diff --git a/docs/resources/integration_aws_serverless.md b/docs/resources/integration_aws_serverless.md new file mode 100644 index 0000000..be979bc --- /dev/null +++ b/docs/resources/integration_aws_serverless.md @@ -0,0 +1,167 @@ +--- +# generated by https://github.com/hashicorp/terraform-plugin-docs +page_title: "mondoo_integration_aws_serverless Resource - terraform-provider-mondoo" +subcategory: "" +description: |- + Continuously scan AWS organization and accounts for misconfigurations and vulnerabilities. +--- + +# mondoo_integration_aws_serverless (Resource) + +Continuously scan AWS organization and accounts for misconfigurations and vulnerabilities. + +## Example Usage + +```terraform +variable "mondoo_org" { + description = "Mondoo Organization" + type = string +} + +variable "origin_aws_account" { + description = "Origin AWS Account" + type = string + default = "764453172858" +} + +variable "aws_region" { + description = "AWS Region" + type = string + default = "us-east-1" +} + +variable "AWS_ACCOUNT_ID" { + description = "value of the AWS account ID" + type = string +} + +provider "mondoo" { + region = "us" +} + +provider "aws" { + region = var.aws_region +} + +data "aws_region" "current" {} + +# Create a new space +resource "mondoo_space" "my_space" { + name = "AWS Terraform" + org_id = var.mondoo_org +} + +# Setup the AWS integration +resource "mondoo_integration_aws_serverless" "aws_serverless" { + space_id = mondoo_space.my_space.id + name = "AWS Integration" + region = data.aws_region.current.name + is_organization = false + console_sign_in_trigger = true + instance_state_change_trigger = true + account_ids = [var.AWS_ACCOUNT_ID] + scan_configuration = { + ec2_scan = true + ecr_scan = false + ecs_scan = false + cron_scanin_hours = 24 + ec2_scan_options = { + ssm = true + ebs_volume_scan = true + ebs_scan_options = { + target_instances_per_scanner = 5 + max_asg_instances = 10 + } + instance_connect = false + } + } +} + +# for single account deploys +resource "aws_cloudformation_stack" "mondoo_stack" { + name = "mondoo-stack" + template_url = "https://s3.amazonaws.com/mondoo.${data.aws_region.current.name}/mondoo-lambda-stackset-cf.json" + capabilities = ["CAPABILITY_NAMED_IAM"] + parameters = { + MondooIntegrationMrn = mondoo_integration_aws_serverless.aws_serverless.mrn + MondooToken = mondoo_integration_aws_serverless.aws_serverless.token + OriginAwsAccount = var.origin_aws_account + } +} + +# for organisation wide deploys use aws_cloudformation_stack_set and aws_cloudformation_stack_set_instance instaed of aws_cloudformation_stack +# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set +# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set_instance +``` + + +## Schema + +### Required + +- `name` (String) Name of the integration. +- `region` (String) AWS region. +- `scan_configuration` (Attributes) (see [below for nested schema](#nestedatt--scan_configuration)) +- `space_id` (String) Mondoo Space Identifier. + +### Optional + +- `account_ids` (List of String) List of AWS account IDs. +- `console_sign_in_trigger` (Boolean) Enable console sign in trigger. +- `instance_state_change_trigger` (Boolean) Enable instance state change trigger. +- `is_organization` (Boolean) Is organization. + +### Read-Only + +- `mrn` (String) Integration identifier +- `token` (String) Integration token + + +### Nested Schema for `scan_configuration` + +Required: + +- `ec2_scan_options` (Attributes) (see [below for nested schema](#nestedatt--scan_configuration--ec2_scan_options)) + +Optional: + +- `cron_scanin_hours` (Number) Cron scan in hours. +- `ec2_scan` (Boolean) Enable EC2 scan. +- `ecr_scan` (Boolean) Enable ECR scan. +- `ecs_scan` (Boolean) Enable ECS scan. +- `event_scan_triggers` (Attributes) (see [below for nested schema](#nestedatt--scan_configuration--event_scan_triggers)) + + +### Nested Schema for `scan_configuration.ec2_scan_options` + +Required: + +- `ebs_scan_options` (Attributes) (see [below for nested schema](#nestedatt--scan_configuration--ec2_scan_options--ebs_scan_options)) + +Optional: + +- `ebs_volume_scan` (Boolean) Enable EBS volume scan. +- `instance_connect` (Boolean) Enable instance connect. +- `instance_ids_filter` (List of String) List of instance IDs filter. +- `regions_filter` (List of String) List of regions filter. +- `ssm` (Boolean) Enable SSM. +- `tags_filter` (Map of String) Tags filter. + + +### Nested Schema for `scan_configuration.ec2_scan_options.ebs_scan_options` + +Optional: + +- `max_asg_instances` (Number) Max ASG instances. +- `target_instances_per_scanner` (Number) Target instances per scanner. + + + + +### Nested Schema for `scan_configuration.event_scan_triggers` + +Optional: + +- `event_detail_type` (String) Event detail type. +- `event_source` (String) Event source. +- `scan_type` (String) Scan type. diff --git a/examples/resources/mondoo_integration_aws_serverless/main.tf b/examples/resources/mondoo_integration_aws_serverless/main.tf index f43ca7f..dd86232 100644 --- a/examples/resources/mondoo_integration_aws_serverless/main.tf +++ b/examples/resources/mondoo_integration_aws_serverless/main.tf @@ -5,7 +5,7 @@ terraform { version = ">= 0.4.0" } aws = { - source = "hashicorp/aws" + source = "hashicorp/aws" version = "5.50.0" } } diff --git a/examples/resources/mondoo_integration_aws_serverless/resource.tf b/examples/resources/mondoo_integration_aws_serverless/resource.tf index 98cf775..626c5f5 100644 --- a/examples/resources/mondoo_integration_aws_serverless/resource.tf +++ b/examples/resources/mondoo_integration_aws_serverless/resource.tf @@ -6,7 +6,18 @@ variable "mondoo_org" { variable "origin_aws_account" { description = "Origin AWS Account" type = string - default = "764453172858" + default = "764453172858" +} + +variable "aws_region" { + description = "AWS Region" + type = string + default = "us-east-1" +} + +variable "AWS_ACCOUNT_ID" { + description = "value of the AWS account ID" + type = string } provider "mondoo" { @@ -14,7 +25,7 @@ provider "mondoo" { } provider "aws" { - region = "us-east-1" + region = var.aws_region } data "aws_region" "current" {} @@ -26,105 +37,43 @@ resource "mondoo_space" "my_space" { } # Setup the AWS integration -resource "mondoo_integration_aws_serverless" "example" { - space_id = mondoo_space.my_space.id - name = "AWS Integration" - region = data.aws_region.current.name - is_organization = true - console_sign_in_trigger = true +resource "mondoo_integration_aws_serverless" "aws_serverless" { + space_id = mondoo_space.my_space.id + name = "AWS Integration" + region = data.aws_region.current.name + is_organization = false + console_sign_in_trigger = true instance_state_change_trigger = true - # account_ids = ["123456789012"] + account_ids = [var.AWS_ACCOUNT_ID] scan_configuration = { - ec2_scan = true - ecr_scan = false - ecs_scan = false + ec2_scan = true + ecr_scan = false + ecs_scan = false cron_scanin_hours = 24 ec2_scan_options = { - ssm = true + ssm = true ebs_volume_scan = true ebs_scan_options = { target_instances_per_scanner = 5 - max_asg_instances = 10 + max_asg_instances = 10 } instance_connect = false } } } +# for single account deploys resource "aws_cloudformation_stack" "mondoo_stack" { - name = "mondoo-stack" + name = "mondoo-stack" template_url = "https://s3.amazonaws.com/mondoo.${data.aws_region.current.name}/mondoo-lambda-stackset-cf.json" capabilities = ["CAPABILITY_NAMED_IAM"] parameters = { - MondooIntegrationMrn = mondoo_integration_aws_serverless.example.mrn - MondooToken = mondoo_integration_aws_serverless.example.token + MondooIntegrationMrn = mondoo_integration_aws_serverless.aws_serverless.mrn + MondooToken = mondoo_integration_aws_serverless.aws_serverless.token OriginAwsAccount = var.origin_aws_account } } +# for organisation wide deploys use aws_cloudformation_stack_set and aws_cloudformation_stack_set_instance instaed of aws_cloudformation_stack # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set -# data "aws_iam_policy_document" "AWSCloudFormationStackSetAdministrationRole_assume_role_policy" { -# statement { -# actions = ["sts:AssumeRole"] -# effect = "Allow" - -# principals { -# identifiers = ["cloudformation.amazonaws.com"] -# type = "Service" -# } -# } -# } - -# resource "aws_iam_role" "AWSCloudFormationStackSetAdministrationRole" { -# assume_role_policy = data.aws_iam_policy_document.AWSCloudFormationStackSetAdministrationRole_assume_role_policy.json -# name = "AWSCloudFormationStackSetAdministrationRole" -# } - -# resource "aws_cloudformation_stack_set" "example" { -# administration_role_arn = aws_iam_role.AWSCloudFormationStackSetAdministrationRole.arn -# name = "example" - -# parameters = { -# VPCCidr = "10.0.0.0/16" -# } - -# template_body = jsonencode({ -# Parameters = { -# VPCCidr = { -# Type = "String" -# Default = "10.0.0.0/16" -# Description = "Enter the CIDR block for the VPC. Default is 10.0.0.0/16." -# } -# } -# Resources = { -# myVpc = { -# Type = "AWS::EC2::VPC" -# Properties = { -# CidrBlock = { -# Ref = "VPCCidr" -# } -# Tags = [ -# { -# Key = "Name" -# Value = "Primary_CF_VPC" -# } -# ] -# } -# } -# } -# }) -# } - -# data "aws_iam_policy_document" "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy" { -# statement { -# actions = ["sts:AssumeRole"] -# effect = "Allow" -# resources = ["arn:aws:iam::*:role/${aws_cloudformation_stack_set.example.execution_role_name}"] -# } -# } - -# resource "aws_iam_role_policy" "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy" { -# name = "ExecutionPolicy" -# policy = data.aws_iam_policy_document.AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy.json -# role = aws_iam_role.AWSCloudFormationStackSetAdministrationRole.name -# } +# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set_instance