![](https://camo.githubusercontent.com/d29b29b3a301eb1bcc200a5c2f978d18b32fe0dd567ffa99eff8af778877cf0e/68747470733a2f2f74656368616c6c792d636f6e74656e742e73332d75732d776573742d312e616d617a6f6e6177732e636f6d2f7075626c69632d636f6e74656e742f6c616365776f726b5f6c6f676f5f66756c6c2e706e67)
![Codefresh build status](https://camo.githubusercontent.com/6769c3afe3ca90ced28ef81d3a37a5723675745003080fdde2f22442fafae419/68747470733a2f2f672e636f646566726573682e696f2f6170692f6261646765732f706970656c696e652f6c616365776f726b2f7465727261666f726d2d6d6f64756c6573253246746573742d636f6d7061746962696c6974793f747970653d63662d31266b65793d65794a68624763694f694a49557a49314e694a392e4e57566d4e5441784f4755345932466a4f47517a59546b78596a67335a4445782e524a3344457a576d4258724a58376d33386945784a5f6e744776345f4970385654612d616e38674277426f)
Terraform module for configuring an integration with Lacework and AWS for cloud resource configuration assessment.
Name |
Description |
Type |
Default |
Required |
external_id_length |
The length of the external ID to generate. Max length is 1224. Ignored when use_existing_iam_role is set to true |
number |
16 |
no |
iam_role_arn |
The IAM role ARN is required when setting use_existing_iam_role to true |
string |
"" |
no |
iam_role_external_id |
The external ID configured inside the IAM role is required when setting use_existing_iam_role to true |
string |
"" |
no |
iam_role_name |
The IAM role name. Required to match with iam_role_arn if use_existing_iam_role is set to true |
string |
"" |
no |
lacework_aws_account_id |
The Lacework AWS account that the IAM role will grant access |
string |
"434813966438" |
no |
lacework_integration_name |
The name of the integration in Lacework |
string |
"TF config" |
no |
lacework_audit_policy_name |
The name of the custom audit policy (which extends SecurityAudit) to allow Lacework to read configs. Defaults to lwaudit-policy-${random_id.uniq.hex} when empty |
string |
"" |
no |
tags |
A map/dictionary of Tags to be assigned to created resources |
map(string) |
{} |
no |
use_existing_iam_role |
Set this to true to use an existing IAM role |
bool |
false |
no |
use_existing_iam_role_policy |
Set this to true to use an existing policy on the IAM role |
bool |
false |
no |
wait_time |
Amount of time to wait before the next resource is provisioned |
string |
"10s" |
no |
Name |
Description |
external_id |
The External ID configured into the IAM role |
iam_role_arn |
The IAM Role ARN |
iam_role_name |
The IAM Role name |
The Lacework audit policy extends the SecurityAudit policy to facilitate the reading of additional configuration resources.
The audit policy is comprised of the following permissions:
sid |
actions |
resources |
GetEbsEncryptionByDefault |
ec2:GetEbsEncryptionByDefault |
* |
GetBucketPublicAccessBlock |
s3:GetBucketPublicAccessBlock |
* |
EFS |
elasticfilesystem:DescribeFileSystemPolicy |
* |
|
elasticfilesystem:DescribeLifecycleConfiguration |
|
|
elasticfilesystem:DescribeAccessPoints |
|
|
elasticfilesystem:DescribeAccountPreferences |
|
|
elasticfilesystem:DescribeBackupPolicy |
|
|
elasticfilesystem:DescribeReplicationConfigurations |
|
EMR |
elasticmapreduce:ListBootstrapActions |
* |
|
elasticmapreduce:ListInstanceFleets |
|
|
elasticmapreduce:ListInstanceGroups |
|
SAGEMAKER |
sagemaker:GetModelPackageGroupPolicy |
* |
|
sagemaker:GetLineageGroupPolicy |
|