> ## Documentation Index
> Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Compliance

> Manages an AWS compliance baseline with GuardDuty threat detection and registry-wide ECR image scanning across selected Regions.

**Type:** `rvn-aws-compliance` · **Latest version:** `0.1.0`

## Readme

Manages an AWS compliance baseline with GuardDuty threat detection and Basic ECR image scanning on push across selected Regions.

### Account-level setup

Deploy one module for an AWS account and select every Region you want covered. The runner Region controls where Terraform executes; the Regions list controls where both services are configured. Every selected Region must already be enabled for the account.

Each Region receives a GuardDuty detector with explicitly managed protection plans and an ECR registry scanning rule covering all existing and future private repositories. The module supports threat-detection and vulnerability-scanning controls; application alarms, log retention, and other compliance controls remain in their respective modules.

### GuardDuty

S3, EKS audit logs, EC2 malware, RDS login, and Lambda network protection are enabled by default. Runtime Monitoring is opt-in because it adds security-agent costs. Each protection plan is explicitly enabled or disabled in every selected Region.

GuardDuty sends findings to EventBridge. The finding publishing frequency controls updates to existing findings, defaulting to every 15 minutes. Central aggregation and notification routing are configured separately. GuardDuty protection plans incur AWS charges.

### ECR image scanning

Basic scan-on-push is always enabled with a registry-level `*` filter. It covers repositories used by ECS, EKS, EC2, Lambda, and other workloads, including repositories created later. This declares the registry settings checked by OneLeet's image-scanning monitor.

Basic scans check operating-system vulnerabilities on new image pushes. They do not provide continuous scanning or automatically scan all images pushed before this configuration was enabled.

### Existing resources and ownership

GuardDuty detectors and ECR scanning configurations are shared by the whole account in each Region. Keep exactly one Terraform owner per account and Region; do not deploy overlapping instances or also manage them from a VPC or service module.

If GuardDuty is already enabled, import the existing detectors into this module's Terraform state before applying. Do not disable GuardDuty just to adopt this module. Existing protection-plan settings are reconciled to the selected inputs.

Applying replaces any existing ECR Enhanced scanning or custom filters with Basic scan-on-push for all repositories. Review the current configuration before adoption. Manually configured ECR registries can be managed by applying this module.

Removing a Region or destroying the module deletes its GuardDuty detector and findings and resets ECR scanning to Basic without registry rules. It does not delete ECR repositories or images.

### Configuration

| Setting                                  | Default                                 | Purpose                                                                               |
| ---------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------- |
| AWS account                              | Required                                | Account whose regional security settings are managed.                                 |
| Region                                   | Required                                | Terraform runner Region.                                                              |
| Regions                                  | Required                                | Regions covered by both GuardDuty and ECR scanning.                                   |
| ECR scanning                             | Basic scan-on-push for all repositories | Always enabled by this module.                                                        |
| S3, EKS, malware, RDS, Lambda protection | Enabled                                 | GuardDuty protection plans.                                                           |
| Runtime monitoring                       | Disabled                                | Optional workload security agents.                                                    |
| Automated agent management               | EKS, ECS Fargate, EC2                   | Used when Runtime Monitoring is enabled.                                              |
| Finding publishing frequency             | Every 15 minutes                        | Export cadence for updated GuardDuty findings.                                        |
| Tags                                     | Standard Ravion tags                    | Additional tags for GuardDuty detectors; ECR registry scanning does not support tags. |

### Learn more

* [Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html)
* [GuardDuty protection plans](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html)
* [ECR scanning filters](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-filters.html)
* [Source module](https://github.com/ravionhq/modules/tree/rvn-aws-compliance@0.1.0/security/compliance)

## Inputs reference

All inputs for `rvn-aws-compliance` version `0.1.0`. Use the `name` shown for each field as the input key in module config.

### AWS account & region

<ResponseField name="aws_account_id" type="string" required>
  **AWS account.**

  * Immutable after creation
</ResponseField>

<ResponseField name="aws_region" type="string" required>
  **Region.** Region where the Terraform runner executes. GuardDuty and ECR scanning are enabled in the Regions selected below.

  * Immutable after creation
</ResponseField>

### Compliance regions

<ResponseField name="regions" type="string_array" required>
  **Regions.** AWS Regions where GuardDuty and Basic ECR scan-on-push are enabled. ECR scanning covers every repository and replaces existing Enhanced scanning or custom filters. Use one module per account with all required Regions; each Region must already be enabled.
</ResponseField>

### GuardDuty protection plans

<ResponseField name="s3_protection_enabled" type="boolean">
  **S3 protection.** Monitor S3 data events for suspicious access to buckets and objects.

  * Default: `true`
</ResponseField>

<ResponseField name="eks_protection_enabled" type="boolean">
  **EKS protection.** Monitor Kubernetes audit logs from EKS clusters.

  * Default: `true`
</ResponseField>

<ResponseField name="malware_protection_enabled" type="boolean">
  **Malware protection for EC2.** Scan EBS volumes attached to EC2 instances and container workloads when GuardDuty detects malicious behaviour.

  * Default: `true`
</ResponseField>

<ResponseField name="rds_protection_enabled" type="boolean">
  **RDS protection.** Monitor login activity to Aurora and supported RDS databases.

  * Default: `true`
</ResponseField>

<ResponseField name="lambda_protection_enabled" type="boolean">
  **Lambda protection.** Monitor Lambda network activity logs.

  * Default: `true`
</ResponseField>

<ResponseField name="runtime_monitoring_enabled" type="boolean">
  **Runtime monitoring.** OS-level threat detection for EKS, ECS Fargate, and EC2 workloads using the GuardDuty security agent. Adds agent cost per workload.

  * Default: `false`
</ResponseField>

<ResponseField name="runtime_monitoring_automated_agents" type="string_array">
  **Automated agent management.** Workload types where GuardDuty installs and manages the Runtime Monitoring security agent automatically.

  * Default: `["EKS_ADDON_MANAGEMENT","ECS_FARGATE_AGENT_MANAGEMENT","EC2_AGENT_MANAGEMENT"]`
  * Pattern: `^(EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT)$` — Must be EKS\_ADDON\_MANAGEMENT, ECS\_FARGATE\_AGENT\_MANAGEMENT, or EC2\_AGENT\_MANAGEMENT.
  * Shown when: `{"runtime_monitoring_enabled":true}`
</ResponseField>

### Findings

<ResponseField name="finding_publishing_frequency" type="string">
  **Finding publishing frequency.** How often GuardDuty exports updated findings to EventBridge. New findings are always exported within five minutes.

  * Default: `FIFTEEN_MINUTES`
  * Allowed values: `FIFTEEN_MINUTES` (Every 15 minutes), `ONE_HOUR` (Every hour), `SIX_HOURS` (Every 6 hours)
</ResponseField>

### Misc

<ResponseField name="tags" type="keyvalue">
  **Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`
</ResponseField>

### Terraform settings

<ResponseField name="opentofu_version" type="string">
  **OpenTofu version override.** Override the environment's default version for this module
</ResponseField>

<ResponseField name="ravion_state_backend_workspace" type="string">
  **Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

  * Immutable after creation
</ResponseField>

<ResponseField name="advanced_terraform_variables" type="object">
  **Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

  * Default: `{}`
</ResponseField>

<ResponseField name="execution_environment_id" type="string">
  **Terraform execution environment.** Override the execution environment for Terraform runners. Must use the same AWS account as selected above.
</ResponseField>