You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <aname="input_name"></a> [name](#input\_name)| (Required) The name of the Analyzer. |`string`| n/a | yes |
40
-
| <aname="input_archive_rules"></a> [archive\_rules](#input\_archive\_rules)| (Optional) A list of archive rules for the AccessAnalyzer Analyzer. Each item of `archive_rules` block as defined below.<br> (Required) `name` - The name of archive rule.<br> (Required) `filters` - A list of filter criterias for the archive rule. Each item of `filters` block as defined below.<br> (Required) `criteria` - The filter criteria.<br> (Optional) `contains` - Contains comparator.<br> (Optional) `exists` - Exists comparator (Boolean).<br> (Optional) `eq` - Equal comparator.<br> (Optional) `neq` - Not Equal comparator. |`any`|`[]`| no |
40
+
| <aname="input_archive_rules"></a> [archive\_rules](#input\_archive\_rules)| (Optional) A list of archive rules for the AccessAnalyzer Analyzer. Each item of `archive_rules` block as defined below.<br/> (Required) `name` - The name of archive rule.<br/> (Required) `filters` - A list of filter criterias for the archive rule. Each item of `filters` block as defined below.<br/> (Required) `criteria` - The filter criteria.<br/> (Optional) `contains` - Contains comparator.<br/> (Optional) `exists` - Exists comparator (Boolean).<br/> (Optional) `eq` - Equal comparator.<br/> (Optional) `neq` - Not Equal comparator. | <pre>list(object({<br/> name = string<br/> filters = list(object({<br/> criteria = string<br/> contains = optional(list(string))<br/> exists = optional(bool)<br/> eq = optional(list(string))<br/> neq = optional(list(string))<br/> }))<br/> }))</pre> |`[]`| no |
41
+
| <a name="input_internal_access_analysis"></a> [internal\_access\_analysis](#input\_internal\_access\_analysis) | (Optional) A configurations for the `INTERNAL_ACCESS` type Analyzer. `internal_access_analysis` as defined below.<br/> (Optional) `rules` - A list of rules for internal access analyzer. Each item of `rules` block as defined below.<br/> (Required) `inclusion` - An inclusion rule to filter findings. `inclusion` as defined below.<br/> (Optional) `accounts` - A set of account IDs to include in the analysis. Account IDs can only be applied to the analysis rule criteria for organization-level analyzers.<br/> (Optional) `resource_arns` - A set of resource ARNs to include in the analysis. The analyzer will only generate findings for resources that match these ARNs.<br/> (Optional) `resource_types` - A set of resource types to include in the analysis. The analyzer will only generate findings for resources of these types | <pre>object({<br/> rules = optional(list(object({<br/> inclusion = object({<br/> accounts = optional(set(string), [])<br/> resource_arns = optional(set(string), [])<br/> resource_types = optional(set(string), [])<br/> })<br/> })), [])<br/> })</pre> | `{}` | no |
41
42
| <aname="input_module_tags_enabled"></a> [module\_tags\_enabled](#input\_module\_tags\_enabled)| (Optional) Whether to create AWS Resource Tags for the module informations. |`bool`|`true`| no |
42
-
| <aname="input_resource_group_description"></a> [resource\_group\_description](#input\_resource\_group\_description)| (Optional) The description of Resource Group. |`string`|`"Managed by Terraform."`| no |
43
-
| <aname="input_resource_group_enabled"></a> [resource\_group\_enabled](#input\_resource\_group\_enabled)| (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. |`bool`|`true`| no |
44
-
| <aname="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name)| (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. |`string`|`""`| no |
43
+
| <aname="input_region"></a> [region](#input\_region)| (Optional) The region in which to create the module resources. If not provided, the module resources will be created in the provider's configured region. |`string`|`null`| no |
44
+
| <aname="input_resource_group"></a> [resource\_group](#input\_resource\_group)| (Optional) A configurations of Resource Group for this module. `resource_group` as defined below.<br/> (Optional) `enabled` - Whether to create Resource Group to find and group AWS resources which are created by this module. Defaults to `true`.<br/> (Optional) `name` - The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. If not provided, a name will be generated using the module name and instance name.<br/> (Optional) `description` - The description of Resource Group. Defaults to `Managed by Terraform.`. | <pre>object({<br/> enabled = optional(bool, true)<br/> name = optional(string, "")<br/> description = optional(string, "Managed by Terraform.")<br/> })</pre> |`{}`| no |
45
45
| <aname="input_scope"></a> [scope](#input\_scope)| (Optional) A scope of Analyzer. Valid values are `ACCOUNT` or `ORGANIZATION`. Defaults to `ACCOUNT`. |`string`|`"ACCOUNT"`| no |
46
46
| <aname="input_tags"></a> [tags](#input\_tags)| (Optional) A map of tags to add to all resources. |`map(string)`|`{}`| no |
47
-
| <aname="input_type"></a> [type](#input\_type)| (Optional) A finding type of Analyzer. Valid values are `EXTERNAL_ACCESS` or `UNUSED_ACCESS`. Defaults to `EXTERNAL_ACCESS`. |`string`|`"EXTERNAL_ACCESS"`| no |
48
-
| <aname="input_unused_access_tracking_period"></a> [unused\_access\_tracking\_period](#input\_unused\_access\_tracking\_period)| (Optional) A number of days for the tracking the period. Findings will be generated for access that hasn't been used in more than the specified number of days. Defaults to `90`. |`number`|`90`| no |
47
+
| <aname="input_type"></a> [type](#input\_type)| (Optional) A finding type of Analyzer. Valid values are `EXTERNAL_ACCESS`, `INTERNAL_ACCESS` or `UNUSED_ACCESS`. Defaults to `EXTERNAL_ACCESS`. |`string`|`"EXTERNAL_ACCESS"`| no |
48
+
| <a name="input_unused_access_analysis"></a> [unused\_access\_analysis](#input\_unused\_access\_analysis) | (Optional) A configurations for the `UNUSED_ACCESS` type Analyzer. `unused_access_analysis` as defined below.<br/> (Optional) `tracking_period` - A number of days for the tracking the period. Findings will be generated for access that hasn't been used in more than the specified number of days. Defaults to `90`.<br/> (Optional) `rules` - A list of rules for unused access analyzer. Each item of `rules` block as defined below.<br/> (Required) `exclusion` - An exclusion rule to filter findings. `exclusion` as defined below.<br/> (Optional) `accounts` - A set of account IDs to exclude from the analysis. Account IDs can only be applied to the analysis rule criteria for organization-level analyzers.<br/> (Optional) `resource_tags` - A list of tag key and value pairs to exclude from the analysis. | <pre>object({<br/> tracking_period = optional(number, 90)<br/> rules = optional(list(object({<br/> exclusion = object({<br/> accounts = optional(set(string), [])<br/> resource_tags = optional(list(map(string)), [])<br/> })<br/> })), [])<br/> })</pre> | `{}` | no |
49
49
50
50
## Outputs
51
51
@@ -54,8 +54,11 @@ This module creates following resources.
54
54
| <aname="output_archive_rules"></a> [archive\_rules](#output\_archive\_rules)| A list of archive rules for the Analyzer. |
55
55
| <aname="output_arn"></a> [arn](#output\_arn)| The Amazon Resource Name (ARN) of this Analyzer. |
56
56
| <aname="output_id"></a> [id](#output\_id)| The ID of this Analyzer. |
57
+
| <aname="output_internal_access_analysis"></a> [internal\_access\_analysis](#output\_internal\_access\_analysis)| The configurations for the `INTERNAL_ACCESS` type Analyzer. |
57
58
| <aname="output_name"></a> [name](#output\_name)| The name of the Analyzer. |
59
+
| <aname="output_region"></a> [region](#output\_region)| The AWS region this module resources resides in. |
60
+
| <aname="output_resource_group"></a> [resource\_group](#output\_resource\_group)| The resource group created to manage resources in this module. |
58
61
| <aname="output_scope"></a> [scope](#output\_scope)| The scope of Analyzer. |
59
62
| <aname="output_type"></a> [type](#output\_type)| The finding type of Analyzer. |
60
-
| <aname="output_unused_access_tracking_period"></a> [unused\_access\_tracking\_period](#output\_unused\_access\_tracking\_period)| The scope of Analyzer. |
63
+
| <aname="output_unused_access_analysis"></a> [unused\_access\_analysis](#output\_unused\_access\_analysis)| The configurations for the `UNUSED_ACCESS` type Analyzer. |
Copy file name to clipboardExpand all lines: modules/access-analyzer/variables.tf
+68-17Lines changed: 68 additions & 17 deletions
Original file line number
Diff line number
Diff line change
@@ -1,17 +1,25 @@
1
+
variable"region" {
2
+
description="(Optional) The region in which to create the module resources. If not provided, the module resources will be created in the provider's configured region."
3
+
type=string
4
+
default=null
5
+
nullable=true
6
+
}
7
+
1
8
variable"name" {
2
9
description="(Required) The name of the Analyzer."
3
10
type=string
11
+
nullable=false
4
12
}
5
13
6
14
variable"type" {
7
-
description="(Optional) A finding type of Analyzer. Valid values are `EXTERNAL_ACCESS` or `UNUSED_ACCESS`. Defaults to `EXTERNAL_ACCESS`."
15
+
description="(Optional) A finding type of Analyzer. Valid values are `EXTERNAL_ACCESS`, `INTERNAL_ACCESS` or `UNUSED_ACCESS`. Defaults to `EXTERNAL_ACCESS`."
error_message="The `type` should be one of `EXTERNAL_ACCESS`, `INTERNAL_ACCESS`, `UNUSED_ACCESS`."
15
23
}
16
24
}
17
25
@@ -27,18 +35,55 @@ variable "scope" {
27
35
}
28
36
}
29
37
30
-
variable"unused_access_tracking_period" {
31
-
description="(Optional) A number of days for the tracking the period. Findings will be generated for access that hasn't been used in more than the specified number of days. Defaults to `90`."
32
-
type=number
33
-
default=90
34
-
nullable=false
38
+
variable"internal_access_analysis" {
39
+
description=<<EOF
40
+
(Optional) A configurations for the `INTERNAL_ACCESS` type Analyzer. `internal_access_analysis` as defined below.
41
+
(Optional) `rules` - A list of rules for internal access analyzer. Each item of `rules` block as defined below.
42
+
(Required) `inclusion` - An inclusion rule to filter findings. `inclusion` as defined below.
43
+
(Optional) `accounts` - A set of account IDs to include in the analysis. Account IDs can only be applied to the analysis rule criteria for organization-level analyzers.
44
+
(Optional) `resource_arns` - A set of resource ARNs to include in the analysis. The analyzer will only generate findings for resources that match these ARNs.
45
+
(Optional) `resource_types` - A set of resource types to include in the analysis. The analyzer will only generate findings for resources of these types
46
+
EOF
47
+
type=object({
48
+
rules =optional(list(object({
49
+
inclusion =object({
50
+
accounts =optional(set(string), [])
51
+
resource_arns =optional(set(string), [])
52
+
resource_types =optional(set(string), [])
53
+
})
54
+
})), [])
55
+
})
56
+
default={}
57
+
nullable=false
58
+
}
59
+
60
+
variable"unused_access_analysis" {
61
+
description=<<EOF
62
+
(Optional) A configurations for the `UNUSED_ACCESS` type Analyzer. `unused_access_analysis` as defined below.
63
+
(Optional) `tracking_period` - A number of days for the tracking the period. Findings will be generated for access that hasn't been used in more than the specified number of days. Defaults to `90`.
64
+
(Optional) `rules` - A list of rules for unused access analyzer. Each item of `rules` block as defined below.
65
+
(Required) `exclusion` - An exclusion rule to filter findings. `exclusion` as defined below.
66
+
(Optional) `accounts` - A set of account IDs to exclude from the analysis. Account IDs can only be applied to the analysis rule criteria for organization-level analyzers.
67
+
(Optional) `resource_tags` - A list of tag key and value pairs to exclude from the analysis.
68
+
EOF
69
+
type=object({
70
+
tracking_period =optional(number, 90)
71
+
rules =optional(list(object({
72
+
exclusion =object({
73
+
accounts =optional(set(string), [])
74
+
resource_tags =optional(list(map(string)), [])
75
+
})
76
+
})), [])
77
+
})
78
+
default={}
79
+
nullable=false
35
80
36
81
validation {
37
82
condition=alltrue([
38
-
var.unused_access_tracking_period>=1,
39
-
var.unused_access_tracking_period<=180
83
+
var.unused_access_analysis.tracking_period>=1,
84
+
var.unused_access_analysis.tracking_period<=180
40
85
])
41
-
error_message="Valid value for `unused_access_tracking_period` is between 1 and 180."
86
+
error_message="Valid value for `tracking_period` is between 1 and 180."
0 commit comments