Skip to content

Commit 4bea2ba

Browse files
nozaqnozaq
authored
feat: associate members to master in SecurityHub (nozaq#147)
fixes nozaq#145
1 parent d681d9f commit 4bea2ba

File tree

4 files changed

+115
-73
lines changed

4 files changed

+115
-73
lines changed

‎modules/securityhub-baseline/README.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,11 @@
2424

2525
| Name | Description | Type | Default | Required |
2626
|------|-------------|------|---------|:--------:|
27+
| enable\_aws\_foundational\_standard | Boolean whether AWS Foundations standard is enabled. | `bool` | `true` | no |
28+
| enable\_cis\_standard | Boolean whether CIS standard is enabled. | `bool` | `true` | no |
29+
| enable\_pci\_dss\_standard | Boolean whether PCI DSS standard is enabled. | `bool` | `true` | no |
2730
| enabled | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
28-
| securityhub\_enable\_aws\_foundational\_standard | Boolean whether AWS Foundations standard is enabled. | `bool` | `true` | no |
29-
| securityhub\_enable\_cis\_standard | Boolean whether CIS standard is enabled. | `bool` | `true` | no |
30-
| securityhub\_enable\_pci\_dss\_standard | Boolean whether PCI DSS standard is enabled. | `bool` | `true` | no |
31+
| member\_accounts | A list of IDs and emails of AWS accounts which associated as member accounts. | <pre>list(object({<br> account_id = string<br> email = string<br> }))</pre> | `[]` | no |
3132

3233
## Outputs
3334

‎modules/securityhub-baseline/main.tf

+15-3
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,23 @@ resource "aws_securityhub_account" "main" {
66
count = var.enabled ? 1 : 0
77
}
88

9+
# --------------------------------------------------------------------------------------------------
10+
# Add member accounts
11+
# --------------------------------------------------------------------------------------------------
12+
resource "aws_securityhub_member" "members" {
13+
count = var.enabled ? length(var.member_accounts) : 0
14+
15+
depends_on = [aws_securityhub_account.main]
16+
account_id = var.member_accounts[count.index].account_id
17+
email = var.member_accounts[count.index].email
18+
invite = true
19+
}
20+
921
# --------------------------------------------------------------------------------------------------
1022
# Subscribe CIS benchmark
1123
# --------------------------------------------------------------------------------------------------
1224
resource "aws_securityhub_standards_subscription" "cis" {
13-
count = var.enabled && var.securityhub_enable_cis_standard ? 1 : 0
25+
count = var.enabled && var.enable_cis_standard ? 1 : 0
1426

1527
standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
1628

@@ -21,7 +33,7 @@ resource "aws_securityhub_standards_subscription" "cis" {
2133
# Subscribe AWS foundational security best practices standard
2234
# --------------------------------------------------------------------------------------------------
2335
resource "aws_securityhub_standards_subscription" "aws_foundational" {
24-
count = var.enabled && var.securityhub_enable_aws_foundational_standard ? 1 : 0
36+
count = var.enabled && var.enable_aws_foundational_standard ? 1 : 0
2537

2638
standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/aws-foundational-security-best-practices/v/1.0.0"
2739

@@ -32,7 +44,7 @@ resource "aws_securityhub_standards_subscription" "aws_foundational" {
3244
# Subscribe PCI DSS standard
3345
# --------------------------------------------------------------------------------------------------
3446
resource "aws_securityhub_standards_subscription" "pci_dss" {
35-
count = var.enabled && var.securityhub_enable_pci_dss_standard ? 1 : 0
47+
count = var.enabled && var.enable_pci_dss_standard ? 1 : 0
3648

3749
standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/pci-dss/v/3.2.1"
3850

‎modules/securityhub-baseline/variables.tf

+12-3
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,26 @@ variable "enabled" {
33
default = true
44
}
55

6-
variable "securityhub_enable_cis_standard" {
6+
variable "enable_cis_standard" {
77
description = "Boolean whether CIS standard is enabled."
88
default = true
99
}
1010

11-
variable "securityhub_enable_pci_dss_standard" {
11+
variable "enable_pci_dss_standard" {
1212
description = "Boolean whether PCI DSS standard is enabled."
1313
default = true
1414
}
1515

16-
variable "securityhub_enable_aws_foundational_standard" {
16+
variable "enable_aws_foundational_standard" {
1717
description = "Boolean whether AWS Foundations standard is enabled."
1818
default = true
1919
}
20+
21+
variable "member_accounts" {
22+
description = "A list of IDs and emails of AWS accounts which associated as member accounts."
23+
type = list(object({
24+
account_id = string
25+
email = string
26+
}))
27+
default = []
28+
}

‎securityhub.tf

+84-64
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
# --------------------------------------------------------------------------------------------------
22
# SecurityHub Baseline
33
# --------------------------------------------------------------------------------------------------
4+
locals {
5+
securityhub_member_accounts = var.member_accounts
6+
}
7+
48
module "securityhub_baseline_ap-northeast-1" {
59
source = "./modules/securityhub-baseline"
610

711
providers = {
812
aws = aws.ap-northeast-1
913
}
10-
enabled = contains(var.target_regions, "ap-northeast-1")
11-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
12-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
13-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
14+
enabled = contains(var.target_regions, "ap-northeast-1")
15+
enable_cis_standard = var.securityhub_enable_cis_standard
16+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
17+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
18+
member_accounts = local.securityhub_member_accounts
1419
}
1520

1621
module "securityhub_baseline_ap-northeast-2" {
@@ -20,10 +25,11 @@ module "securityhub_baseline_ap-northeast-2" {
2025
aws = aws.ap-northeast-2
2126
}
2227

23-
enabled = contains(var.target_regions, "ap-northeast-2")
24-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
25-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
26-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
28+
enabled = contains(var.target_regions, "ap-northeast-2")
29+
enable_cis_standard = var.securityhub_enable_cis_standard
30+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
31+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
32+
member_accounts = local.securityhub_member_accounts
2733
}
2834

2935
module "securityhub_baseline_ap-south-1" {
@@ -33,10 +39,11 @@ module "securityhub_baseline_ap-south-1" {
3339
aws = aws.ap-south-1
3440
}
3541

36-
enabled = contains(var.target_regions, "ap-south-1")
37-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
38-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
39-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
42+
enabled = contains(var.target_regions, "ap-south-1")
43+
enable_cis_standard = var.securityhub_enable_cis_standard
44+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
45+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
46+
member_accounts = local.securityhub_member_accounts
4047
}
4148

4249
module "securityhub_baseline_ap-southeast-1" {
@@ -46,10 +53,11 @@ module "securityhub_baseline_ap-southeast-1" {
4653
aws = aws.ap-southeast-1
4754
}
4855

49-
enabled = contains(var.target_regions, "ap-southeast-1")
50-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
51-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
52-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
56+
enabled = contains(var.target_regions, "ap-southeast-1")
57+
enable_cis_standard = var.securityhub_enable_cis_standard
58+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
59+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
60+
member_accounts = local.securityhub_member_accounts
5361
}
5462

5563
module "securityhub_baseline_ap-southeast-2" {
@@ -59,10 +67,11 @@ module "securityhub_baseline_ap-southeast-2" {
5967
aws = aws.ap-southeast-2
6068
}
6169

62-
enabled = contains(var.target_regions, "ap-southeast-2")
63-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
64-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
65-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
70+
enabled = contains(var.target_regions, "ap-southeast-2")
71+
enable_cis_standard = var.securityhub_enable_cis_standard
72+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
73+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
74+
member_accounts = local.securityhub_member_accounts
6675
}
6776

6877
module "securityhub_baseline_ca-central-1" {
@@ -72,10 +81,11 @@ module "securityhub_baseline_ca-central-1" {
7281
aws = aws.ca-central-1
7382
}
7483

75-
enabled = contains(var.target_regions, "ca-central-1")
76-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
77-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
78-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
84+
enabled = contains(var.target_regions, "ca-central-1")
85+
enable_cis_standard = var.securityhub_enable_cis_standard
86+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
87+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
88+
member_accounts = local.securityhub_member_accounts
7989
}
8090

8191
module "securityhub_baseline_eu-central-1" {
@@ -85,10 +95,11 @@ module "securityhub_baseline_eu-central-1" {
8595
aws = aws.eu-central-1
8696
}
8797

88-
enabled = contains(var.target_regions, "eu-central-1")
89-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
90-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
91-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
98+
enabled = contains(var.target_regions, "eu-central-1")
99+
enable_cis_standard = var.securityhub_enable_cis_standard
100+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
101+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
102+
member_accounts = local.securityhub_member_accounts
92103
}
93104

94105
module "securityhub_baseline_eu-north-1" {
@@ -98,10 +109,11 @@ module "securityhub_baseline_eu-north-1" {
98109
aws = aws.eu-north-1
99110
}
100111

101-
enabled = contains(var.target_regions, "eu-north-1")
102-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
103-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
104-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
112+
enabled = contains(var.target_regions, "eu-north-1")
113+
enable_cis_standard = var.securityhub_enable_cis_standard
114+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
115+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
116+
member_accounts = local.securityhub_member_accounts
105117
}
106118

107119
module "securityhub_baseline_eu-west-1" {
@@ -111,10 +123,11 @@ module "securityhub_baseline_eu-west-1" {
111123
aws = aws.eu-west-1
112124
}
113125

114-
enabled = contains(var.target_regions, "eu-west-1")
115-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
116-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
117-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
126+
enabled = contains(var.target_regions, "eu-west-1")
127+
enable_cis_standard = var.securityhub_enable_cis_standard
128+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
129+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
130+
member_accounts = local.securityhub_member_accounts
118131
}
119132

120133
module "securityhub_baseline_eu-west-2" {
@@ -124,10 +137,11 @@ module "securityhub_baseline_eu-west-2" {
124137
aws = aws.eu-west-2
125138
}
126139

127-
enabled = contains(var.target_regions, "eu-west-2")
128-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
129-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
130-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
140+
enabled = contains(var.target_regions, "eu-west-2")
141+
enable_cis_standard = var.securityhub_enable_cis_standard
142+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
143+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
144+
member_accounts = local.securityhub_member_accounts
131145
}
132146

133147
module "securityhub_baseline_eu-west-3" {
@@ -137,10 +151,11 @@ module "securityhub_baseline_eu-west-3" {
137151
aws = aws.eu-west-3
138152
}
139153

140-
enabled = contains(var.target_regions, "eu-west-3")
141-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
142-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
143-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
154+
enabled = contains(var.target_regions, "eu-west-3")
155+
enable_cis_standard = var.securityhub_enable_cis_standard
156+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
157+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
158+
member_accounts = local.securityhub_member_accounts
144159
}
145160

146161
module "securityhub_baseline_sa-east-1" {
@@ -150,10 +165,11 @@ module "securityhub_baseline_sa-east-1" {
150165
aws = aws.sa-east-1
151166
}
152167

153-
enabled = contains(var.target_regions, "sa-east-1")
154-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
155-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
156-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
168+
enabled = contains(var.target_regions, "sa-east-1")
169+
enable_cis_standard = var.securityhub_enable_cis_standard
170+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
171+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
172+
member_accounts = local.securityhub_member_accounts
157173
}
158174

159175
module "securityhub_baseline_us-east-1" {
@@ -163,10 +179,11 @@ module "securityhub_baseline_us-east-1" {
163179
aws = aws.us-east-1
164180
}
165181

166-
enabled = contains(var.target_regions, "us-east-1")
167-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
168-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
169-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
182+
enabled = contains(var.target_regions, "us-east-1")
183+
enable_cis_standard = var.securityhub_enable_cis_standard
184+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
185+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
186+
member_accounts = local.securityhub_member_accounts
170187
}
171188

172189
module "securityhub_baseline_us-east-2" {
@@ -176,10 +193,11 @@ module "securityhub_baseline_us-east-2" {
176193
aws = aws.us-east-2
177194
}
178195

179-
enabled = contains(var.target_regions, "us-east-2")
180-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
181-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
182-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
196+
enabled = contains(var.target_regions, "us-east-2")
197+
enable_cis_standard = var.securityhub_enable_cis_standard
198+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
199+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
200+
member_accounts = local.securityhub_member_accounts
183201
}
184202

185203
module "securityhub_baseline_us-west-1" {
@@ -189,10 +207,11 @@ module "securityhub_baseline_us-west-1" {
189207
aws = aws.us-west-1
190208
}
191209

192-
enabled = contains(var.target_regions, "us-west-1")
193-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
194-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
195-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
210+
enabled = contains(var.target_regions, "us-west-1")
211+
enable_cis_standard = var.securityhub_enable_cis_standard
212+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
213+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
214+
member_accounts = local.securityhub_member_accounts
196215
}
197216

198217
module "securityhub_baseline_us-west-2" {
@@ -202,8 +221,9 @@ module "securityhub_baseline_us-west-2" {
202221
aws = aws.us-west-2
203222
}
204223

205-
enabled = contains(var.target_regions, "us-west-2")
206-
securityhub_enable_cis_standard = var.securityhub_enable_cis_standard
207-
securityhub_enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
208-
securityhub_enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
224+
enabled = contains(var.target_regions, "us-west-2")
225+
enable_cis_standard = var.securityhub_enable_cis_standard
226+
enable_pci_dss_standard = var.securityhub_enable_pci_dss_standard
227+
enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
228+
member_accounts = local.securityhub_member_accounts
209229
}

0 commit comments

Comments
 (0)