Terraform-Monitor-Notify-AWS-Root-login/roles.tf at master · box9527/Terraform-Monitor-Notify-AWS-Root-login · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
resource "aws_cloudwatch_log_group" "CloudTrailAnalysis" {
  name = "CloudTrailAnalysis"
}

resource "aws_iam_role" "cloudtrail_role" {
  name = "cloudtrail_role"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Service": "cloudtrail.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
}
EOF
}

resource "aws_iam_role_policy" "allow_stream_policy" {
  name = "allow_stream_change"
  role = "${aws_iam_role.cloudtrail_role.id}"

  policy = <<EOF
{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
              ],
              "Resource": [
                "${aws_cloudwatch_log_group.CloudTrailAnalysis.arn}"
              ]
          }
      ]
}
EOF
}

resource "aws_sns_topic" "root_login_notification" {
  name = "RootNotification"
  provisioner "local-exec" {
    command = "aws sns subscribe --region ${var.region} --topic-arn ${self.arn} --protocol email --notification-endpoint ${var.notificationemail}"
  }
}

variable "thiseventname" { default = "LoginRootAccount"}
variable "thisnamespace" { default = "CloudTrailMetrics"}
resource "aws_cloudwatch_log_metric_filter" "rootEvent" {
  name           = "Root_Account_Login"
  pattern        = <<EOF
{ ($.eventSource = "signin.amazonaws.com" ) && ( $.userIdentity.type = "Root" ) }
EOF
  log_group_name = "${aws_cloudwatch_log_group.CloudTrailAnalysis.name}"

  metric_transformation {
    name      = "${var.thiseventname}"
    namespace = "${var.thisnamespace}"
    value     = "1"
  }
}

data "aws_caller_identity" "current" {}
data "aws_iam_account_alias" "current" {}

resource "aws_cloudwatch_metric_alarm" "rootAlarm" {
  alarm_name          = "Root_Account_Login"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = "1"
  metric_name         = "${var.thiseventname}"
  namespace           = "${var.thisnamespace}"
  period              = "300"
  statistic           = "Sum"
  threshold           = "1"

  alarm_description = "in the AWS account with id = ${data.aws_caller_identity.current.account_id} and alias = ${data.aws_iam_account_alias.current.account_alias} the root user logged in"
  alarm_actions     = ["${aws_sns_topic.root_login_notification.arn}"]
}