rvn-aws-compliance / Latest version: 1.0.0
Readme
Manages an AWS compliance baseline with GuardDuty, ECR image scanning, and regional CloudTrail audit trails.Account-level setup
Deploy one module for an AWS account and select every Region you want covered. The runner Region controls where Terraform executes and hosts the shared CloudTrail bucket; the Regions list controls GuardDuty, ECR scanning and CloudTrail trails. Every selected Region must already be enabled for the account. Each selected Region receives a GuardDuty detector with explicitly managed protection plans and an ECR registry scanning rule covering all existing and future private repositories. CloudTrail trails cover all selected Regions by default, or the CloudTrail regions subset when set. Application alarms and application log retention remain in their respective modules.GuardDuty
S3, EKS audit logs, EC2 malware, RDS login, and Lambda network protection are enabled by default. Runtime Monitoring is opt-in because it adds security-agent costs. Each protection plan is explicitly enabled or disabled in every selected Region. GuardDuty sends findings to EventBridge. The finding publishing frequency controls updates to existing findings, defaulting to every 15 minutes. Central aggregation and notification routing are configured separately. GuardDuty protection plans incur AWS charges.ECR image scanning
Basic scan-on-push is always enabled with a registry-level* filter. It covers repositories used by ECS, EKS, EC2, Lambda, and other workloads, including repositories created later. This declares the registry settings checked by OneLeet’s image-scanning monitor.
Basic scans check operating-system vulnerabilities on new image pushes. They do not provide continuous scanning or automatically scan all images pushed before this configuration was enabled.
CloudTrail
CloudTrail is enabled by default and creates one single-Region trail in each selected Region. CloudTrail regions optionally limits trails to a non-empty subset of Regions; leave it blank for all selected Regions. Turn CloudTrail off to disable all trails. Each trail records read and write management events with log file validation and no data events. The trails share one bucket in the runner Region. Include us-east-1 in Regions and, when set, CloudTrail regions to capture IAM changes and other global service events (CloudFront and the STS global endpoint). Only that trail includes global service events; us-east-1 is not added automatically. STS regional-endpoint events are recorded in their respective Regions. Logs go to a dedicated private S3 bucket with public access blocked, bucket-owner-enforced ownership, versioning, and encryption. Log retention (days) sets lifecycle expiry for current and noncurrent object versions; 365 is the default and 0 keeps them forever. With versioning, current-object expiry makes a version noncurrent, then noncurrent expiry applies. Leave KMS key ARN blank for SSE-S3, or supply a key in the bucket’s runner Region, even for trails in other Regions. Its policy must allow cloudtrail.amazonaws.com to encrypt logs for every selected trail. This module does not manage the key policy. The first copy of management events per Region is free; S3 storage and optional KMS usage incur charges. If an existing trail already records those events in a Region, the additional copy is paid. Leave those Regions out via CloudTrail regions, or turn CloudTrail off if an organization trail already provides full coverage. Destroy fails while the bucket contains logs or object versions: force deletion is disabled. Disabling CloudTrail also attempts to remove its bucket, so preserve or explicitly remove retained logs before doing so.Existing resources and ownership
GuardDuty detectors and ECR scanning configurations are shared by the whole account in each Region. Keep exactly one Terraform owner per account and Region; do not deploy overlapping instances or also manage them from a VPC or service module. If GuardDuty is already enabled, import the existing detectors into this module’s Terraform state before applying. Do not disable GuardDuty just to adopt this module. Existing protection-plan settings are reconciled to the selected inputs. Applying replaces any existing ECR Enhanced scanning or custom filters with Basic scan-on-push for all repositories. Review the current configuration before adoption. Manually configured ECR registries can be managed by applying this module. Removing a Region or destroying the module deletes its GuardDuty detector and findings and resets ECR scanning to Basic without registry rules. It does not delete ECR repositories or images.Configuration
Learn more
Inputs reference
All inputs forrvn-aws-compliance version 1.0.0. Use the name shown for each field as the input key in module config.
AWS account & region
string
required
AWS account.
- Immutable after creation
string
required
Region. Region where the Terraform runner executes. GuardDuty and ECR scanning are enabled in the Regions selected below.
- Immutable after creation
Compliance regions
string_array
required
Regions. Regions for GuardDuty, ECR scanning and CloudTrail. Include us-east-1 for IAM changes; each Region must be enabled.
CloudTrail
boolean
CloudTrail. Use CloudTrail regions to omit existing coverage, or turn off if all Regions are already covered.
- Default:
true
string_array
CloudTrail regions. Defaults to all selected Regions. Leave out Regions an existing trail already covers.
- Shown when:
{"cloudtrail_enabled":true}
number
Log retention (days). S3 lifecycle expiry; 0 keeps logs forever.
- Default:
365 - Min:
0 - Shown when:
{"cloudtrail_enabled":true}
string
KMS key ARN. Leave blank for SSE-S3. Use a bucket-Region key whose policy allows cloudtrail.amazonaws.com for every trail.
- Shown when:
{"cloudtrail_enabled":true}
GuardDuty protection plans
boolean
S3 protection. Monitor S3 data events for suspicious access to buckets and objects.
- Default:
true
boolean
EKS protection. Monitor Kubernetes audit logs from EKS clusters.
- Default:
true
boolean
Malware protection for EC2. Scan EBS volumes attached to EC2 instances and container workloads when GuardDuty detects malicious behaviour.
- Default:
true
boolean
RDS protection. Monitor login activity to Aurora and supported RDS databases.
- Default:
true
boolean
Lambda protection. Monitor Lambda network activity logs.
- Default:
true
boolean
Runtime monitoring. OS-level threat detection for EKS, ECS Fargate, and EC2 workloads using the GuardDuty security agent. Adds agent cost per workload.
- Default:
false
string_array
Automated agent management. Workload types where GuardDuty installs and manages the Runtime Monitoring security agent automatically.
- Default:
["EKS_ADDON_MANAGEMENT","ECS_FARGATE_AGENT_MANAGEMENT","EC2_AGENT_MANAGEMENT"] - Pattern:
^(EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT)$— Must be EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT, or EC2_AGENT_MANAGEMENT. - Shown when:
{"runtime_monitoring_enabled":true}
Findings
string
Finding publishing frequency. How often GuardDuty exports updated findings to EventBridge. New findings are always exported within five minutes.
- Default:
FIFTEEN_MINUTES - Allowed values:
FIFTEEN_MINUTES(Every 15 minutes),ONE_HOUR(Every hour),SIX_HOURS(Every 6 hours)
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
- Default:
true
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
- Default:
true
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.