diff --git a/README.md b/README.md index 6a268049..f6c91caf 100644 --- a/README.md +++ b/README.md @@ -422,8 +422,8 @@ module "landing_zone" { | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.3 | -| [aws](#requirement\_aws) | >= 5.26.0 | +| [terraform](#requirement\_terraform) | >= 1.6 | +| [aws](#requirement\_aws) | >= 5.54.0 | | [datadog](#requirement\_datadog) | > 3.0.0 | | [mcaf](#requirement\_mcaf) | >= 0.4.2 | @@ -431,9 +431,9 @@ module "landing_zone" { | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 5.26.0 | -| [aws.audit](#provider\_aws.audit) | >= 5.26.0 | -| [aws.logging](#provider\_aws.logging) | >= 5.26.0 | +| [aws](#provider\_aws) | >= 5.54.0 | +| [aws.audit](#provider\_aws.audit) | >= 5.54.0 | +| [aws.logging](#provider\_aws.logging) | >= 5.54.0 | | [mcaf](#provider\_mcaf) | >= 0.4.2 | ## Modules @@ -480,9 +480,9 @@ module "landing_zone" { | [aws_guardduty_organization_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration) | resource | | [aws_guardduty_organization_configuration_feature.ebs_malware_protection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | | [aws_guardduty_organization_configuration_feature.eks_audit_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | -| [aws_guardduty_organization_configuration_feature.eks_runtime_monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | | [aws_guardduty_organization_configuration_feature.lambda_network_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | | [aws_guardduty_organization_configuration_feature.rds_login_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | +| [aws_guardduty_organization_configuration_feature.runtime_monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | | [aws_guardduty_organization_configuration_feature.s3_data_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) | resource | | [aws_iam_account_password_policy.audit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy) | resource | | [aws_iam_account_password_policy.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy) | resource | @@ -546,7 +546,7 @@ module "landing_zone" { | [aws\_config](#input\_aws\_config) | AWS Config settings | 
object({
    aggregator_account_ids          = optional(list(string), [])
    aggregator_regions              = optional(list(string), [])
    delivery_channel_s3_bucket_name = optional(string, null)
    delivery_channel_s3_key_prefix  = optional(string, null)
    delivery_frequency              = optional(string, "TwentyFour_Hours")
    rule_identifiers                = optional(list(string), [])
  })
| 
{
  "aggregator_account_ids": [],
  "aggregator_regions": [],
  "delivery_channel_s3_bucket_name": null,
  "delivery_channel_s3_key_prefix": null,
  "delivery_frequency": "TwentyFour_Hours",
  "rule_identifiers": []
}
| no | | [aws\_config\_sns\_subscription](#input\_aws\_config\_sns\_subscription) | Subscription options for the aws-controltower-AggregateSecurityNotifications (AWS Config) SNS topic | 
map(object({
    endpoint = string
    protocol = string
  }))
| `{}` | no | | [aws\_ebs\_encryption\_by\_default](#input\_aws\_ebs\_encryption\_by\_default) | Set to true to enable AWS Elastic Block Store encryption by default | `bool` | `true` | no | -| [aws\_guardduty](#input\_aws\_guardduty) | AWS GuardDuty settings | 
object({
    enabled                       = optional(bool, true)
    finding_publishing_frequency  = optional(string, "FIFTEEN_MINUTES")
    ebs_malware_protection_status = optional(bool, true)
    eks_addon_management_status   = optional(bool, true)
    eks_audit_logs_status         = optional(bool, true)
    eks_runtime_monitoring_status = optional(bool, true)
    lambda_network_logs_status    = optional(bool, true)
    rds_login_events_status       = optional(bool, true)
    s3_data_events_status         = optional(bool, true)
  })
| 
{
  "ebs_malware_protection_status": true,
  "eks_addon_management_status": true,
  "eks_audit_logs_status": true,
  "eks_runtime_monitoring_status": true,
  "enabled": true,
  "finding_publishing_frequency": "FIFTEEN_MINUTES",
  "lambda_network_logs_status": true,
  "rds_login_events_status": true,
  "s3_data_events_status": true
}
| no | +| [aws\_guardduty](#input\_aws\_guardduty) | AWS GuardDuty settings | 
object({
    enabled                       = optional(bool, true)
    finding_publishing_frequency  = optional(string, "FIFTEEN_MINUTES")
    ebs_malware_protection_status = optional(bool, true)
    eks_audit_logs_status         = optional(bool, true)
    lambda_network_logs_status    = optional(bool, true)
    rds_login_events_status       = optional(bool, true)
    s3_data_events_status         = optional(bool, true)
    runtime_monitoring_status = optional(object({
      enabled                             = optional(bool, true)
      eks_addon_management_status         = optional(bool, true)
      ecs_fargate_agent_management_status = optional(bool, true)
      ec2_agent_management_status         = optional(bool, true)
    }), {})
  })
| `{}` | no | | [aws\_inspector](#input\_aws\_inspector) | AWS Inspector settings, at least one of the scan options must be enabled | 
object({
    enabled                 = optional(bool, false)
    enable_scan_ec2         = optional(bool, true)
    enable_scan_ecr         = optional(bool, true)
    enable_scan_lambda      = optional(bool, true)
    enable_scan_lambda_code = optional(bool, true)
    resource_create_timeout = optional(string, "15m")
  })
| 
{
  "enable_scan_ec2": true,
  "enable_scan_ecr": true,
  "enable_scan_lambda": true,
  "enable_scan_lambda_code": true,
  "enabled": false,
  "resource_create_timeout": "15m"
}
| no | | [aws\_required\_tags](#input\_aws\_required\_tags) | AWS Required tags settings | 
map(list(object({
    name         = string
    values       = optional(list(string))
    enforced_for = optional(list(string))
  })))
| `null` | no | | [aws\_security\_hub](#input\_aws\_security\_hub) | AWS Security Hub settings | 
object({
    enabled                       = optional(bool, true)
    auto_enable_controls          = optional(bool, true)
    auto_enable_default_standards = optional(bool, false)
    control_finding_generator     = optional(string, "SECURITY_CONTROL")
    create_cis_metric_filters     = optional(bool, true)
    product_arns                  = optional(list(string), [])
    standards_arns                = optional(list(string), null)
  })
| 
{
  "auto_enable_controls": true,
  "auto_enable_default_standards": false,
  "control_finding_generator": "SECURITY_CONTROL",
  "create_cis_metric_filters": true,
  "enabled": true,
  "product_arns": [],
  "standards_arns": null
}
| no | diff --git a/UPGRADING.md b/UPGRADING.md index 5b12094c..79fa1f8e 100644 --- a/UPGRADING.md +++ b/UPGRADING.md @@ -2,6 +2,181 @@ This document captures required refactoring on your part when upgrading to a module version that contains breaking changes. +## Upgrading to v4.0.0 + +> [!WARNING] +> **Read the diagram in [PR 210](https://github.com/schubergphilis/terraform-aws-mcaf-landing-zone/pull/210) and the guide below! If you currently have EKS Runtime Monitoring enabled, you need to perform MANUAL steps after you have migrated to this version.** + +### Behaviour + +Using the default `aws_guardduty` values: +* `EKS_RUNTIME_MONITORING` gets removed from the state (but not disabled) +* `RUNTIME_MONITORING` is enabled including `ECS_FARGATE_AGENT_MANAGEMENT`, `EC2_AGENT_MANAGEMENT`, and `EKS_ADDON_MANAGEMENT`. +* Minimum required AWS provider has been set to `v5.54.0`, and minimum required Terraform version has been set to `v1.6`. + +### Variables + +The following variables have been replaced: +* `aws_guardduty.eks_runtime_monitoring_status` -> `aws_guardduty.runtime_monitoring_status.enabled` +* `aws_guardduty.eks_addon_management_status` -> `aws_guardduty.runtime_monitoring_status.eks_addon_management_status` + +The following variables have been introduced: +* `aws_guardduty.runtime_monitoring_status.ecs_fargate_agent_management_status` +* `aws_guardduty.runtime_monitoring_status.ec2_agent_management_status` + +### EKS Runtime Monitoring to Runtime Monitoring migration + +#### The issue +After you upgraded to this version. **RUNTIME_MONITORING is enabled. But EKS_RUNTIME_MONITORING is not disabled** as is written in the [guardduty_detector_feature documentation](https://registry.terraform.io/providers/hashicorp/aws/5.68.0/docs/resources/guardduty_detector_feature): _Deleting this resource does not disable the detector feature, the resource in simply removed from state instead._ + +To prevent duplicated costs please **disable** EKS_RUNTIME_MONITORING manually after upgrading. + +> [!IMPORTANT] +> Run all the commands with valid credentials in the AWS account where guardduty is delegated administrator. By default this is the **control tower audit** account. +> It's not possible to execute these steps from the AWS Console as the EKS Runtime Monitoring protection plan has already been removed from the GUI. The only way to control this feature is via the CLI. + +#### Step 1: get the GuardDuty detector id + +``` +aws guardduty list-detectors +``` + +Should display: + +``` +{ + "DetectorIds": [ + "12abc34d567e8fa901bc2d34e56789f0" + ] +} +``` + +> [!IMPORTANT] +> Ensure you run this command in the right region! If GuardDuty is enabled in multiple regions then execute all steps for all enabled regions. + +#### Step 2: update the GuardDuty detector + +_Replace 12abc34d567e8fa901bc2d34e56789f0 with your own regional detector-id. Execute these commands in the audit account:_ + +``` +aws guardduty update-detector --detector-id 12abc34d567e8fa901bc2d34e56789f0 --features '[{"Name" : "EKS_RUNTIME_MONITORING", "Status" : "DISABLED"}]' +``` + +#### Step 3: update the GuardDuty organization settings + +Replace the `<>` with your current configuration for auto-enabling GuardDuty. By default this should be set to `ALL`. + +``` +aws guardduty update-organization-configuration --detector-id 12abc34d567e8fa901bc2d34e56789f0 --auto-enable-organization-members <> --features '[{"Name" : "EKS_RUNTIME_MONITORING", "AutoEnable": "NONE"}]' +``` + + +#### Step 4: update the GuardDuty member accounts + +Disable EKS Runtime Monitoring for **all** member accounts in your organization, for example: + +``` +aws guardduty update-member-detectors --detector-id 12abc34d567e8fa901bc2d34e56789f0 --account-ids 111122223333 --features '[{"Name" : "EKS_RUNTIME_MONITORING", "Status" : "DISABLED"}]' +``` + +#### Troubleshooting + +> An error occurred (BadRequestException) when calling the UpdateMemberDetectors operation: The request is rejected because a feature cannot be turned off for a member while organization has the feature flag set to 'All Accounts'. + +Change these options on the AWS console by following the steps below: + +1. Go to the GuardDuty Console. +2. On left navigation bar, under protection plans, select `Runtime Monitoring`. +3. Under the `Configuration` tab, in `Runtime Monitoring configuration` click `Edit` and here you need to select the option `Configure accounts manually` for `Automated agent configuration - Amazon EKS`. + +Once complete, please allow a minute for the changes to update, you should now be able to execute the command from step 3. When you have executed this command for all AWS accounts, set this option back to `Enable for all accounts`. + +> Even after following all steps I still see the message `Your organization has auto-enable preferences set for EKS Runtime Monitoring. This feature has been removed from console experience and can now be managed as part of the Runtime Monitoring feature. Learn more`. + +We have checked in with AWS and this behaviour is expected, this is a static message that is displayed currently on the AWS Management Console. AWS could not confirm how to hide this message or how long it will be visible. + +#### Verification + +Review the GuardDuty organization settings: + +``` +aws guardduty describe-organization-configuration --detector-id 12abc34d567e8fa901bc2d34e56789f0 +``` + +Should display: + +``` +... + "Features": [ +... + { + "Name": "EKS_RUNTIME_MONITORING", + "AutoEnable": "NONE", + "AdditionalConfiguration": [ + { + "Name": "EKS_ADDON_MANAGEMENT", + "AutoEnable": "ALL" + } + ] + }, +... +``` + +Review the GuardDuty detector settings: + +``` +aws guardduty get-detector --detector-id 12abc34d567e8fa901bc2d34e56789f0 +``` + +Should display: + +``` +... + "Features": [ +... + { + "Name": "EKS_RUNTIME_MONITORING", + "Status": "DISABLED", + "UpdatedAt": "2024-10-16T14:12:31+02:00", + "AdditionalConfiguration": [ + { + "Name": "EKS_ADDON_MANAGEMENT", + "Status": "ENABLED", + "UpdatedAt": "2024-10-16T14:24:43+02:00" + } + ] + }, +... +``` + +> [!NOTE] +> If you want to be really sure all member accounts have the right settings you can run the `aws guardduty get-detector` for member accounts as well. Ensure you have valid credentials for the member account and replace the `detector-id` with the GuardDuty `detector-id` of the member account. + +## Upgrading to v3.0.0 + +### Behaviour + +This version add Control Tower 3.x support. Upgrade to Control Tower 3.x before upgrading to this version. + +## Upgrading to v2.0.0 + +### Behaviour + +This version sets the minimum required aws provider version from v4 to v5. + +### Variables + +The following variables have been replaced: +* `aws_guardduty.datasources.malware_protection` -> `aws_guardduty.ebs_malware_protection_status` +* `aws_guardduty.datasources.kubernetes` -> `aws_guardduty.eks_audit_logs_status` +* `aws_guardduty.datasources.s3_logs` -> `aws_guardduty.s3_data_events_status` + +The following variables have been introduced: +* `aws_guardduty.eks_addon_management_status` +* `aws_guardduty.eks_runtime_monitoring_status` +* `aws_guardduty.lambda_network_logs_status` +* `aws_guardduty.rds_login_events_status` + ## Upgrading to v1.0.0 ### Behaviour diff --git a/examples/basic/versions.tf b/examples/basic/versions.tf index ceefbc2a..99a66d55 100644 --- a/examples/basic/versions.tf +++ b/examples/basic/versions.tf @@ -2,7 +2,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 4.40.0" + version = ">= 5.54.0" } datadog = { source = "datadog/datadog" @@ -13,5 +13,5 @@ terraform { version = ">= 0.4.2" } } - required_version = ">= 1.3" + required_version = ">= 1.6" } diff --git a/guardduty.tf b/guardduty.tf index f66b1ee3..6f2fd1df 100644 --- a/guardduty.tf +++ b/guardduty.tf @@ -6,6 +6,16 @@ resource "aws_guardduty_organization_admin_account" "audit" { } // AWS GuardDuty - Audit account configuration +resource "aws_guardduty_detector" "audit" { + #checkov:skip=CKV_AWS_238: "Ensure that GuardDuty detector is enabled" - False positive, GuardDuty is enabled by default. + #checkov:skip=CKV2_AWS_3: "Ensure GuardDuty is enabled to specific org/region" - False positive, GuardDuty is enabled by default. + provider = aws.audit + + enable = var.aws_guardduty.enabled + finding_publishing_frequency = var.aws_guardduty.finding_publishing_frequency + tags = var.tags +} + resource "aws_guardduty_organization_configuration" "default" { count = var.aws_guardduty.enabled == true ? 1 : 0 provider = aws.audit @@ -16,14 +26,6 @@ resource "aws_guardduty_organization_configuration" "default" { depends_on = [aws_guardduty_organization_admin_account.audit] } -resource "aws_guardduty_detector" "audit" { - provider = aws.audit - - enable = var.aws_guardduty.enabled - finding_publishing_frequency = var.aws_guardduty.finding_publishing_frequency - tags = var.tags -} - resource "aws_guardduty_organization_configuration_feature" "ebs_malware_protection" { provider = aws.audit @@ -40,20 +42,6 @@ resource "aws_guardduty_organization_configuration_feature" "eks_audit_logs" { auto_enable = var.aws_guardduty.eks_audit_logs_status == true ? "ALL" : "NONE" } -resource "aws_guardduty_organization_configuration_feature" "eks_runtime_monitoring" { - provider = aws.audit - - detector_id = aws_guardduty_detector.audit.id - name = "EKS_RUNTIME_MONITORING" - auto_enable = var.aws_guardduty.eks_runtime_monitoring_status == true ? "ALL" : "NONE" - - - additional_configuration { - name = "EKS_ADDON_MANAGEMENT" - auto_enable = var.aws_guardduty.eks_addon_management_status == true ? "ALL" : "NONE" - } -} - resource "aws_guardduty_organization_configuration_feature" "lambda_network_logs" { provider = aws.audit @@ -77,3 +65,38 @@ resource "aws_guardduty_organization_configuration_feature" "s3_data_events" { name = "S3_DATA_EVENTS" auto_enable = var.aws_guardduty.s3_data_events_status == true ? "ALL" : "NONE" } + +resource "aws_guardduty_organization_configuration_feature" "runtime_monitoring" { + provider = aws.audit + + detector_id = aws_guardduty_detector.audit.id + name = "RUNTIME_MONITORING" + auto_enable = var.aws_guardduty.runtime_monitoring_status.enabled == true ? "ALL" : "NONE" + + dynamic "additional_configuration" { + for_each = var.aws_guardduty.runtime_monitoring_status.ecs_fargate_agent_management_status == true ? ["ECS_FARGATE_AGENT_MANAGEMENT"] : [] + + content { + name = additional_configuration.value + auto_enable = "ALL" + } + } + + dynamic "additional_configuration" { + for_each = var.aws_guardduty.runtime_monitoring_status.ec2_agent_management_status == true ? ["EC2_AGENT_MANAGEMENT"] : [] + + content { + name = additional_configuration.value + auto_enable = "ALL" + } + } + + dynamic "additional_configuration" { + for_each = var.aws_guardduty.runtime_monitoring_status.eks_addon_management_status == true ? ["EKS_ADDON_MANAGEMENT"] : [] + + content { + name = additional_configuration.value + auto_enable = "ALL" + } + } +} diff --git a/variables.tf b/variables.tf index b244d11b..8c7d3b52 100644 --- a/variables.tf +++ b/variables.tf @@ -99,24 +99,18 @@ variable "aws_guardduty" { enabled = optional(bool, true) finding_publishing_frequency = optional(string, "FIFTEEN_MINUTES") ebs_malware_protection_status = optional(bool, true) - eks_addon_management_status = optional(bool, true) eks_audit_logs_status = optional(bool, true) - eks_runtime_monitoring_status = optional(bool, true) lambda_network_logs_status = optional(bool, true) rds_login_events_status = optional(bool, true) s3_data_events_status = optional(bool, true) + runtime_monitoring_status = optional(object({ + enabled = optional(bool, true) + eks_addon_management_status = optional(bool, true) + ecs_fargate_agent_management_status = optional(bool, true) + ec2_agent_management_status = optional(bool, true) + }), {}) }) - default = { - enabled = true - finding_publishing_frequency = "FIFTEEN_MINUTES" - ebs_malware_protection_status = true - eks_addon_management_status = true - eks_audit_logs_status = true - eks_runtime_monitoring_status = true - lambda_network_logs_status = true - rds_login_events_status = true - s3_data_events_status = true - } + default = {} description = "AWS GuardDuty settings" } diff --git a/versions.tf b/versions.tf index 0cb25581..ff18295b 100644 --- a/versions.tf +++ b/versions.tf @@ -2,7 +2,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.26.0" + version = ">= 5.54.0" configuration_aliases = [aws.audit, aws.logging] } datadog = { @@ -14,5 +14,5 @@ terraform { version = ">= 0.4.2" } } - required_version = ">= 1.3" + required_version = ">= 1.6" }