Skip to content

Commit 1638655

Browse files
author
Dominic DePasquale
authored
feat: allow enabling/disabling individual alarms (nozaq#164)
1 parent a87c731 commit 1638655

File tree

2 files changed

+105
-30
lines changed

2 files changed

+105
-30
lines changed

‎modules/alarm-baseline/main.tf

+30-30
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ resource "aws_sns_topic" "alarms" {
1515
# --------------------------------------------------------------------------------------------------
1616

1717
resource "aws_cloudwatch_log_metric_filter" "unauthorized_api_calls" {
18-
count = var.enabled ? 1 : 0
18+
count = var.enabled && var.unauthorized_api_calls_enabled ? 1 : 0
1919

2020
name = "UnauthorizedAPICalls"
2121
pattern = "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\") }"
@@ -29,7 +29,7 @@ resource "aws_cloudwatch_log_metric_filter" "unauthorized_api_calls" {
2929
}
3030

3131
resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
32-
count = var.enabled ? 1 : 0
32+
count = var.enabled && var.unauthorized_api_calls_enabled ? 1 : 0
3333

3434
alarm_name = "UnauthorizedAPICalls"
3535
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -48,7 +48,7 @@ resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
4848
}
4949

5050
resource "aws_cloudwatch_log_metric_filter" "no_mfa_console_signin" {
51-
count = var.enabled ? 1 : 0
51+
count = var.enabled && var.no_mfa_console_signin_enabled ? 1 : 0
5252

5353
name = "NoMFAConsoleSignin"
5454
pattern = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }"
@@ -62,7 +62,7 @@ resource "aws_cloudwatch_log_metric_filter" "no_mfa_console_signin" {
6262
}
6363

6464
resource "aws_cloudwatch_metric_alarm" "no_mfa_console_signin" {
65-
count = var.enabled ? 1 : 0
65+
count = var.enabled && var.no_mfa_console_signin_enabled ? 1 : 0
6666

6767
alarm_name = "NoMFAConsoleSignin"
6868
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -81,7 +81,7 @@ resource "aws_cloudwatch_metric_alarm" "no_mfa_console_signin" {
8181
}
8282

8383
resource "aws_cloudwatch_log_metric_filter" "root_usage" {
84-
count = var.enabled ? 1 : 0
84+
count = var.enabled && var.root_usage_enabled ? 1 : 0
8585

8686
name = "RootUsage"
8787
pattern = "{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }"
@@ -95,7 +95,7 @@ resource "aws_cloudwatch_log_metric_filter" "root_usage" {
9595
}
9696

9797
resource "aws_cloudwatch_metric_alarm" "root_usage" {
98-
count = var.enabled ? 1 : 0
98+
count = var.enabled && var.root_usage_enabled ? 1 : 0
9999

100100
alarm_name = "RootUsage"
101101
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -114,7 +114,7 @@ resource "aws_cloudwatch_metric_alarm" "root_usage" {
114114
}
115115

116116
resource "aws_cloudwatch_log_metric_filter" "iam_changes" {
117-
count = var.enabled ? 1 : 0
117+
count = var.enabled && var.iam_changes_enabled ? 1 : 0
118118

119119
name = "IAMChanges"
120120
pattern = "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}"
@@ -128,7 +128,7 @@ resource "aws_cloudwatch_log_metric_filter" "iam_changes" {
128128
}
129129

130130
resource "aws_cloudwatch_metric_alarm" "iam_changes" {
131-
count = var.enabled ? 1 : 0
131+
count = var.enabled && var.iam_changes_enabled ? 1 : 0
132132

133133
alarm_name = "IAMChanges"
134134
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -147,7 +147,7 @@ resource "aws_cloudwatch_metric_alarm" "iam_changes" {
147147
}
148148

149149
resource "aws_cloudwatch_log_metric_filter" "cloudtrail_cfg_changes" {
150-
count = var.enabled ? 1 : 0
150+
count = var.enabled && var.cloudtrail_cfg_changes_enabled ? 1 : 0
151151

152152
name = "CloudTrailCfgChanges"
153153
pattern = "{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }"
@@ -161,7 +161,7 @@ resource "aws_cloudwatch_log_metric_filter" "cloudtrail_cfg_changes" {
161161
}
162162

163163
resource "aws_cloudwatch_metric_alarm" "cloudtrail_cfg_changes" {
164-
count = var.enabled ? 1 : 0
164+
count = var.enabled && var.cloudtrail_cfg_changes_enabled ? 1 : 0
165165

166166
alarm_name = "CloudTrailCfgChanges"
167167
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -180,7 +180,7 @@ resource "aws_cloudwatch_metric_alarm" "cloudtrail_cfg_changes" {
180180
}
181181

182182
resource "aws_cloudwatch_log_metric_filter" "console_signin_failures" {
183-
count = var.enabled ? 1 : 0
183+
count = var.enabled && var.console_signin_failures_enabled ? 1 : 0
184184

185185
name = "ConsoleSigninFailures"
186186
pattern = "{ ($.eventName = ConsoleLogin) && ($.errorMessage = \"Failed authentication\") }"
@@ -194,7 +194,7 @@ resource "aws_cloudwatch_log_metric_filter" "console_signin_failures" {
194194
}
195195

196196
resource "aws_cloudwatch_metric_alarm" "console_signin_failures" {
197-
count = var.enabled ? 1 : 0
197+
count = var.enabled && var.console_signin_failures_enabled ? 1 : 0
198198

199199
alarm_name = "ConsoleSigninFailures"
200200
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -213,7 +213,7 @@ resource "aws_cloudwatch_metric_alarm" "console_signin_failures" {
213213
}
214214

215215
resource "aws_cloudwatch_log_metric_filter" "disable_or_delete_cmk" {
216-
count = var.enabled ? 1 : 0
216+
count = var.enabled && var.disable_or_delete_cmk_enabled ? 1 : 0
217217

218218
name = "DisableOrDeleteCMK"
219219
pattern = "{ ($.eventSource = kms.amazonaws.com) && (($.eventName = DisableKey) || ($.eventName = ScheduleKeyDeletion)) }"
@@ -227,7 +227,7 @@ resource "aws_cloudwatch_log_metric_filter" "disable_or_delete_cmk" {
227227
}
228228

229229
resource "aws_cloudwatch_metric_alarm" "disable_or_delete_cmk" {
230-
count = var.enabled ? 1 : 0
230+
count = var.enabled && var.disable_or_delete_cmk_enabled ? 1 : 0
231231

232232
alarm_name = "DisableOrDeleteCMK"
233233
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -246,7 +246,7 @@ resource "aws_cloudwatch_metric_alarm" "disable_or_delete_cmk" {
246246
}
247247

248248
resource "aws_cloudwatch_log_metric_filter" "s3_bucket_policy_changes" {
249-
count = var.enabled ? 1 : 0
249+
count = var.enabled && var.s3_bucket_policy_changes_enabled ? 1 : 0
250250

251251
name = "S3BucketPolicyChanges"
252252
pattern = "{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }"
@@ -260,7 +260,7 @@ resource "aws_cloudwatch_log_metric_filter" "s3_bucket_policy_changes" {
260260
}
261261

262262
resource "aws_cloudwatch_metric_alarm" "s3_bucket_policy_changes" {
263-
count = var.enabled ? 1 : 0
263+
count = var.enabled && var.s3_bucket_policy_changes_enabled ? 1 : 0
264264

265265
alarm_name = "S3BucketPolicyChanges"
266266
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -279,7 +279,7 @@ resource "aws_cloudwatch_metric_alarm" "s3_bucket_policy_changes" {
279279
}
280280

281281
resource "aws_cloudwatch_log_metric_filter" "aws_config_changes" {
282-
count = var.enabled ? 1 : 0
282+
count = var.enabled && var.aws_config_changes_enabled ? 1 : 0
283283

284284
name = "AWSConfigChanges"
285285
pattern = "{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) }"
@@ -293,7 +293,7 @@ resource "aws_cloudwatch_log_metric_filter" "aws_config_changes" {
293293
}
294294

295295
resource "aws_cloudwatch_metric_alarm" "aws_config_changes" {
296-
count = var.enabled ? 1 : 0
296+
count = var.enabled && var.aws_config_changes_enabled ? 1 : 0
297297

298298
alarm_name = "AWSConfigChanges"
299299
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -312,7 +312,7 @@ resource "aws_cloudwatch_metric_alarm" "aws_config_changes" {
312312
}
313313

314314
resource "aws_cloudwatch_log_metric_filter" "security_group_changes" {
315-
count = var.enabled ? 1 : 0
315+
count = var.enabled && var.security_group_changes_enabled ? 1 : 0
316316

317317
name = "SecurityGroupChanges"
318318
pattern = "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}"
@@ -326,7 +326,7 @@ resource "aws_cloudwatch_log_metric_filter" "security_group_changes" {
326326
}
327327

328328
resource "aws_cloudwatch_metric_alarm" "security_group_changes" {
329-
count = var.enabled ? 1 : 0
329+
count = var.enabled && var.security_group_changes_enabled ? 1 : 0
330330

331331
alarm_name = "SecurityGroupChanges"
332332
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -345,7 +345,7 @@ resource "aws_cloudwatch_metric_alarm" "security_group_changes" {
345345
}
346346

347347
resource "aws_cloudwatch_log_metric_filter" "nacl_changes" {
348-
count = var.enabled ? 1 : 0
348+
count = var.enabled && var.nacl_changes_enabled ? 1 : 0
349349

350350
name = "NACLChanges"
351351
pattern = "{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }"
@@ -359,7 +359,7 @@ resource "aws_cloudwatch_log_metric_filter" "nacl_changes" {
359359
}
360360

361361
resource "aws_cloudwatch_metric_alarm" "nacl_changes" {
362-
count = var.enabled ? 1 : 0
362+
count = var.enabled && var.nacl_changes_enabled ? 1 : 0
363363

364364
alarm_name = "NACLChanges"
365365
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -378,7 +378,7 @@ resource "aws_cloudwatch_metric_alarm" "nacl_changes" {
378378
}
379379

380380
resource "aws_cloudwatch_log_metric_filter" "network_gw_changes" {
381-
count = var.enabled ? 1 : 0
381+
count = var.enabled && var.network_gw_changes_enabled ? 1 : 0
382382

383383
name = "NetworkGWChanges"
384384
pattern = "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }"
@@ -392,7 +392,7 @@ resource "aws_cloudwatch_log_metric_filter" "network_gw_changes" {
392392
}
393393

394394
resource "aws_cloudwatch_metric_alarm" "network_gw_changes" {
395-
count = var.enabled ? 1 : 0
395+
count = var.enabled && var.network_gw_changes_enabled ? 1 : 0
396396

397397
alarm_name = "NetworkGWChanges"
398398
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -411,7 +411,7 @@ resource "aws_cloudwatch_metric_alarm" "network_gw_changes" {
411411
}
412412

413413
resource "aws_cloudwatch_log_metric_filter" "route_table_changes" {
414-
count = var.enabled ? 1 : 0
414+
count = var.enabled && var.route_table_changes_enabled ? 1 : 0
415415

416416
name = "RouteTableChanges"
417417
pattern = "{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }"
@@ -425,7 +425,7 @@ resource "aws_cloudwatch_log_metric_filter" "route_table_changes" {
425425
}
426426

427427
resource "aws_cloudwatch_metric_alarm" "route_table_changes" {
428-
count = var.enabled ? 1 : 0
428+
count = var.enabled && var.route_table_changes_enabled ? 1 : 0
429429

430430
alarm_name = "RouteTableChanges"
431431
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -444,7 +444,7 @@ resource "aws_cloudwatch_metric_alarm" "route_table_changes" {
444444
}
445445

446446
resource "aws_cloudwatch_log_metric_filter" "vpc_changes" {
447-
count = var.enabled ? 1 : 0
447+
count = var.enabled && var.vpc_changes_enabled ? 1 : 0
448448

449449
name = "VPCChanges"
450450
pattern = "{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }"
@@ -458,7 +458,7 @@ resource "aws_cloudwatch_log_metric_filter" "vpc_changes" {
458458
}
459459

460460
resource "aws_cloudwatch_metric_alarm" "vpc_changes" {
461-
count = var.enabled ? 1 : 0
461+
count = var.enabled && var.vpc_changes_enabled ? 1 : 0
462462

463463
alarm_name = "VPCChanges"
464464
comparison_operator = "GreaterThanOrEqualToThreshold"
@@ -477,7 +477,7 @@ resource "aws_cloudwatch_metric_alarm" "vpc_changes" {
477477
}
478478

479479
resource "aws_cloudwatch_log_metric_filter" "organizations_changes" {
480-
count = var.enabled ? 1 : 0
480+
count = var.enabled && var.organizations_changes_enabled ? 1 : 0
481481

482482
name = "OrganizationsChanges"
483483
pattern = "{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = \"AcceptHandshake\") || ($.eventName = \"AttachPolicy\") || ($.eventName = \"CreateAccount\") || ($.eventName = \"CreateOrganizationalUnit\") || ($.eventName= \"CreatePolicy\") || ($.eventName = \"DeclineHandshake\") || ($.eventName = \"DeleteOrganization\") || ($.eventName = \"DeleteOrganizationalUnit\") || ($.eventName = \"DeletePolicy\") || ($.eventName = \"DetachPolicy\") || ($.eventName = \"DisablePolicyType\") || ($.eventName = \"EnablePolicyType\") || ($.eventName = \"InviteAccountToOrganization\") || ($.eventName = \"LeaveOrganization\") || ($.eventName = \"MoveAccount\") || ($.eventName = \"RemoveAccountFromOrganization\") || ($.eventName = \"UpdatePolicy\") || ($.eventName =\"UpdateOrganizationalUnit\")) }"
@@ -491,7 +491,7 @@ resource "aws_cloudwatch_log_metric_filter" "organizations_changes" {
491491
}
492492

493493
resource "aws_cloudwatch_metric_alarm" "organizations_changes" {
494-
count = var.enabled ? 1 : 0
494+
count = var.enabled && var.organizations_changes_enabled ? 1 : 0
495495

496496
alarm_name = "OrganizationsChanges"
497497
comparison_operator = "GreaterThanOrEqualToThreshold"

‎modules/alarm-baseline/variables.tf

+75
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,81 @@ variable "enabled" {
33
default = true
44
}
55

6+
variable "unauthorized_api_calls_enabled" {
7+
description = "The boolean flag whether the unauthorized_api_calls alarm is enabled or not. No resources are created when set to false."
8+
default = true
9+
}
10+
11+
variable "no_mfa_console_signin_enabled" {
12+
description = "The boolean flag whether the no_mfa_console_signin alarm is enabled or not. No resources are created when set to false."
13+
default = true
14+
}
15+
16+
variable "root_usage_enabled" {
17+
description = "The boolean flag whether the root_usage alarm is enabled or not. No resources are created when set to false."
18+
default = true
19+
}
20+
21+
variable "iam_changes_enabled" {
22+
description = "The boolean flag whether the iam_changes alarm is enabled or not. No resources are created when set to false."
23+
default = true
24+
}
25+
26+
variable "cloudtrail_cfg_changes_enabled" {
27+
description = "The boolean flag whether the cloudtrail_cfg_changes alarm is enabled or not. No resources are created when set to false."
28+
default = true
29+
}
30+
31+
variable "console_signin_failures_enabled" {
32+
description = "The boolean flag whether the console_signin_failures alarm is enabled or not. No resources are created when set to false."
33+
default = true
34+
}
35+
36+
variable "disable_or_delete_cmk_enabled" {
37+
description = "The boolean flag whether the disable_or_delete_cmk alarm is enabled or not. No resources are created when set to false."
38+
default = true
39+
}
40+
41+
variable "s3_bucket_policy_changes_enabled" {
42+
description = "The boolean flag whether the s3_bucket_policy_changes alarm is enabled or not. No resources are created when set to false."
43+
default = true
44+
}
45+
46+
variable "aws_config_changes_enabled" {
47+
description = "The boolean flag whether the aws_config_changes alarm is enabled or not. No resources are created when set to false."
48+
default = true
49+
}
50+
51+
variable "security_group_changes_enabled" {
52+
description = "The boolean flag whether the security_group_changes alarm is enabled or not. No resources are created when set to false."
53+
default = true
54+
}
55+
56+
variable "nacl_changes_enabled" {
57+
description = "The boolean flag whether the nacl_changes alarm is enabled or not. No resources are created when set to false."
58+
default = true
59+
}
60+
61+
variable "network_gw_changes_enabled" {
62+
description = "The boolean flag whether the network_gw_changes alarm is enabled or not. No resources are created when set to false."
63+
default = true
64+
}
65+
66+
variable "route_table_changes_enabled" {
67+
description = "The boolean flag whether the route_table_changes alarm is enabled or not. No resources are created when set to false."
68+
default = true
69+
}
70+
71+
variable "vpc_changes_enabled" {
72+
description = "The boolean flag whether the vpc_changes alarm is enabled or not. No resources are created when set to false."
73+
default = true
74+
}
75+
76+
variable "organizations_changes_enabled" {
77+
description = "The boolean flag whether the organizations_changes alarm is enabled or not. No resources are created when set to false."
78+
default = true
79+
}
80+
681
variable "alarm_namespace" {
782
description = "The namespace in which all alarms are set up."
883
default = "CISBenchmark"

0 commit comments

Comments
 (0)