AWSで使った方が良いセキュリティ系サービスをTerraformで有効化(一部手動あり)

resource "aws_config_configuration_recorder" "main" {
  name     = "${var.prefix}-config-recorder"
  role_arn = var.config_role

  recording_group {
    all_supported                 = true
    # メインのリージョンでのみグローバルリソースの監視を行う
    include_global_resource_types = var.is_main_region ? true : false
  }
}

resource "aws_config_configuration_recorder_status" "main" {
  name       = aws_config_configuration_recorder.main.name
  is_enabled = true
  depends_on = [aws_config_delivery_channel.main]
}

resource "aws_config_delivery_channel" "main" {
  name           = "${var.prefix}-config-delivery-channel"
  s3_bucket_name = var.bucket_name
  s3_key_prefix  = "config"
  depends_on     = [aws_config_configuration_recorder.main]
}

module "guardduty-us-east-1" {
  source = "./modules/guardduty/"

  providers = {
    aws = aws.us-east-1
  }
}

module "guardduty-us-east-2" {
  source = "./modules/guardduty/"

  providers = {
    aws = aws.us-east-2
  }
}
# ...省略していますが全リージョンで有効化しています

resource "aws_guardduty_detector" "guardduty" {
  enable = true
}

resource "aws_securityhub_account" "main" {}

/* CloudWatchEventの作成 */
# CRITICAL・HIGHの検出かつ、新規のものだけ拾う
resource "aws_cloudwatch_event_rule" "securityhub" {
  name        = "${var.prefix}-securityhub"
  description = "SecurutiHub High and Critical Events Event"

  event_pattern = <<EOF
{
  "source": [
    "aws.securityhub"
  ],
  "detail-type": [
    "Security Hub Findings - Imported"
  ],
  "detail": {
    "findings":
      {
        "Compliance": {
          "Status": [
            {
              "anything-but": "PASSED"
            }
          ]
        },
        "Severity": {
           "Label": [
             "CRITICAL",
             "HIGH"
           ]
        },
        "Workflow": {
          "Status": [
            "NEW"
          ]
        },
        "RecordState": [
          "ACTIVE"
        ]
      }
  }
}
EOF
}

resource "aws_cloudwatch_event_target" "sns-publish" {
  rule      = aws_cloudwatch_event_rule.securityhub.name
  target_id = aws_sns_topic.chatbot.name
  arn       = aws_sns_topic.chatbot.arn
}


/* SNS Topicの作成 */

# マネジメントコンソールからChatBotを利用する際に指定する
resource "aws_sns_topic" "chatbot" {
  name              = "${var.prefix}-topic"
  kms_master_key_id = aws_kms_key.for_encrypt_sns_topic.id
}

resource "aws_sns_topic_policy" "chatbot" {
  arn    = aws_sns_topic.chatbot.arn
  policy = data.aws_iam_policy_document.chatbot.json
}
# ...省略

cd infra/global
terraform init
terraform plan
terraform apply