diff --git a/.gitignore b/.gitignore index f6e46e88..02937ce9 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,9 @@ junit-reports/ # VSCode files .vscode/ + +terraform-kickstarter/.terraform.lock.hcl + +terraform-kickstarter/.terraform/providers/registry.terraform.io/hashicorp/aws/3.56.0/darwin_amd64/terraform-provider-aws_v3.56.0_x5 + +terraform-kickstarter/terraform.tfstate diff --git a/terraform-kickstarter/docs/Prowler-Terraform-Install.gif b/terraform-kickstarter/docs/Prowler-Terraform-Install.gif deleted file mode 100644 index 2a5a068a..00000000 Binary files a/terraform-kickstarter/docs/Prowler-Terraform-Install.gif and /dev/null differ diff --git a/terraform-kickstarter/docs/Validate-Prowler-Subscription.gif b/terraform-kickstarter/docs/Validate-Prowler-Subscription.gif deleted file mode 100644 index b9cb8003..00000000 Binary files a/terraform-kickstarter/docs/Validate-Prowler-Subscription.gif and /dev/null differ diff --git a/terraform-kickstarter/data.tf b/util/terraform-kickstarter/data.tf similarity index 100% rename from terraform-kickstarter/data.tf rename to util/terraform-kickstarter/data.tf diff --git a/util/terraform-kickstarter/docs/tf.md b/util/terraform-kickstarter/docs/tf.md new file mode 100644 index 00000000..645a7057 --- /dev/null +++ b/util/terraform-kickstarter/docs/tf.md @@ -0,0 +1,53 @@ +## Requirements + +| Name | Version | +|------|---------| +| [aws](#requirement\_aws) | ~> 3.54 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | 3.55.0 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_cloudwatch_event_rule.prowler_check_scheduler_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource | +| [aws_cloudwatch_event_target.run_prowler_scan](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource | +| [aws_codebuild_project.prowler_codebuild](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | +| [aws_iam_policy.prowler_event_trigger_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.prowler_kickstarter_iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy_attachment.prowler_event_trigger_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | +| [aws_iam_policy_attachment.prowler_kickstarter_iam_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | +| [aws_iam_role.prowler_event_trigger_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role.prowler_kick_start_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_s3_bucket.prowler_report_storage_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_policy.prowler_report_storage_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | +| [aws_s3_bucket_public_access_block.prowler_report_storage_bucket_block_public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [aws_securityhub_account.securityhub_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_account) | resource | +| [aws_securityhub_product_subscription.security_hub_enable_prowler_findings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_product_subscription) | resource | +| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_iam_policy.SecurityAudit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [codebuild\_timeout](#input\_codebuild\_timeout) | Codebuild timeout setting | `number` | `300` | no | +| [enable\_security\_hub](#input\_enable\_security\_hub) | Enable AWS SecurityHub. | `bool` | `true` | no | +| [enable\_security\_hub\_prowler\_subscription](#input\_enable\_security\_hub\_prowler\_subscription) | Enable a Prowler Subscription. | `bool` | `true` | no | +| [prowler\_cli\_options](#input\_prowler\_cli\_options) | Run Prowler With The Following Command | `string` | `"_q _M json_asff _S _f us_east_1"` | no | +| [prowler\_schedule](#input\_prowler\_schedule) | Run Prowler based on cron schedule | `string` | `"cron(0 0 ? * * *)"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [account\_id](#output\_account\_id) | TODO Move these to outputs file | diff --git a/terraform-kickstarter/main.tf b/util/terraform-kickstarter/main.tf similarity index 100% rename from terraform-kickstarter/main.tf rename to util/terraform-kickstarter/main.tf diff --git a/terraform-kickstarter/outputs.tf b/util/terraform-kickstarter/outputs.tf similarity index 100% rename from terraform-kickstarter/outputs.tf rename to util/terraform-kickstarter/outputs.tf diff --git a/terraform-kickstarter/prowler_build_spec.yml b/util/terraform-kickstarter/prowler_build_spec.yml similarity index 100% rename from terraform-kickstarter/prowler_build_spec.yml rename to util/terraform-kickstarter/prowler_build_spec.yml diff --git a/terraform-kickstarter/readme.md b/util/terraform-kickstarter/readme.md similarity index 96% rename from terraform-kickstarter/readme.md rename to util/terraform-kickstarter/readme.md index 04a3328b..3637cfb4 100644 --- a/terraform-kickstarter/readme.md +++ b/util/terraform-kickstarter/readme.md @@ -24,11 +24,11 @@ Installing Prowler with Terraform is simple and can be completed in under 1 minu - Issue a `terraform apply` - ![Prowler Install](docs/Prowler-Terraform-Install.gif) + ![Prowler Install](https://prowler-docs.s3.amazonaws.com/Prowler-Terraform-Install.gif) - It is likely an error will return related to the SecurityHub subscription. This appears to be Terraform related and you can validate the configuration by navigating to the SecurityHub console. Click Integreations and search for Prowler. Take noe of the green check where it says *Accepting findings* - ![Prowler Subscription](docs/Validate-Prowler-Subscription.gif) + ![Prowler Subscription](https://prowler-docs.s3.amazonaws.com/Validate-Prowler-Subscription.gif) Thats it! Install is now complete. The resources included a Cloudwatch event that will trigger the AWS Codebuild to run daily at 00:00 GMT. If you'd like to run an assessment after the deployment then simply navigate to the Codebuild console and start the job manually. diff --git a/util/terraform-kickstarter/tf_install.sh b/util/terraform-kickstarter/tf_install.sh new file mode 100644 index 00000000..d3d71ce8 --- /dev/null +++ b/util/terraform-kickstarter/tf_install.sh @@ -0,0 +1,9 @@ +#!/bin/bash +#AMZN-Linux Terraform Install Script +git clone https://github.com/singergs/prowler.git +git fetch +cd prowler +git checkout -t origin/terraform-kickstart +sudo yum install -y yum-utils +sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo +sudo yum -y install terraform \ No newline at end of file diff --git a/terraform-kickstarter/variables.tf b/util/terraform-kickstarter/variables.tf similarity index 100% rename from terraform-kickstarter/variables.tf rename to util/terraform-kickstarter/variables.tf