Merge pull request #5 from appvia/comply-with-checkov

feat: update module to comply with terranetes built in checkov policies

README.md

@@ -41,7 +41,7 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
 |------|-------------|------|---------|:--------:|
 | <a name="input_name"></a> [name](#input\_name) | Name used for the cloudwatch group and role | `string` | n/a | yes |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The ID of the VPC to enable flow logs for | `string` | n/a | yes |
-| <a name="input_retention_in_days"></a> [retention\_in\_days](#input\_retention\_in\_days) | Number of days to retain flow logs | `number` | `7` | no |
+| <a name="input_retention_in_days"></a> [retention\_in\_days](#input\_retention\_in\_days) | Number of days to retain flow logs | `number` | `365` | no |
 | <a name="input_traffic_type"></a> [traffic\_type](#input\_traffic\_type) | Type of traffic to capture. Valid values: ACCEPT,REJECT, ALL | `string` | `"ALL"` | no |
 
 ## Outputs

main.tf

@@ -1,3 +1,7 @@
+data "aws_region" "current" {}
+
+data "aws_caller_identity" "current" {}
+
 resource "aws_flow_log" "vpc" {
   log_destination = aws_cloudwatch_log_group.default.arn
   iam_role_arn    = aws_iam_role.log.arn
@@ -8,6 +12,7 @@ resource "aws_flow_log" "vpc" {
 resource "aws_cloudwatch_log_group" "default" {
   name              = var.name
   retention_in_days = var.retention_in_days
+  kms_key_id        = aws_kms_key.log.arn
 }
 
 data "aws_iam_policy_document" "log_assume" {
@@ -24,16 +29,22 @@ data "aws_iam_policy_document" "log_assume" {
 data "aws_iam_policy_document" "log" {
   statement {
     actions = [
-      "logs:CreateLogGroup",
       "logs:CreateLogStream",
       "logs:PutLogEvents",
       "logs:DescribeLogGroups",
       "logs:DescribeLogStreams",
     ]
 
     resources = [
-      "*",
+      aws_cloudwatch_log_group.default.arn,
+      "${aws_cloudwatch_log_group.default.arn}:*"
     ]
+
+    condition {
+      test     = "StringEqualsIfExists"
+      variable = "aws:ResourceAccount"
+      values   = [data.aws_caller_identity.current.account_id]
+    }
   }
 }
 
@@ -46,4 +57,62 @@ resource "aws_iam_role_policy" "log" {
 resource "aws_iam_role" "log" {
   name               = var.name
   assume_role_policy = data.aws_iam_policy_document.log_assume.json
-}
+}
+
+resource "aws_kms_key" "log" {
+  description             = "An KMS key for encrypting cloudwatch logs"
+  enable_key_rotation     = true
+  deletion_window_in_days = 20
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Id      = "key-default-1"
+    Statement = [
+      {
+        Sid    = "Enable IAM User Permissions"
+        Effect = "Allow"
+        Principal = {
+          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
+        },
+        Action   = "kms:*"
+        Resource = "*"
+      },
+      {
+        Sid    = "Allow administration of the key"
+        Effect = "Allow"
+        Principal = {
+          AWS = data.aws_caller_identity.current.arn
+        },
+        Action = [
+          "kms:ReplicateKey",
+          "kms:Create*",
+          "kms:Describe*",
+          "kms:Enable*",
+          "kms:List*",
+          "kms:Put*",
+          "kms:Update*",
+          "kms:Revoke*",
+          "kms:Disable*",
+          "kms:Get*",
+          "kms:Delete*",
+          "kms:ScheduleKeyDeletion",
+          "kms:CancelKeyDeletion"
+        ],
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "logs.${data.aws_region.current.name}.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt*",
+          "kms:Decrypt*",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:Describe*"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}

variables.tf

@@ -5,7 +5,7 @@ variable "name" {
 
 variable "retention_in_days" {
   description = "Number of days to retain flow logs"
-  default     = 7
+  default     = 365
   type        = number
 }