diff --git a/cloudtrail/generate_splunk.cloudtrail.tf b/cloudtrail/generate_splunk.cloudtrail.tf index a61110a..06063a3 100644 --- a/cloudtrail/generate_splunk.cloudtrail.tf +++ b/cloudtrail/generate_splunk.cloudtrail.tf @@ -4,11 +4,12 @@ data "template_file" "splunk_cloudtrail" { template = file("${path.module}/templates/inputs.cloudtrail.conf.tpl") vars = { - account_id = local.account_id - account_alias = local.account_alias - entry_uuid = random_uuid.splunk_cloudtrail.result - region = local.region - queue_url = var.enable_sqs ? aws_sqs_queue.cloudtrail[0].id : null + account_id = local.account_id + account_alias = local.account_alias + entry_uuid = random_uuid.splunk_cloudtrail.result + region = local.region + cloudtrail_name = local.splunk_name + queue_url = var.enable_sqs ? aws_sqs_queue.cloudtrail[0].id : null } } diff --git a/cloudtrail/templates/inputs.cloudtrail.conf.tpl b/cloudtrail/templates/inputs.cloudtrail.conf.tpl index 78390d9..5154a94 100644 --- a/cloudtrail/templates/inputs.cloudtrail.conf.tpl +++ b/cloudtrail/templates/inputs.cloudtrail.conf.tpl @@ -1,4 +1,4 @@ -[aws_sqs_based_s3://${account_alias}-cloudtrail-${region}] +[aws_sqs_based_s3://${account_alias}-%{cloudtrail_name}-${region}] account = ${account_alias} index = aws polling_interval = 300