About aws-app-ditd-darhts-s3-transfer

Usage

module "darhts-s3-transfer" {
  source = "git@github.e.it.census.gov:terraform-modules/aws-app-ditd-darhts-s3-transfer.git"

  api_client_id         = "3M1234.12343x"
  api_client_secret     = "C1D66"
  environment_label     = "ite"
  secret_name           = "/app/ditd-darhts/ite/salesforce-api"
  secret_key_name       = "ditd-darhts-ite-salesforce-api"
  input_resource_label  = "ditd-darhts-ite"
  output_resource_label = "adsd-dapps-ite"
  input_resource_tags = {
    finops_project_number = "fs1234567890"
    finops_project_name   = "adsd_darhts"
  }
  output_resource_tags = {
    finops_project_number = "fs0123456789"
    finops_project_name   = "adsd_dapps"
  }
  settings = {
    guardduty-move = {}
    guardduty-notify = {
      environment            = "ite"
      secret_name            = "/app/ditd-darhts/ite/salesforce-api"
      auth_url               = "https://census-darhts--ite.sandbox.my.salesforce.com/services/oauth2/token"
      salesforce_api_version = "64.0"
      platform_event_name    = "GuardDutyObjectScan__e"
    }
    s3-tag = {
      environment = "ite"
      trigger_tags = {
        GuardDutyMalwareScanStatus = "NO_THREATS_FOUND"
        darhts_certified           = "true"
      }
    }
    s3 = {
      environment            = "ite"
      secret_name            = "/app/ditd-darhts/ite/salesforce-api"
      auth_url               = "https://census-darhts--ite.sandbox.my.salesforce.com/services/oauth2/token"
      salesforce_api_version = "64.0"
      platform_event_name    = "DARHTSCleanCreateObjectEvent__e"
    }
  }
}

Links

This uses a number of internal and external modules. Here are references for those:

Internal
- boc-nts/base-label
- aws-s3/standard
External

Requirements

Name	Version
terraform	>= 1.5.7
aws	>= 6.0

Providers

Name	Version
aws	>= 6.0

Modules

Name	Source	Version
base	git@github.e.it.census.gov:terraform-modules/boc-nts//base-label	n/a
eventbridge_guardduty	terraform-aws-modules/eventbridge/aws	4.1.0
eventbridge_s3	terraform-aws-modules/eventbridge/aws	4.1.0
files_clean	git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard	tf-upgrade
files_in	git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard	tf-upgrade
files_out_clean	git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard	tf-upgrade
files_quarantine	git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard	tf-upgrade
lambda_layer	terraform-aws-modules/lambda/aws	8.0.1
lambda_move	terraform-aws-modules/lambda/aws	8.0.1
lambda_move_alias	terraform-aws-modules/lambda/aws//modules/alias	8.0.1
lambda_move_failure	terraform-aws-modules/sqs/aws	5.0.0
lambda_notify	terraform-aws-modules/lambda/aws	8.0.1
lambda_notify_alias	terraform-aws-modules/lambda/aws//modules/alias	8.0.1
lambda_notify_failure	terraform-aws-modules/sqs/aws	5.0.0
lambda_s3	terraform-aws-modules/lambda/aws	8.0.1
lambda_s3_alias	terraform-aws-modules/lambda/aws//modules/alias	8.0.1
lambda_s3_failure	terraform-aws-modules/sqs/aws	5.0.0
lambda_s3_tag	terraform-aws-modules/lambda/aws	8.0.1
lambda_s3_tag_alias	terraform-aws-modules/lambda/aws//modules/alias	8.0.1
lambda_s3_tag_failure	terraform-aws-modules/sqs/aws	5.0.0

Resources

Name	Type
aws_cloudwatch_log_group.guardduty_event_log	resource
aws_cloudwatch_log_resource_policy.guardduty_event_log	resource
aws_guardduty_malware_protection_plan.s3_malware	resource
aws_iam_role.guardduty_malware_role	resource
aws_iam_role_policy.guardduty_malware_policy	resource
aws_kms_alias.app_secret	resource
aws_kms_key.app_secret	resource
aws_s3_bucket_notification.files_clean	resource
aws_s3_bucket_notification.files_out_clean	resource
aws_secretsmanager_secret.app_secret	resource
aws_secretsmanager_secret_version.app_secret	resource
aws_arn.current	data source
aws_caller_identity.current	data source
aws_guardduty_detector.main	data source
aws_iam_policy_document.app_secret	data source
aws_iam_policy_document.app_secret_key	data source
aws_iam_policy_document.guardduty_event_log	data source
aws_iam_policy_document.guardduty_malware_access_policy	data source
aws_iam_policy_document.guardduty_malware_access_policy_old	data source
aws_iam_policy_document.guardduty_malware_assume_role	data source
aws_iam_policy_document.lambda_move	data source
aws_iam_policy_document.lambda_notify	data source
aws_iam_policy_document.lambda_s3	data source
aws_iam_policy_document.lambda_s3_tag	data source
aws_iam_role.inf_cloud_admin	data source
aws_kms_key.s3_key	data source
aws_region.current	data source
aws_s3_bucket.log_bucket	data source

Inputs

Name	Description	Type	Default	Required
account_alias	AWS Account Alias	`string`	`""`	no
account_id	AWS Account ID (default will pull from current user)	`string`	`""`	no
api_client_id	Salesforce API Client Id	`string`	n/a	yes
api_client_secret	Salesforce API Client Secreet	`string`	n/a	yes
dlq_event_age	Dead Letter Queue maximum_event_age_in_seconds (default: 3600)	`number`	`300`	no
dlq_retry_attempts	Dead Letter Queue maxium_retry_attempts (default: 3)	`number`	`3`	no
environment_label	Label to be used as the environment	`string`	n/a	yes
input_resource_label	Label to be used on input components (in, clean, quarantine and related resources)	`string`	n/a	yes
input_resource_tags	AWS Tags to apply to input resources (should include finops_ tags)	`map(string)`	`{}`	no
lambda_environment_variables_override	Map of lambda environment variables and values to override from the defaults	`map(string)`	`{}`	no
lambda_ephemeral_storage_size	Lambda emphemral storage size (minimum 512M)	`number`	`512`	no
lambda_memory_size	Memory size (minimum 128M)	`number`	`128`	no
lambda_timeout	Lambda Timeout in seconds	`number`	`300`	no
log_bucket	AWS Log Bucket (default: inf-logs-ACCOUNT-REGION)	`string`	`null`	no
log_retention_in_days	Number of days to keep cloudwatch logs (default is 30). See the documentation for available values.	`number`	`30`	no
output_resource_label	Label to be used on output components (replication clean and related resources)	`string`	n/a	yes
output_resource_tags	AWS Tags to apply to output resources (should include finops_ tags)	`map(string)`	`{}`	no
override_prefixes	Override built-in prefixes by component. This should be used primarily for common infrastructure things	`map(string)`	`{}`	no
python_runtime	Python runtime version	`string`	`"3.12"`	no
secret_description	Description to be used for the AWS Secret for the Salesforce API	`string`	`"Credentials for Salesforce API"`	no
secret_key_name	Name to be used for the AWS Secret KMS Key	`string`	n/a	yes
secret_name	Label to be used for the AWS Secret for the Salesforce API	`string`	n/a	yes
settings	Configuration settings map	`any`	`{}`	no
tags	AWS Tags to apply to appropriate resources	`map(string)`	`{}`	no

Outputs

Name	Description
s3_bucket_files_clean	files-clean bucket ARN and id
s3_bucket_files_in	files-in bucket ARN and id
s3_bucket_files_out_clean	files-out-clean bucket ARN and id
s3_bucket_files_quarantine	files-quarantine bucket ARN and id
settings	n/a

terraform-modules/aws-app-ditd-darhts-s3-transfer

About

Resources

Stars

Watchers

Forks

Releases 6

Contributors 2

Languages