Skip to content

Commit 385093a

Browse files
author
nozaq
committed
feat: return resources as outputs instead of specific attributes
Since v0.12 Terraform supports returning resources from child modules. Originally this module returns various attributes such as an ID, an ARN and a name of the same resource to the parent module. This commit replace them with the single output directly returning the exact resource.
1 parent 64a494d commit 385093a

File tree

19 files changed

+307
-451
lines changed

19 files changed

+307
-451
lines changed

‎.chglog/CHANGELOG.tpl.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,4 +39,4 @@
3939
[{{ .Tag.Name }}]: {{ $.Info.RepositoryURL }}/compare/{{ .Tag.Previous.Name }}...{{ .Tag.Name }}
4040
{{ end -}}
4141
{{ end -}}
42-
{{ end -}}
42+
{{ end -}}

‎README.md

+20-30
Original file line numberDiff line numberDiff line change
@@ -135,36 +135,26 @@ This module is composed of several submodules and each of which can be used inde
135135

136136
| Name | Description |
137137
|------|-------------|
138-
| alarms\_topic\_arn | The ARN of the SNS topic to which CloudWatch Alarms will be sent. |
139-
| audit\_bucket\_arn | The ARN of the S3 bucket used for storing audit logs. |
140-
| audit\_bucket\_id | The ID of the S3 bucket used for storing audit logs. |
141-
| cloudtrail\_arn | The ARN of the trail for recording events in all regions. |
142-
| cloudtrail\_id | The ID of the trail for recording events in all regions. |
143-
| cloudtrail\_kms\_key\_arn | The ARN of the KMS key used for encrypting CloudTrail events. |
144-
| cloudtrail\_kms\_key\_id | The ID of the KMS key used for encrypting CloudTrail events. |
145-
| cloudtrail\_log\_delivery\_iam\_role\_arn | The ARN of the IAM role used for delivering CloudTrail events to CloudWatch Logs. |
146-
| cloudtrail\_log\_delivery\_iam\_role\_name | The name of the IAM role used for delivering CloudTrail events to CloudWatch Logs. |
147-
| cloudtrail\_log\_group\_arn | The ARN of the CloudWatch Logs log group which stores CloudTrail events. |
148-
| cloudtrail\_log\_group\_name | The name of the CloudWatch Logs log group which stores CloudTrail events. |
149-
| config\_configuration\_recorder\_id | The name of the configuration recorder. |
150-
| config\_iam\_role\_arn | The ARN of the IAM role used for delivering AWS Config records to CloudWatch Logs. |
151-
| config\_iam\_role\_name | The name of the IAM role used for delivering AWS Config records to CloudWatch Logs. |
152-
| config\_topic\_arn | The ARN of the SNS topic that AWS Config delivers notifications to. |
153-
| default\_network\_acl\_id | The ID of the default network ACL. |
154-
| default\_route\_table\_id | The ID of the default route table. |
155-
| default\_security\_group\_id | The ID of the default security group. |
156-
| default\_vpc\_id | The ID of the default VPC. |
157-
| guardduty\_detector\_id | The ID of the GuardDuty detector. |
158-
| manager\_iam\_role\_arn | The ARN of the IAM role used for the manager user. |
159-
| manager\_iam\_role\_name | The name of the IAM role used for the manager user. |
160-
| master\_iam\_role\_arn | The ARN of the IAM role used for the master user. |
161-
| master\_iam\_role\_name | The name of the IAM role used for the master user. |
162-
| support\_iam\_role\_arn | The ARN of the IAM role used for the support user. |
163-
| support\_iam\_role\_name | The name of the IAM role used for the support user. |
164-
| vpc\_flow\_logs\_group\_arn | The ARN of the CloudWatch Logs log group which stores VPC Flow Logs. |
165-
| vpc\_flow\_logs\_group\_name | The name of the CloudWatch Logs log group which stores VPC Flow Logs. |
166-
| vpc\_flow\_logs\_iam\_role\_arn | The ARN of the IAM role used for delivering VPC Flow Logs to CloudWatch Logs. |
167-
| vpc\_flow\_logs\_iam\_role\_name | The name of the IAM role used for delivering VPC Flow Logs to CloudWatch Logs. |
138+
| alarm\_sns\_topic | The SNS topic to which CloudWatch Alarms will be sent. |
139+
| audit\_bucket\ | The S3 bucket used for storing audit logs. |
140+
| cloudtrail | The trail for recording events in all regions. |
141+
| cloudtrail\_kms\_key | The KMS key used for encrypting CloudTrail events. |
142+
| cloudtrail\_log\_delivery\_iam\_role | The IAM role used for delivering CloudTrail events to CloudWatch Logs. |
143+
| cloudtrail\_log\_group | The CloudWatch Logs log group which stores CloudTrail events. |
144+
| config\_configuration\_recorder | The configuration recorder. |
145+
| config\_iam\_role | The IAM role used for delivering AWS Config records to CloudWatch Logs. |
146+
| config\_sns\_topic | The SNS topic that AWS Config delivers notifications to. |
147+
| default\_network\_acl | The default network ACL. |
148+
| default\_route\_table | The default route table. |
149+
| default\_security\_group | The default security group. |
150+
| default\_vpc | The default VPC. |
151+
| guardduty\_detector| The GuardDuty detector. |
152+
| manager\_iam\_role | The IAM role used for the manager user. |
153+
| master\_iam\_role | The IAM role used for the master user. |
154+
| support\_iam\_role | The ARN of the IAM role used for the support user. |
155+
| vpc\_flow\_logs\_group | The ARN of the CloudWatch Logs log group which stores VPC Flow Logs. |
156+
| vpc\_flow\_logs\_group | The CloudWatch Logs log group which stores VPC Flow Logs. |
157+
| vpc\_flow\_logs\_iam\_role | The IAM role used for delivering VPC Flow Logs to CloudWatch Logs. |
168158

169159
[CIS Amazon Web Services Foundations]: https://www.cisecurity.org/benchmark/amazon_web_services/
170160
[Providers within Modules - Terraform Docs]: https://www.terraform.io/docs/modules/usage.html#providers-within-modules

‎config_baselines.tf

+34-34
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ POLICY
2828
data "aws_iam_policy_document" "recoder_publish_policy" {
2929
statement {
3030
actions = ["s3:PutObject"]
31-
resources = ["${module.audit_log_bucket.this_bucket_arn}/config/AWSLogs/${var.aws_account_id}/*"]
31+
resources = ["${module.audit_log_bucket.this_bucket.arn}/config/AWSLogs/${var.aws_account_id}/*"]
3232

3333
condition {
3434
test = "StringLike"
@@ -39,29 +39,29 @@ data "aws_iam_policy_document" "recoder_publish_policy" {
3939

4040
statement {
4141
actions = ["s3:GetBucketAcl"]
42-
resources = [module.audit_log_bucket.this_bucket_arn]
42+
resources = [module.audit_log_bucket.this_bucket.arn]
4343
}
4444

4545
statement {
4646
actions = ["sns:Publish"]
4747

4848
resources = [
49-
module.config_baseline_ap-northeast-1.config_topic_arn,
50-
module.config_baseline_ap-northeast-2.config_topic_arn,
51-
module.config_baseline_ap-south-1.config_topic_arn,
52-
module.config_baseline_ap-southeast-1.config_topic_arn,
53-
module.config_baseline_ap-southeast-2.config_topic_arn,
54-
module.config_baseline_ca-central-1.config_topic_arn,
55-
module.config_baseline_eu-central-1.config_topic_arn,
56-
module.config_baseline_eu-north-1.config_topic_arn,
57-
module.config_baseline_eu-west-1.config_topic_arn,
58-
module.config_baseline_eu-west-2.config_topic_arn,
59-
module.config_baseline_eu-west-3.config_topic_arn,
60-
module.config_baseline_sa-east-1.config_topic_arn,
61-
module.config_baseline_us-east-1.config_topic_arn,
62-
module.config_baseline_us-east-2.config_topic_arn,
63-
module.config_baseline_us-west-1.config_topic_arn,
64-
module.config_baseline_us-west-2.config_topic_arn,
49+
module.config_baseline_ap-northeast-1.config_sns_topic.arn,
50+
module.config_baseline_ap-northeast-2.config_sns_topic.arn,
51+
module.config_baseline_ap-south-1.config_sns_topic.arn,
52+
module.config_baseline_ap-southeast-1.config_sns_topic.arn,
53+
module.config_baseline_ap-southeast-2.config_sns_topic.arn,
54+
module.config_baseline_ca-central-1.config_sns_topic.arn,
55+
module.config_baseline_eu-central-1.config_sns_topic.arn,
56+
module.config_baseline_eu-north-1.config_sns_topic.arn,
57+
module.config_baseline_eu-west-1.config_sns_topic.arn,
58+
module.config_baseline_eu-west-2.config_sns_topic.arn,
59+
module.config_baseline_eu-west-3.config_sns_topic.arn,
60+
module.config_baseline_sa-east-1.config_sns_topic.arn,
61+
module.config_baseline_us-east-1.config_sns_topic.arn,
62+
module.config_baseline_us-east-2.config_sns_topic.arn,
63+
module.config_baseline_us-west-1.config_sns_topic.arn,
64+
module.config_baseline_us-west-2.config_sns_topic.arn,
6565
]
6666
}
6767
}
@@ -85,7 +85,7 @@ resource "aws_iam_role_policy_attachment" "recoder_read_policy" {
8585
module "config_baseline_ap-northeast-1" {
8686
source = "./modules/config-baseline"
8787
iam_role_arn = aws_iam_role.recorder.arn
88-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
88+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
8989
s3_key_prefix = var.config_s3_bucket_key_prefix
9090
delivery_frequency = var.config_delivery_frequency
9191
sns_topic_name = var.config_sns_topic_name
@@ -98,7 +98,7 @@ module "config_baseline_ap-northeast-1" {
9898
module "config_baseline_ap-northeast-2" {
9999
source = "./modules/config-baseline"
100100
iam_role_arn = aws_iam_role.recorder.arn
101-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
101+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
102102
s3_key_prefix = var.config_s3_bucket_key_prefix
103103
delivery_frequency = var.config_delivery_frequency
104104
sns_topic_name = var.config_sns_topic_name
@@ -111,7 +111,7 @@ module "config_baseline_ap-northeast-2" {
111111
module "config_baseline_ap-south-1" {
112112
source = "./modules/config-baseline"
113113
iam_role_arn = aws_iam_role.recorder.arn
114-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
114+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
115115
s3_key_prefix = var.config_s3_bucket_key_prefix
116116
delivery_frequency = var.config_delivery_frequency
117117
sns_topic_name = var.config_sns_topic_name
@@ -124,7 +124,7 @@ module "config_baseline_ap-south-1" {
124124
module "config_baseline_ap-southeast-1" {
125125
source = "./modules/config-baseline"
126126
iam_role_arn = aws_iam_role.recorder.arn
127-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
127+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
128128
s3_key_prefix = var.config_s3_bucket_key_prefix
129129
delivery_frequency = var.config_delivery_frequency
130130
sns_topic_name = var.config_sns_topic_name
@@ -137,7 +137,7 @@ module "config_baseline_ap-southeast-1" {
137137
module "config_baseline_ap-southeast-2" {
138138
source = "./modules/config-baseline"
139139
iam_role_arn = aws_iam_role.recorder.arn
140-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
140+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
141141
s3_key_prefix = var.config_s3_bucket_key_prefix
142142
delivery_frequency = var.config_delivery_frequency
143143
sns_topic_name = var.config_sns_topic_name
@@ -150,7 +150,7 @@ module "config_baseline_ap-southeast-2" {
150150
module "config_baseline_ca-central-1" {
151151
source = "./modules/config-baseline"
152152
iam_role_arn = aws_iam_role.recorder.arn
153-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
153+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
154154
s3_key_prefix = var.config_s3_bucket_key_prefix
155155
delivery_frequency = var.config_delivery_frequency
156156
sns_topic_name = var.config_sns_topic_name
@@ -163,7 +163,7 @@ module "config_baseline_ca-central-1" {
163163
module "config_baseline_eu-central-1" {
164164
source = "./modules/config-baseline"
165165
iam_role_arn = aws_iam_role.recorder.arn
166-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
166+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
167167
s3_key_prefix = var.config_s3_bucket_key_prefix
168168
delivery_frequency = var.config_delivery_frequency
169169
sns_topic_name = var.config_sns_topic_name
@@ -176,7 +176,7 @@ module "config_baseline_eu-central-1" {
176176
module "config_baseline_eu-north-1" {
177177
source = "./modules/config-baseline"
178178
iam_role_arn = aws_iam_role.recorder.arn
179-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
179+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
180180
s3_key_prefix = var.config_s3_bucket_key_prefix
181181
delivery_frequency = var.config_delivery_frequency
182182
sns_topic_name = var.config_sns_topic_name
@@ -189,7 +189,7 @@ module "config_baseline_eu-north-1" {
189189
module "config_baseline_eu-west-1" {
190190
source = "./modules/config-baseline"
191191
iam_role_arn = aws_iam_role.recorder.arn
192-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
192+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
193193
s3_key_prefix = var.config_s3_bucket_key_prefix
194194
delivery_frequency = var.config_delivery_frequency
195195
sns_topic_name = var.config_sns_topic_name
@@ -202,7 +202,7 @@ module "config_baseline_eu-west-1" {
202202
module "config_baseline_eu-west-2" {
203203
source = "./modules/config-baseline"
204204
iam_role_arn = aws_iam_role.recorder.arn
205-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
205+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
206206
s3_key_prefix = var.config_s3_bucket_key_prefix
207207
delivery_frequency = var.config_delivery_frequency
208208
sns_topic_name = var.config_sns_topic_name
@@ -215,7 +215,7 @@ module "config_baseline_eu-west-2" {
215215
module "config_baseline_eu-west-3" {
216216
source = "./modules/config-baseline"
217217
iam_role_arn = aws_iam_role.recorder.arn
218-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
218+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
219219
s3_key_prefix = var.config_s3_bucket_key_prefix
220220
delivery_frequency = var.config_delivery_frequency
221221
sns_topic_name = var.config_sns_topic_name
@@ -228,7 +228,7 @@ module "config_baseline_eu-west-3" {
228228
module "config_baseline_sa-east-1" {
229229
source = "./modules/config-baseline"
230230
iam_role_arn = aws_iam_role.recorder.arn
231-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
231+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
232232
s3_key_prefix = var.config_s3_bucket_key_prefix
233233
delivery_frequency = var.config_delivery_frequency
234234
sns_topic_name = var.config_sns_topic_name
@@ -241,7 +241,7 @@ module "config_baseline_sa-east-1" {
241241
module "config_baseline_us-east-1" {
242242
source = "./modules/config-baseline"
243243
iam_role_arn = aws_iam_role.recorder.arn
244-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
244+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
245245
s3_key_prefix = var.config_s3_bucket_key_prefix
246246
delivery_frequency = var.config_delivery_frequency
247247
sns_topic_name = var.config_sns_topic_name
@@ -254,7 +254,7 @@ module "config_baseline_us-east-1" {
254254
module "config_baseline_us-east-2" {
255255
source = "./modules/config-baseline"
256256
iam_role_arn = aws_iam_role.recorder.arn
257-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
257+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
258258
s3_key_prefix = var.config_s3_bucket_key_prefix
259259
delivery_frequency = var.config_delivery_frequency
260260
sns_topic_name = var.config_sns_topic_name
@@ -267,7 +267,7 @@ module "config_baseline_us-east-2" {
267267
module "config_baseline_us-west-1" {
268268
source = "./modules/config-baseline"
269269
iam_role_arn = aws_iam_role.recorder.arn
270-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
270+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
271271
s3_key_prefix = var.config_s3_bucket_key_prefix
272272
delivery_frequency = var.config_delivery_frequency
273273
sns_topic_name = var.config_sns_topic_name
@@ -280,7 +280,7 @@ module "config_baseline_us-west-1" {
280280
module "config_baseline_us-west-2" {
281281
source = "./modules/config-baseline"
282282
iam_role_arn = aws_iam_role.recorder.arn
283-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
283+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
284284
s3_key_prefix = var.config_s3_bucket_key_prefix
285285
delivery_frequency = var.config_delivery_frequency
286286
sns_topic_name = var.config_sns_topic_name

‎main.tf

+7-7
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ module "audit_log_bucket" {
1515
}
1616

1717
resource "aws_s3_bucket_policy" "audit_log_bucket_policy" {
18-
bucket = module.audit_log_bucket.this_bucket_id
18+
bucket = module.audit_log_bucket.this_bucket.id
1919

2020
policy = <<END_OF_POLICY
2121
{
@@ -26,14 +26,14 @@ resource "aws_s3_bucket_policy" "audit_log_bucket_policy" {
2626
"Effect": "Allow",
2727
"Principal": {"Service": "config.amazonaws.com"},
2828
"Action": "s3:GetBucketAcl",
29-
"Resource": "${module.audit_log_bucket.this_bucket_arn}"
29+
"Resource": "${module.audit_log_bucket.this_bucket.arn}"
3030
},
3131
{
3232
"Sid": " AWSCloudTrailWriteForConfig",
3333
"Effect": "Allow",
3434
"Principal": {"Service": "config.amazonaws.com"},
3535
"Action": "s3:PutObject",
36-
"Resource": "${module.audit_log_bucket.this_bucket_arn}/config/AWSLogs/${var.aws_account_id}/Config/*",
36+
"Resource": "${module.audit_log_bucket.this_bucket.arn}/config/AWSLogs/${var.aws_account_id}/Config/*",
3737
"Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
3838
},
3939
{
@@ -43,7 +43,7 @@ resource "aws_s3_bucket_policy" "audit_log_bucket_policy" {
4343
"Service": "cloudtrail.amazonaws.com"
4444
},
4545
"Action": "s3:GetBucketAcl",
46-
"Resource": "${module.audit_log_bucket.this_bucket_arn}"
46+
"Resource": "${module.audit_log_bucket.this_bucket.arn}"
4747
},
4848
{
4949
"Sid": "AWSCloudTrailWriteForCloudTrail",
@@ -52,7 +52,7 @@ resource "aws_s3_bucket_policy" "audit_log_bucket_policy" {
5252
"Service": "cloudtrail.amazonaws.com"
5353
},
5454
"Action": "s3:PutObject",
55-
"Resource": "${module.audit_log_bucket.this_bucket_arn}/cloudtrail/AWSLogs/${var.aws_account_id}/*",
55+
"Resource": "${module.audit_log_bucket.this_bucket.arn}/cloudtrail/AWSLogs/${var.aws_account_id}/*",
5656
"Condition": {
5757
"StringEquals": {
5858
"s3:x-amz-acl": "bucket-owner-full-control"
@@ -104,7 +104,7 @@ module "cloudtrail_baseline" {
104104
iam_role_policy_name = var.cloudtrail_iam_role_policy_name
105105
key_deletion_window_in_days = var.cloudtrail_key_deletion_window_in_days
106106
region = var.region
107-
s3_bucket_name = module.audit_log_bucket.this_bucket_id
107+
s3_bucket_name = module.audit_log_bucket.this_bucket.id
108108
s3_key_prefix = var.cloudtrail_s3_key_prefix
109109
}
110110

@@ -116,7 +116,7 @@ module "alarm_baseline" {
116116
source = "./modules/alarm-baseline"
117117

118118
alarm_namespace = var.alarm_namespace
119-
cloudtrail_log_group_name = module.cloudtrail_baseline.log_group_name
119+
cloudtrail_log_group_name = module.cloudtrail_baseline.log_group.name
120120
sns_topic_name = var.alarm_sns_topic_name
121121
}
122122

‎modules/alarm-baseline/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ Set up CloudWatch alarms to notify you when critical changes happen in your AWS
1414

1515
| Name | Description |
1616
|------|-------------|
17-
| alarm_topic_arn | The ARN of the SNS topic to which CloudWatch Alarms will be sent. |
17+
| alarm_sns_topic | The SNS topic to which CloudWatch Alarms will be sent. |

‎modules/alarm-baseline/outputs.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
output "alarm_topic_arn" {
2-
description = "The ARN of the SNS topic to which CloudWatch Alarms will be sent."
3-
value = aws_sns_topic.alarms.arn
1+
output "alarm_sns_topic" {
2+
description = "The SNS topic to which CloudWatch Alarms will be sent."
3+
value = aws_sns_topic.alarms
44
}

‎modules/cloudtrail-baseline/README.md

+4-8
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,8 @@ Enable CloudTrail in all regions and deliver events to CloudWatch Logs. CloudTra
2121

2222
| Name | Description |
2323
|------|-------------|
24-
| cloudtrail_arn | The ARN of the trail for recording events in all regions. |
25-
| cloudtrail_id | The ID of the trail for recording events in all regions. |
26-
| kms_key_arn | The ARN of the KMS key used for encrypting CloudTrail events. |
27-
| kms_key_id | The ID of the KMS key used for encrypting CloudTrail events. |
28-
| log_delivery_iam_role_arn | The ARN of the IAM role used for delivering CloudTrail events to CloudWatch Logs. |
29-
| log_delivery_iam_role_name | The name of the IAM role used for delivering CloudTrail events to CloudWatch Logs. |
30-
| log_group_arn | The ARN of the CloudWatch Logs log group which stores CloudTrail events. |
31-
| log_group_name | The name of the CloudWatch Logs log group which stores CloudTrail events. |
24+
| cloudtrail | The trail for recording events in all regions. |
25+
| kms_key | The KMS key used for encrypting CloudTrail events. |
26+
| log_delivery_iam_role | The IAM role used for delivering CloudTrail events to CloudWatch Logs. |
27+
| log_group | The CloudWatch Logs log group which stores CloudTrail events. |
3228

0 commit comments

Comments
 (0)