Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add event rule pattern detail and control finding generator variable #59

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add event rule pattern detail and control finding generator variable #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ba4085d
Add variable for rule pattern details
aaboyd Apr 20, 2024
0de4df4
Change type to any for event rule pattern detail
aaboyd Apr 20, 2024
230d2ee
Add control finding generator variable
aaboyd Apr 22, 2024
df7c396
Fix doc comment on control_finding_generator
aaboyd Apr 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 13 additions & 8 deletions eventbridge.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,14 +91,19 @@ resource "aws_cloudwatch_event_rule" "imported_findings" {
tags = module.this.tags

event_pattern = jsonencode(
{
"source" : [
"aws.securityhub"
],
"detail-type" : [
var.cloudwatch_event_rule_pattern_detail_type
]
}
merge(
{
"source" : [
"aws.securityhub"
],
"detail-type" : [
var.cloudwatch_event_rule_pattern_detail_type
]
},
var.cloudwatch_event_rule_pattern_detail != null ?
{ "detail" : var.cloudwatch_event_rule_pattern_detail } :
{}
)
)
}

Expand Down
3 changes: 2 additions & 1 deletion main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@
resource "aws_securityhub_account" "this" {
count = local.enabled ? 1 : 0

enable_default_standards = var.enable_default_standards
enable_default_standards = var.enable_default_standards
control_finding_generator = var.control_finding_generator
}

#-----------------------------------------------------------------------------------------------------------------------
Expand Down
36 changes: 31 additions & 5 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,21 @@ variable "enable_default_standards" {
default = true
}

variable "control_finding_generator" {
description = <<-DOC
Updates whether the calling account has consolidated control findings turned on.
If the value for this field is set to ,

SECURITY_CONTROL - Security Hub generates a single finding for a control check even when
the check applies to multiple enabled standards.

STANDARD_CONTROL - Security Hub generates separate findings for a control check when the
check applies to multiple enabled standards.
DOC
type = string
default = "SECURITY_CONTROL"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be nice to add a validation block here to check if the values inputted are correct

}

variable "enabled_standards" {
description = <<-DOC
A list of standards/rulesets to enable
Expand Down Expand Up @@ -55,7 +70,7 @@ variable "imported_findings_notification_arn" {
description = <<-DOC
The ARN for an SNS topic to send findings notifications to. This is only used if create_sns_topic is false.

If you want to send findings to an existing SNS topic, set the value of this to the ARN of the existing topic and set
If you want to send findings to an existing SNS topic, set the value of this to the ARN of the existing topic and set
create_sns_topic to false.
DOC
default = null
Expand All @@ -64,7 +79,7 @@ variable "imported_findings_notification_arn" {

variable "cloudwatch_event_rule_pattern_detail_type" {
description = <<-DOC
The detail-type pattern used to match events that will be sent to SNS.
The detail-type pattern used to match events that will be sent to SNS.

For more information, see:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEventsandEventPatterns.html
Expand All @@ -73,6 +88,17 @@ variable "cloudwatch_event_rule_pattern_detail_type" {
default = "Security Hub Findings - Imported"
}

variable "cloudwatch_event_rule_pattern_detail" {
description = <<-DOC
The detail pattern used to match events that will be sent to SNS.

For more information, see:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEventsandEventPatterns.html
DOC
type = any
default = null
}

variable "finding_aggregator_enabled" {
description = <<-DOC
Flag to indicate whether a finding aggregator should be created
Expand All @@ -89,9 +115,9 @@ variable "finding_aggregator_enabled" {

variable "finding_aggregator_linking_mode" {
description = <<-DOC
Linking mode to use for the finding aggregator.
Linking mode to use for the finding aggregator.

The possible values are:
The possible values are:
- `ALL_REGIONS` - Aggregate from all regions
- `ALL_REGIONS_EXCEPT_SPECIFIED` - Aggregate from all regions except those specified in `var.finding_aggregator_regions`
- `SPECIFIED_REGIONS` - Aggregate from regions specified in `finding_aggregator_enabled`
Expand All @@ -102,7 +128,7 @@ variable "finding_aggregator_linking_mode" {

variable "finding_aggregator_regions" {
description = <<-DOC
A list of regions to aggregate findings from.
A list of regions to aggregate findings from.

This is only used if `finding_aggregator_enabled` is `true`.
DOC
Expand Down