GSA / GSA/grace-logging

Make object level logging an option

Open
#34 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
HCL
Stars
0
Forks
5
PR merge metrics
No merged PRs in 30d

Description

We are failing some non-CIS checks when running Prowler against a dev environment where object level logging is not enable in CloudTrail.

***Warning***
There is some complexity, chicken vs egg type scenario, around this issue as it needs to be either enabled for all buckets or specified individually within the aws_cloudtrail resource. The complexity comes from the fact that the buckets need the access log bucket part of this module to exist as it is part of their configuration.

One option would be to use a dynamic block for the `event_selector` and treat that section as conditional by setting the value of a new variable `enable_object_logging` to an empty list or a list containing a single value based on that same variable's string value. Kinda like the old count conditional but within a section of the resource vs the entire thing.

#### variables.tf append

```
variable enable_object_logging {
description = "Enable object level logging on all buckets logging to CloudTrail. Set to true to enable or false to disable"
default = "true"
}
```

#### cloudtrail.tf edit

```
# Setup CloudTrail
resource "aws_cloudtrail" "cloudtrail" {
name = var.cloudtrail_name
s3_bucket_name = aws_s3_bucket.logging.bucket
s3_key_prefix = var.cloudtrail_bucket_prefix
include_global_service_events = var.cloudtrail_include_global_service_events
is_multi_region_trail = var.cloudtrail_multi_region
enable_log_file_validation = var.cloudtrail_enable_log_validation
kms_key_id = aws_kms_key.cloudtrail.arn
cloud_watch_logs_group_arn = aws_cloudwatch_log_group.cloudtrail.arn
cloud_watch_logs_role_arn = aws_iam_role.cloudtrail.arn

dynamic "event_selector" {
for_each = var.enable_object_logging == "true" ? ["true"] : []
content {
read_write_type = "All"
include_management_events = true
data_resource {
type = "AWS::S3::Object"
values = ["arn:aws:s3:::"]
}
}
}

depends_on = [aws_s3_bucket_policy.logging]
}
```

**Note:**

The only section of code tested above was the dynamic block for the event selector in a separate test module. The logic works, but needs to be run through dev.

My apologies for the wordy / needy issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.