CloudWatch log groups should have retention period of at least 365 days
CloudWatch log data is often the only record of application errors, authentication events, and API activity available to incident investigators. When retention falls below 365 days, you lose the ability to correlate events across seasonal patterns or investigate breaches discovered months after initial compromise.
CloudWatch Logs storage costs vary by region, log class, and volume, but for most workloads it is a minor line item compared to losing forensic evidence. Setting retention explicitly also prevents runaway spend: log groups default to indefinite retention and can quietly accumulate terabytes if left unmanaged.
Implementation
Choose the approach that matches how you manage Terraform.
Use the compliance.tf module to enforce this control by default. See get started with compliance.tf.
module "apigateway_v2" {
source = "soc2.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "soc2.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "soc2.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "soc2.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "soc2.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "soc2.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "soc2.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "soc2.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "soc2.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "soc2.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "soc2.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "soc2.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "soc2.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "soc2.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "soc2.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "soc2.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "soc2.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "soc2.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "pcidss.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "pcidss.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "pcidss.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "pcidss.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "pcidss.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "pcidss.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "pcidss.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "pcidss.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "pcidss.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "pcidss.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "pcidss.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "pcidss.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "pcidss.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "pcidss.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidss.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidss.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "hipaa.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "hipaa.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "hipaa.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "hipaa.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "hipaa.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "hipaa.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "hipaa.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "hipaa.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "hipaa.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "hipaa.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "hipaa.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "hipaa.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "hipaa.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "hipaa.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaa.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaa.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "iso27001.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "iso27001.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "iso27001.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "iso27001.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "iso27001.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "iso27001.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "iso27001.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "iso27001.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "iso27001.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "iso27001.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "iso27001.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "iso27001.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "iso27001.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "iso27001.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "iso27001.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "iso27001.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nis2.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nis2.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nis2.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nis2.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nis2.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nis2.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nis2.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nis2.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nis2.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nis2.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nis2.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nis2.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nis2.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nis2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nis2.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nis2.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nis2.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nis2.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nis2.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nist80053.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nist80053.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nist80053.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nist80053.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nist80053.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nist80053.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nist80053.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nist80053.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nist80053.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nist80053.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nist80053.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nist80053.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nist80053.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nist80053.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nistcsf.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nistcsf.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nistcsf.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nistcsf.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nistcsf.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nistcsf.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nistcsf.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nistcsf.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nistcsf.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nistcsf.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nistcsf.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nistcsf.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nistcsf.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nistcsf.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsf.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsf.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nist800171.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nist800171.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nist800171.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nist800171.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nist800171.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nist800171.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nist800171.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nist800171.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nist800171.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nist800171.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nist800171.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nist800171.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nist800171.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nist800171.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist800171.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist800171.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nydfs23.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nydfs23.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nydfs23.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nydfs23.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nydfs23.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nydfs23.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nydfs23.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nydfs23.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nydfs23.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nydfs23.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nydfs23.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nydfs23.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nydfs23.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nydfs23.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nydfs23.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nydfs23.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "ffiec.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "ffiec.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "ffiec.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "ffiec.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "ffiec.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "ffiec.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "ffiec.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "ffiec.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "ffiec.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "ffiec.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "ffiec.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "ffiec.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "ffiec.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "ffiec.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "ffiec.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "ffiec.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "ffiec.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "ffiec.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "ffiec.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "fedramplow.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "fedramplow.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "fedramplow.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "fedramplow.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "fedramplow.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "fedramplow.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "fedramplow.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "fedramplow.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "fedramplow.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "fedramplow.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "fedramplow.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "fedramplow.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "fedramplow.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "fedramplow.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedramplow.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedramplow.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
broker_node_client_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}This control is enforced automatically with Compliance.tf modules. Start free trial
If you use terraform-aws-modules/apigateway-v2/aws, set the right module inputs for this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.
module "apigateway_v2" {
source = "terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_retention_in_days = 365
}
}module "cloudwatch" {
source = "terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
retention_in_days = 365
}module "ecs" {
source = "terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_retention_in_days = 365
}module "ecs" {
source = "terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_retention_in_days = 365
}module "ecs" {
source = "terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_retention_in_days = 365
}module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_retention_in_days = 365
}module "elasticache" {
source = "terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_retention_in_days = 365
}module "fsx" {
source = "terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_retention_in_days = 365
}module "fsx" {
source = "terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_retention_in_days = 365
}module "lambda" {
source = "terraform-aws-modules/lambda/aws"
version = "~> 8.9"
create_package = false
function_name = "abc123"
handler = "index.lambda_handler"
local_existing_package = "lambda_function.zip"
runtime = "python3.12"
}module "msk_kafka_cluster" {
source = "terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
cloudwatch_log_group_retention_in_days = 365
}module "opensearch" {
source = "terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_retention_in_days = 365
}module "rds_aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
cloudwatch_log_group_retention_in_days = 365
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
}module "rds" {
source = "terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_retention_in_days = 365
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
}module "redshift" {
source = "terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_retention_in_days = 365
create_cloudwatch_log_group = true
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
}module "step_functions" {
source = "terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_retention_in_days = 365
logging_configuration = {
level = "ALL"
}
}module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_retention_in_days = 365
}module "vpc" {
source = "terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_retention_in_days = 365
}Use AWS provider resources directly. See docs for the resources involved: aws_cloudwatch_log_group.
resource "aws_cloudwatch_log_group" "this" {
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
name = /example/abc123"
retention_in_days = 365
}What this control checks
Every aws_cloudwatch_log_group resource must have retention_in_days set to 365 or higher. AWS only accepts a fixed set of values: 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653. Omitting retention_in_days also fails; the group has no retention policy and logs accumulate indefinitely. Values below 365 (such as 30, 90, or 180) fail regardless of intent. There is no account-level default in AWS, so each log group needs its own setting.
Common pitfalls
Indefinite retention (unset) flagged as non-compliant
It seems counterintuitive: a group with no expiry technically retains logs longer than 365 days. But Config's cw-loggroup-retention-period-check and most compliance scanners flag it as non-compliant because there is no explicit bounded retention period. Always set a numeric value of 365 or higher, even if your intent is to keep logs indefinitely.
Log groups created outside Terraform
Lambda, API Gateway, ECS, and RDS auto-create log groups on first invocation (e.g., /aws/lambda/<function-name>), and all of them default to never-expire. The cleanest fix is to pre-create these groups in Terraform with retention_in_days set before the service writes to them. If pre-creation isn't practical, a Config auto-remediation SSM document or a scheduled Lambda that calls PutRetentionPolicy across all groups is the next best option.
Only specific integer values are valid
retention_in_days accepts a fixed enumeration: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653. Pass an arbitrary integer like 366 or 730 and the API returns an error. The minimum value that passes this control is 365.
Terraform import drift for externally managed groups
Import a log group with terraform import aws_cloudwatch_log_group.example /my/log/group without retention_in_days in the resource block and the next terraform apply removes the existing retention policy, leaving the group at indefinite retention. Always add the argument to the resource block before importing.
Audit evidence
Auditors typically start with the Config rule cw-loggroup-retention-period-check, with minRetentionTime set to 365, and a compliance report or exported CSV showing all evaluated log groups as COMPLIANT. For deeper assurance, they may pull a DescribeLogGroups API response directly, checking that every group's retentionInDays value is 365 or above.
Supporting evidence can include CloudWatch console screenshots showing per-group retention settings and CloudTrail entries for PutRetentionPolicy calls, which establish when retention was set and by whom.
Framework-specific interpretation
SOC 2: CC7.2 and CC7.3 expect organizations to monitor system components and keep enough log data to detect and respond to anomalies. A 365-day window covers a full audit period plus meaningful lookback, which is what Type II examiners ask to see.
PCI DSS v4.0: Requirement 10.7 is explicit: 12 months total retention, with the most recent three months immediately available for analysis. Setting retention_in_days to 365 meets the 12-month requirement. If you want the active window in CloudWatch and archive older data to S3, you need a separate lifecycle policy to cover the three-months-available requirement.
HIPAA Omnibus Rule 2013: 45 CFR 164.312(b) requires audit controls that record and examine activity on systems processing ePHI. The Omnibus Rule's six-year document retention requirement sets a longer bar, but 365 days of CloudWatch logs satisfies the active monitoring and breach investigation obligations, which is what most auditors focus on in a technical review.
ISO/IEC 27001:2022: Annex A control A.8.15 requires logs to be retained according to defined periods that support security event analysis and investigation. Setting an explicit 365-day minimum satisfies the retention requirement; the 'defined' part also means you need a documented log retention policy to back it up.
NIS2 Directive (EU 2022/2555): Article 21 calls for incident handling and security monitoring measures for essential and important entities. Retaining logs for at least one year provides the forensic baseline NIS2 expects for incident reporting and post-incident analysis.
NIST SP 800-53 Rev 5: Maps to AU-11. The control asks for an organization-defined retention period consistent with records retention policy; 365 days covers the minimum most agencies define for operational log data.
NIST Cybersecurity Framework v2.0: A full year of log history supports both DE.CM continuous monitoring and RS.AN incident analysis. Without sufficient retention, analysts lack context for intrusions that dwell for months before detection.
FedRAMP Moderate Baseline Rev 4: AU-11 at the Moderate baseline calls for retention long enough to support after-the-fact investigation of security incidents. The standard FedRAMP expectation is one year online and three years total; 365 days covers the online portion.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudwatch_log_group_retention_period_365 - AWS Config Managed Rule:
CW_LOGGROUP_RETENTION_PERIOD_CHECK - Checkov Checks:
CKV_AWS_338,CKV_AWS_66 - Powerpipe Control:
aws_compliance.control.cloudwatch_log_group_retention_period_365 - Prowler Check:
cloudwatch_log_group_retention_policy_specific_days_enabled - AWS Security Hub Control:
CloudWatch.16
Last reviewed: 2026-03-09
Stop fixing controls one by one. Compliance.tf modules enforce 142 module-backed controls for SOC 2 automatically.