0.13 and newer. Pin module version to ~> 4.x. Submit pull-requests to master branch.

Terraform 0.12. Pin module version to ~> 3.0. Submit pull-requests to terraform012 branch.

Usage

Note: This module sets up AWS IAM Roles and Policies, which are globally namespaced. If you plan to have multiple instances of AWS Config, make sure they have unique values for config_name.

Note: If you use this module in multiple regions, be sure to disable duplicative checks and global resource types.

module "aws_config" {
  source = "trussworks/config/aws"

  config_name        = "my-aws-config"
  config_logs_bucket = "my-aws-logs"
}

Requirements

Providers

Inputs

Outputs

Upgrade Paths

Upgrading from 2.3.0 to 2.4.x

Version 2.4.0 changed how AWS Config IAM polcies would be attached to IAM roles. When applying the upgrade, you will likely see a race condition resulting in the following error

Error: Provider produced inconsistent result after apply

A second terraform apply should resolve the issue.

Developer Setup

Install dependencies (macOS)

brew install pre-commit go terraform terraform-docs

Testing

Terratest is being used for automated testing with this module. Tests in the test folder can be run locally by running the following command:

make test

Or with aws-vault:

AWS_VAULT_KEYCHAIN_NAME=<NAME> aws-vault exec <PROFILE> -- make test