Log groups should have encryption at rest enabled
CloudWatch Log Groups frequently contain application secrets, database connection strings, IP addresses, and authentication tokens emitted by running workloads. While AWS applies service-managed encryption by default, a customer-managed KMS key gives you explicit control over the key lifecycle, rotation schedule, and access policy. Without a CMK, you cannot revoke access to historical log data independently of IAM, nor can you enforce separation of duties between the team that writes logs and the team that reads them.
Using a CMK also improves auditability through CloudTrail records of KMS key usage and management activity, though CloudTrail doesn't capture every internal data-key operation.
Implementation
Choose the approach that matches how you manage Terraform.
Use the compliance.tf module to enforce this control by default. See get started with compliance.tf.
module "apigateway_v2" {
source = "soc2.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "soc2.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "soc2.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "soc2.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "soc2.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "soc2.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "soc2.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "soc2.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "soc2.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "soc2.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "soc2.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "soc2.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "soc2.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "soc2.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "soc2.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "soc2.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "soc2.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "soc2.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "pcidss.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "pcidss.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "pcidss.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "pcidss.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "pcidss.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "pcidss.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "pcidss.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "pcidss.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "pcidss.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "pcidss.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "pcidss.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "pcidss.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "pcidss.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "pcidss.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidss.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidss.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "hipaa.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "hipaa.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "hipaa.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "hipaa.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "hipaa.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "hipaa.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "hipaa.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "hipaa.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "hipaa.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "hipaa.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "hipaa.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "hipaa.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "hipaa.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "hipaa.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaa.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaa.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "iso27001.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "iso27001.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "iso27001.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "iso27001.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "iso27001.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "iso27001.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "iso27001.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "iso27001.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "iso27001.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "iso27001.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "iso27001.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "iso27001.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "iso27001.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "iso27001.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "iso27001.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "iso27001.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "gdpr.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "gdpr.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "gdpr.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "gdpr.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "gdpr.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "gdpr.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "gdpr.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "gdpr.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "gdpr.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "gdpr.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "gdpr.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "gdpr.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "gdpr.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "gdpr.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "gdpr.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "gdpr.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "gdpr.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "gdpr.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "gdpr.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nist80053.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "nist80053.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nist80053.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nist80053.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nist80053.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nist80053.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nist80053.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nist80053.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nist80053.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nist80053.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nist80053.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nist80053.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nist80053.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nist80053.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nistcsf.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "nistcsf.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nistcsf.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nistcsf.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nistcsf.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nistcsf.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nistcsf.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nistcsf.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nistcsf.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nistcsf.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nistcsf.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nistcsf.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nistcsf.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nistcsf.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsf.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsf.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nist800171.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "nist800171.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nist800171.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nist800171.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nist800171.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nist800171.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nist800171.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nist800171.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nist800171.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nist800171.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nist800171.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nist800171.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nist800171.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nist800171.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist800171.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist800171.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nydfs23.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "nydfs23.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nydfs23.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nydfs23.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nydfs23.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nydfs23.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nydfs23.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nydfs23.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nydfs23.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nydfs23.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nydfs23.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nydfs23.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nydfs23.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nydfs23.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nydfs23.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nydfs23.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "fedramplow.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "fedramplow.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "fedramplow.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "fedramplow.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "fedramplow.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "fedramplow.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "fedramplow.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "fedramplow.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "fedramplow.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "fedramplow.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "fedramplow.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "fedramplow.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "fedramplow.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "fedramplow.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedramplow.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "fedramplow.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "hipaasecurity2003.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "apigateway_v2" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
auth_token = "REPLACE-WITH-A-SECRET-0123456789"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
copy_tags_to_backups = true
deployment_type = "PERSISTENT_2"
per_unit_storage_throughput = 125
security_group_ingress_rules = {
example = {
cidr_ipv4 = "10.0.0.0/16"
from_port = 80
ip_protocol = "tcp"
}
}
}module "fsx" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
dead_letter_target_arn = "arn:aws:sqs:eu-west-1:123456789012:example-dlq"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
reserved_concurrent_executions = 10
vpc_security_group_ids = ["sg-0123456789abcdef0"]
vpc_subnet_ids = ["subnet-0123456789abcdef0"]
}module "msk_kafka_cluster" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
client_authentication = {
unauthenticated = false
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cloudwatch_log_group_retention_in_days = 365
cluster_config = {
instance_count = 3
zone_awareness_config = {
availability_zone_count = 3
}
zone_awareness_enabled = true
}
cognito_options = {
enabled = true
identity_pool_id = "eu-west-1:00000000-0000-0000-0000-000000000000"
role_arn = "arn:aws:iam::123456789012:role/example"
user_pool_id = "eu-west-1_example0000"
}
log_publishing_options = [
{
log_type = "AUDIT_LOGS"
},
{
cloudwatch_log_group_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:example"
log_type = "ES_APPLICATION_LOGS"
},
]
vpc_options = {
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1", "subnet-0123456789abcdef2"]
}
}module "rds_aurora" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}module "rds" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
db_subnet_group_name = "example-subnet-group"
enabled_cloudwatch_logs_exports = ["audit"]
port = "3307"
}module "redshift" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
database_name = "mydb"
kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
master_username = "redshiftadmin"
}module "step_functions" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "pcidssv321.compliance.tf/terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}This control is enforced automatically with Compliance.tf modules. Start free trial
If you use terraform-aws-modules/apigateway-v2/aws, set the right module inputs for this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.
module "apigateway_v2" {
source = "terraform-aws-modules/apigateway-v2/aws"
version = "~> 6.1"
domain_name = "example.example.com"
name = "example"
stage_access_log_settings = {
log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}
}module "cloudwatch" {
source = "terraform-aws-modules/cloudwatch/aws//modules/log-group"
version = "~> 5.7"
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "terraform-aws-modules/ecs/aws"
version = "~> 7.6"
capacity_providers = {
example = {
managed_instances_provider = {
instance_launch_template = {
network_configuration = {
subnets = ["subnet-0123456789abcdef0"]
}
storage_configuration = {
storage_size_gib = 30
}
}
}
}
}
cluster_name = "example"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "terraform-aws-modules/ecs/aws//modules/container-definition"
version = "~> 7.6"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "ecs" {
source = "terraform-aws-modules/ecs/aws//modules/express-service"
version = "~> 7.6"
primary_container = {
image = "public.ecr.aws/docker/library/httpd:latest"
}
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 21.26"
name = "example"
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "elasticache" {
source = "terraform-aws-modules/elasticache/aws"
version = "~> 1.11"
num_cache_clusters = 2
replication_group_id = "example-group"
log_delivery_configuration = {
slow-log = {
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
destination_type = "cloudwatch-logs"
log_format = "json"
}
}
}module "emr" {
source = "terraform-aws-modules/emr/aws//modules/virtual-cluster"
version = "~> 3.3"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "terraform-aws-modules/fsx/aws//modules/lustre"
version = "~> 1.3"
storage_capacity = 1200
subnet_ids = ["subnet-0123456789abcdef0"]
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "fsx" {
source = "terraform-aws-modules/fsx/aws//modules/windows"
version = "~> 1.3"
active_directory_id = "d-0123456789"
deployment_type = "MULTI_AZ_1"
preferred_subnet_id = "subnet-0123456789abcdef0"
storage_capacity = 32
subnet_ids = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"]
throughput_capacity = 128
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "lambda" {
source = "terraform-aws-modules/lambda/aws"
version = "~> 8.9"
function_name = "example-function"
handler = "index.handler"
runtime = "python3.14"
cloudwatch_logs_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "msk_kafka_cluster" {
source = "terraform-aws-modules/msk-kafka-cluster/aws"
version = "~> 3.3"
broker_node_instance_type = "kafka.t3.small"
kafka_version = "3.6.0"
number_of_broker_nodes = 3
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "opensearch" {
source = "terraform-aws-modules/opensearch/aws"
version = "~> 2.11"
domain_name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "rds_aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
}module "rds" {
source = "terraform-aws-modules/rds/aws"
version = "~> 7.2"
allocated_storage = 20
engine = "mysql"
family = "mysql8.0"
identifier = "example"
instance_class = "db.t4g.micro"
major_engine_version = "8.0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
enabled_cloudwatch_logs_exports = ["audit"]
}module "redshift" {
source = "terraform-aws-modules/redshift/aws"
version = "~> 7.1"
cluster_identifier = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
create_cloudwatch_log_group = true
logging = {
log_destination_type = "cloudwatch"
log_exports = ["connectionlog"]
}
}module "step_functions" {
source = "terraform-aws-modules/step-functions/aws"
version = "~> 5.1"
name = "example"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
logging_configuration = {
level = "ALL"
}
}module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 6.7"
create_flow_log_cloudwatch_log_group = true
enable_flow_log = true
flow_log_cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}module "vpc" {
source = "terraform-aws-modules/vpc/aws//modules/flow-log"
version = "~> 6.7"
vpc_id = "vpc-0123456789abcdef0"
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
}Use AWS provider resources directly. See docs for the resources involved: aws_cloudwatch_log_group.
resource "aws_cloudwatch_log_group" "this" {
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
name = /example/abc123"
retention_in_days = 365
}What this control checks
The policy checks every aws_cloudwatch_log_group for a non-null kms_key_id set to a valid KMS key ARN. A log group that omits kms_key_id or sets it to an empty string fails. To pass, declare an aws_kms_key resource (or reference an existing key ARN) and set kms_key_id on the log group:
aws_cloudwatch_log_group with kms_key_id = aws_kms_key.logs.arn passes. The referenced aws_kms_key must have a key policy granting the CloudWatch Logs service principal (logs.<region>.amazonaws.com) permission to use the key. Without that policy statement, key association or subsequent log ingestion can fail.
Common pitfalls
KMS key policy missing CloudWatch Logs service principal
Without the right key policy, AssociateKmsKey fails, or subsequent PutLogEvents calls fail with KMS access errors. The policy must explicitly allow logs.<region>.amazonaws.com to perform kms:Encrypt*, kms:Decrypt*, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:Describe*.
Cross-region key references fail silently
A KMS key ARN in us-east-1 cannot encrypt a log group in us-west-2. CloudWatch Logs requires the KMS key to reside in the same region as the log group. Terraform will report an error on apply, but multi-region modules that pass a single key ARN everywhere often hit this.
Importing existing log groups without kms_key_id
After importing a pre-existing aws_cloudwatch_log_group, kms_key_id will be empty if no CMK was previously associated. Terraform won't propose adding it unless you explicitly set it in configuration. Once you do, terraform plan shows the required update.
Lambda and ECS auto-created log groups bypass Terraform
Lambda (/aws/lambda/<fn>) and ECS create log groups automatically on first invocation, and those groups never get a CMK. The fix is to declare aws_cloudwatch_log_group resources before the service launches. Alternatively, enforce an SCP that denies logs:CreateLogGroup to non-admin roles so auto-creation can't happen.
Audit evidence
Auditors expect an AWS Config rule evaluation (such as cloud-watch-log-group-encrypted) showing all log groups COMPLIANT, or equivalent output from an open-source scanner like Prowler or Steampipe. Console evidence should show the "Encryption" field on each log group populated with a KMS key ARN rather than "Default (AWS-managed)". CloudTrail events for AssociateKmsKey confirm when encryption was applied, and kms:Decrypt events tied to the logs.amazonaws.com service principal show the CMK is actively in use.
For periodic review, auditors may also request the KMS key policy document to verify that only authorized principals have decrypt access and that key rotation is enabled.
Framework-specific interpretation
SOC 2: CC6.1 and CC6.6 both touch logical access controls and system operations. CMK-based encryption on log groups, backed by CloudTrail evidence of key usage, supports SOC 2 evaluation of confidentiality and security commitments, alongside broader policy and control requirements.
PCI DSS v4.0: Requirement 3.5 mandates strong cryptography for stored account data, and log groups capturing cardholder data environment traffic or application output fall in scope. A CMK with defined access policies and rotation addresses 3.5.1 and 3.6.1 key management expectations, but full PCI DSS compliance requires additional controls beyond encryption alone.
HIPAA Omnibus Rule 2013: 45 CFR 164.312(a)(2)(iv) treats encryption as an addressable safeguard for ePHI at rest. Log groups ingesting application or audit output from healthcare workloads can contain ePHI. Associating a CMK provides the documented encryption mechanism and key management process that auditors ask to see.
ISO/IEC 27001:2022: A.8.24 governs use of cryptography and expects the organization to manage the lifecycle, access policy, and rotation of any key protecting sensitive data. Associating a CMK with CloudWatch Log Groups brings log encryption under that governance framework.
GDPR: Article 32 calls for appropriate technical measures to secure personal data processing. Log groups frequently contain IP addresses, user identifiers, and request payloads that qualify as personal data. Encrypting them with a CMK gives you a documented, auditable encryption layer that supports data protection impact assessments.
NIST SP 800-53 Rev 5: SC-28 (Protection of Information at Rest) and SC-12 (Cryptographic Key Establishment and Management) both apply. A CMK on CloudWatch Log Groups puts key material under organizational control rather than delegating it entirely to AWS-managed key operations.
NIST Cybersecurity Framework v2.0: PR.DS calls for protecting data at rest through encryption. The CMK adds key management governance that also feeds into ID.AM by tying encryption to identifiable, auditable key resources rather than opaque service-managed keys.
FedRAMP Moderate Baseline Rev 4: FedRAMP Moderate inherits SC-28 and requires FIPS 140-2 validated encryption for data at rest. AWS KMS uses FIPS-validated HSMs, so associating a CMK with CloudWatch Log Groups directly addresses this control.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
log_group_encryption_at_rest_enabled - AWS Config Managed Rule:
CLOUDWATCH_LOG_GROUP_ENCRYPTED - Checkov Check:
CKV_AWS_158 - Powerpipe Control:
aws_compliance.control.log_group_encryption_at_rest_enabled - Prowler Check:
cloudwatch_log_group_kms_encryption_enabled - KICS Query:
0afbcfe9-d341-4b92-a64c-7e6de0543879 - Trivy Check:
AWS-0017
Last reviewed: 2026-03-09
Stop fixing controls one by one. Compliance.tf modules enforce 142 module-backed controls for SOC 2 automatically.