terraform-aws-cloudtrail-cloudwatch-alarms

🤖 Automatic Updates

This PR contains the following updates:

Release Notes

v0.25.0

Compare Source

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box.

This PR has been generated by WhiteSource Renovate. View repository job log here.

🤖 Automatic Updates

what

This is an auto-generated PR that updates the context.tf file to the latest version from cloudposse/terraform-null-label

why

To support all the features of the context interface.

🚀 Enhancements

what

• Updates sns_topic name
  From CloudTrailBreach-threshold-alerts to ${namespace}-${env}-${stage}-cloudwatch-cloudtrail-breach

why

• follow naming convention

what

• Disable use of amazon-managed KMS key
• Use user-supplied CMK if var.kms_master_key_id is not null
• If var.kms_master_key_id is null, create a CMK for SNS topic for encryption of CloudTrailTrailBreach SNS topic and allow CloudWatch to encrypt messages published to the SNS topic.

why

• The SNS topic must be encrypted with a KMS key that allows the CloudWatch service to use it. Messages will fail to be published when using the amazon-managed default KMS key for SNS.

references

• https://github.com/cloudposse/terraform-aws-security-hub/pull/20

what

• Fix the conditional logic for the aws_sns_topic_policy
• Update to allow the alarm to be named
• Update the catalog to reflect other changes

why

• The current logic is incorrect

what

• Adding config_yaml module compatibility
• Change metrics to catalog

why

• To make it easy to load big catalog of metric filters and alerts
• To make the alerts and metrics fully configurable

what

• update context.tf to v0.24.1
• minimum required Terraform version bumped to 0.13.0
• readme updated, Bridgecrew compliance badges added

why

• It allows for setting the letter case of tag names and labels, back compatibility with context v0.22.0 and below
• we have dropped support for Terraform 0.12
• To be able see and fix the recommendations from Bridgecrew so we can position our modules as standards compliant

🤖 Automatic Updates

what

This is an auto-generated PR that updates the context.tf file to the latest version from cloudposse/terraform-null-label

why

To support all the features of the context interface.

what

• update context.tf to v0.23.0
• minimum required Terraform version bumped to 0.13.0
• readme updated, Bridgecrew compliance badges added

why

• It allows for setting the letter case of tag names and labels
• we have dropped support for Terraform 0.12
• To be able see and fix the recommendations from Bridgecrew so we can position our modules as standards compliant

🤖 Automatic Updates

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

• BridgeCrew compliance checks fix
• readme updated
• default behaviour changed: Encrypt SNS Topic Data enabled by default

why

• To be able to position our modules as standards compliant
• Providing explicit note about policy attached directly to user
• To comply BridgeCrew check

references

• https://docs.bridgecrew.io/docs/general_15
• https://docs.bridgecrew.io/docs/logging_13

what

• Upgrade to support Terraform 0.14 and bring up to current Cloud Posse standard

why

• Support Terraform 0.14

why

• There was drift since #21 was merged

references

• #21

• Brings this module into the new ecosystem of tools used by CloudPosse, and updates terraform compatibility to v0.12.x.
• Adds .github dir with all the CloudPosse defaults
• Created a complete test case with updated CloudPosse module references
• Updated syntax for dashboard creation to use terraform native code, then jsonencode
• Extract all metric definitions into single metric_definitions.tf file for readability

why

• Hasn't been updated in a while, and I would like to use it 😄

references

• Closes #11

what

• Fix parenthesis

why

• Some code did not properly include a set of parenthesis

what

• Change filter expressions as per CIS Benchmark guide

why

• Update 3 filters in alarms.tf as per CIS Benchmark guide.

  • Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
  • Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
  • Ensure a log metric filter and alarm exist for AWS Config configuration changes

references

• https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf

related

• Closes #9

what

• Fix permissions

why

• The alerts do not originate from events.amazonaws.com

what

• Regenerate README.md

why

• Previous version of build-harness has some typos

• Fix avatars links