├── variables.tf ├── img ├── epsagon_dashboard.png └── cloudformation_params.png ├── main.tf ├── README.md ├── iam-policy.json └── native └── epsagon-native.tf /variables.tf: -------------------------------------------------------------------------------- 1 | variable "epsagon_external_id" { 2 | type = string 3 | description = "Epsagon AWS external ID" 4 | } 5 | -------------------------------------------------------------------------------- /img/epsagon_dashboard.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/epsagon/epsagon-terraform-existing-cloudtrail/main/img/epsagon_dashboard.png -------------------------------------------------------------------------------- /img/cloudformation_params.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/epsagon/epsagon-terraform-existing-cloudtrail/main/img/cloudformation_params.png -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | resource "aws_cloudformation_stack" "epsagon" { 2 | name = "epsagon" 3 | 4 | template_url = "https://s3.amazonaws.com/epsagon/template_existing_cloudtrail.json" 5 | capabilities = ["CAPABILITY_NAMED_IAM"] 6 | 7 | parameters = { 8 | ExternalId = "${var.epsagon_external_id}" 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Epsagon Terraform AWS Integration - Existing Cloudtrail 2 | 3 | Note: Only use this module if you already have an existing cloudtrail in your epsagon account. 4 | Otherwise, check out our [regular terraform integration](https://github.com/epsagon/epsagon-terraform) 5 | 6 | Setup Epsagon <-> AWS integration module 7 | 8 | This module provides the ability to setup Epsagon integration via Terraform. This module will setup the following: 9 | 10 | - Cross account IAM role for Epsagon 11 | 12 | ## Usage 13 | 14 | To use this module you need to create a Terraform configuration that utilizes this module. A basic example configuration would look as follows (Be sure to adjust the git ref in the source value appropriately): 15 | 16 | ```hcl 17 | module "epsagon_aws_integration" { 18 | source = "github.com/epsagon/epsagon-terraform-existing-cloudtrail?ref=1.0.0" 19 | epsagon_external_id = "" 20 | } 21 | ``` 22 | 23 | Run Terraform, all resources will be created and Epsagon will be configured without manual intervention. 24 | 25 | ## Parameters 26 | 27 | To find the right value to set for the External ID Epsagon parameter, go to your [Epsagon settings](https://dashboard.epsagon.com/settings/cloudformation) and click the CloudFormation deploy button: 28 | 29 | ![Epsagon dashboard](./img/epsagon_dashboard.png) 30 | 31 | Then copy the ExternalID into your Terraform file: 32 | 33 | ![CloudFormation parameters](./img/cloudformation_params.png) 34 | 35 | ## IAM Requirements 36 | 37 | See `iam-policy.json` in this repository for an IAM policy that is sufficient to allow the terraform module to execute 38 | -------------------------------------------------------------------------------- /iam-policy.json: -------------------------------------------------------------------------------- 1 | { 2 | "Version": "2012-10-17", 3 | "Statement": [ 4 | { 5 | "Effect": "Allow", 6 | "Action": [ 7 | "s3:ListBucket", 8 | "s3:ListAllMyBuckets" 9 | ], 10 | "Resource": [ 11 | "arn:aws:s3:::*" 12 | ] 13 | }, 14 | { 15 | "Effect": "Allow", 16 | "Action": [ 17 | "s3:CreateBucket", 18 | "s3:DeleteBucket", 19 | "s3:DeleteBucketPolicy", 20 | "s3:GetAccelerateConfiguration", 21 | "s3:GetBucket*", 22 | "s3:GetEncryptionConfiguration", 23 | "s3:GetLifecycleConfiguration", 24 | "s3:GetReplicationConfiguration", 25 | "s3:ListBucket", 26 | "s3:ListAllMyBuckets", 27 | "s3:ListBucketVersions", 28 | "s3:PutBucketAcl", 29 | "s3:PutBucketCORS", 30 | "s3:PutBucketLogging", 31 | "s3:PutBucketPolicy", 32 | "s3:PutBucketTagging", 33 | "s3:PutBucketVersioning", 34 | "s3:PutBucketWebsite", 35 | "s3:PutEncryptionConfiguration", 36 | "s3:PutLifecycleConfiguration", 37 | "s3:PutReplicationConfiguration" 38 | ], 39 | "Resource": [ 40 | "arn:aws:s3:::epsagon-trail-bucket*" 41 | ] 42 | }, 43 | { 44 | "Effect": "Allow", 45 | "Action": [ 46 | "cloudformation:CreateStack", 47 | "cloudformation:CreateUploadBucket", 48 | "cloudformation:DeleteStack", 49 | "cloudformation:Describe*", 50 | "cloudformation:GetTemplate", 51 | "cloudformation:UpdateStack" 52 | ], 53 | "Resource": [ 54 | "arn:aws:cloudformation:*:*:stack/epsagon/*" 55 | ] 56 | }, 57 | { 58 | "Effect": "Allow", 59 | "Action": [ 60 | "cloudtrail:DescribeTrails" 61 | ], 62 | "Resource": "*" 63 | }, 64 | { 65 | "Effect": "Allow", 66 | "Action": [ 67 | "cloudtrail:CreateTrail", 68 | "cloudtrail:DeleteTrail", 69 | "cloudtrail:GetEventSelectors", 70 | "cloudtrail:PutEventSelectors", 71 | "cloudtrail:StartLogging", 72 | "cloudtrail:StopLogging" 73 | ], 74 | "Resource": "arn:aws:cloudtrail:*:*:trail/EpsagonMonitoringTrail" 75 | }, 76 | { 77 | "Effect": "Allow", 78 | "Action": [ 79 | "logs:DescribeLogStreams", 80 | "logs:DescribeLogGroups", 81 | "logs:FilterLogEvents" 82 | ], 83 | "Resource": [ 84 | "*" 85 | ] 86 | }, 87 | { 88 | "Effect": "Allow", 89 | "Action": [ 90 | "logs:CreateLogGroup", 91 | "logs:DeleteLogGroup", 92 | "logs:PutRetentionPolicy" 93 | ], 94 | "Resource": [ 95 | "arn:aws:logs:*:*:log-group:EpsagonMonitoringLogGroup:log-stream:" 96 | ] 97 | }, 98 | { 99 | "Effect": "Allow", 100 | "Action": [ 101 | "SNS:Publish" 102 | ], 103 | "Resource": [ 104 | "arn:aws:sns:*:*:cloudformation-status-production" 105 | ] 106 | }, 107 | { 108 | "Effect": "Allow", 109 | "Sid": "DatastoreTerraformLogRole", 110 | "Action": [ 111 | "iam:GetRole", 112 | "iam:CreateRole", 113 | "iam:DeleteRole", 114 | "iam:AttachRolePolicy", 115 | "iam:DetachRolePolicy", 116 | "iam:GetRolePolicy", 117 | "iam:PutRolePolicy", 118 | "iam:DeleteRolePolicy", 119 | "iam:CreateServiceLinkedRole", 120 | "iam:ListAttachedRolePolicies", 121 | "iam:ListInstanceProfilesForRole", 122 | "iam:TagRole", 123 | "iam:PassRole" 124 | ], 125 | "Resource": [ 126 | "arn:aws:iam::*:role/epsagon-EpsagonCloudTrailToCloudWatchLogsRole-*", 127 | "arn:aws:iam::*:role/EpsagonRole" 128 | ] 129 | } 130 | ] 131 | } -------------------------------------------------------------------------------- /native/epsagon-native.tf: -------------------------------------------------------------------------------- 1 | data "aws_caller_identity" "current" {} 2 | 3 | locals { 4 | epsagon_trail_bucket_name = aws_s3_bucket.epsagon_trail_bucket.id 5 | } 6 | 7 | variable "epsagon_aws_account_id" {} 8 | variable "epsagon_external_id" {} 9 | variable "region" {} 10 | 11 | resource "aws_s3_bucket" "epsagon_trail_bucket" { 12 | bucket = "epsagon-trail-bucket" 13 | acl = "private" 14 | lifecycle_rule { 15 | expiration { 16 | days = 1 17 | } 18 | enabled = true 19 | } 20 | } 21 | 22 | resource "aws_s3_bucket_policy" "epsagon_trail_bucket_policy" { 23 | bucket = local.epsagon_trail_bucket_name 24 | policy = <