This Terraform module can be used to implement AWS GuardDuty in a multi-account setup. That is designating a GuardDuty delegated admin account and then configuring the rest of GuardDuty in such account.
This must be done from the master account of your Organization.
You must first enable GuardDuty in the master account and designate a delegated admin account.
This is so you can later on manage GuardDuty from said delegated admin.
IMPORTANT: designating a GuardDuty delegate admin account will automatically enable GuardDuty in that account.
module "guardduty" {
source = "github.com/binbashar/terraform-aws-guardduty-multiaccount.git//guardduty-delegated-admin"
guarduty_enabled = true
guardduty_delegated_admin_account_id = 111111111111
}Configure GuardDuty: this is intended to be done from an account that has been designated to be a GuardDuty delegated admin.
Important: since designating a GuardDuty delegated admin account automatically enables GuardDuty in that account, you will need to import "module.guardduty.aws_guardduty_detector.this" before you can properly use this example.
module "guardduty" {
source = "github.com/binbashar/terraform-aws-guardduty-multiaccount.git//multiaccount-setup"
guarduty_enabled = true
guardduty_organization_members_auto_enable = false
guardduty_member_accounts = {
shared = {
account_id = 222222222222
email = "[email protected]"
},
appsdevstg = {
account_id = 333333333333
email = "[email protected]"
},
appsprd = {
account_id = 444444444444
email = "[email protected]"
},
root = {
account_id = 000000000000
email = "[email protected]"
}
}
}In order to get the full automated potential of the
Binbash Leverage DevOps Automation Code Library
you should initialize all the necessary helper Makefiles.
You must execute the make init-makefiles command at the root context
╭─delivery at delivery-I7567 in ~/terraform/terraform-aws-backup-by-tags on master✔ 20-09-17
╰─⠠⠵ make
Available Commands:
- init-makefiles initialize makefiles
You'll get all the necessary commands to automatically operate this module via a dockerized approach, example shown below
╭─delivery at delivery-I7567 in ~/terraform/terraform-aws-backup-by-tags on master✔ 20-09-17
╰─⠠⠵ make
Available Commands:
- circleci-validate-config ## Validate A CircleCI Config (https
- format-check ## The terraform fmt is used to rewrite tf conf files to a canonical format and style.
- format ## The terraform fmt is used to rewrite tf conf files to a canonical format and style.
- tf-dir-chmod ## run chown in ./.terraform to gran that the docker mounted dir has the right permissions
- version ## Show terraform version
- init-makefiles ## initialize makefiles╭─delivery at delivery-I7567 in ~/terraform/terraform-aws-backup-by-tags on master✔ 20-09-17
╰─⠠⠵ make format-check
docker run --rm -v /home/delivery/Binbash/repos/Leverage/terraform/terraform-aws-backup-by-tags:"/go/src/project/":rw -v :/config -v /common.config:/common-config/common.config -v ~/.ssh:/root/.ssh -v ~/.gitconfig:/etc/gitconfig -v ~/.aws/bb:/root/.aws/bb -e AWS_SHARED_CREDENTIALS_FILE=/root/.aws/bb/credentials -e AWS_CONFIG_FILE=/root/.aws/bb/config --entrypoint=/bin/terraform -w "/go/src/project/" -it binbash/terraform-awscli-slim:0.12.28 fmt -check
- pipeline-job (NOTE: Will only run after merged PR)
- releases
- changelog
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent