Skip to content

Commit

Permalink
Merge pull request #206 from schubergphilis/inspector-timeout-config
Browse files Browse the repository at this point in the history
fix: add create timeout config for aws_inspector2_enabler resource
  • Loading branch information
skesarkar-schubergphilis authored Aug 1, 2024
2 parents d249079 + 393e947 commit 3498564
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -547,7 +547,7 @@ module "landing_zone" {
| <a name="input_aws_config_sns_subscription"></a> [aws\_config\_sns\_subscription](#input\_aws\_config\_sns\_subscription) | Subscription options for the aws-controltower-AggregateSecurityNotifications (AWS Config) SNS topic | <pre>map(object({<br> endpoint = string<br> protocol = string<br> }))</pre> | `{}` | no |
| <a name="input_aws_ebs_encryption_by_default"></a> [aws\_ebs\_encryption\_by\_default](#input\_aws\_ebs\_encryption\_by\_default) | Set to true to enable AWS Elastic Block Store encryption by default | `bool` | `true` | no |
| <a name="input_aws_guardduty"></a> [aws\_guardduty](#input\_aws\_guardduty) | AWS GuardDuty settings | <pre>object({<br> enabled = optional(bool, true)<br> finding_publishing_frequency = optional(string, "FIFTEEN_MINUTES")<br> ebs_malware_protection_status = optional(bool, true)<br> eks_addon_management_status = optional(bool, true)<br> eks_audit_logs_status = optional(bool, true)<br> eks_runtime_monitoring_status = optional(bool, true)<br> lambda_network_logs_status = optional(bool, true)<br> rds_login_events_status = optional(bool, true)<br> s3_data_events_status = optional(bool, true)<br> })</pre> | <pre>{<br> "ebs_malware_protection_status": true,<br> "eks_addon_management_status": true,<br> "eks_audit_logs_status": true,<br> "eks_runtime_monitoring_status": true,<br> "enabled": true,<br> "finding_publishing_frequency": "FIFTEEN_MINUTES",<br> "lambda_network_logs_status": true,<br> "rds_login_events_status": true,<br> "s3_data_events_status": true<br>}</pre> | no |
| <a name="input_aws_inspector"></a> [aws\_inspector](#input\_aws\_inspector) | AWS Inspector settings, at least one of the scan options must be enabled | <pre>object({<br> enabled = optional(bool, false)<br> enable_scan_ec2 = optional(bool, true)<br> enable_scan_ecr = optional(bool, true)<br> enable_scan_lambda = optional(bool, true)<br> enable_scan_lambda_code = optional(bool, true)<br> })</pre> | <pre>{<br> "enable_scan_ec2": true,<br> "enable_scan_ecr": true,<br> "enable_scan_lambda": true,<br> "enable_scan_lambda_code": true,<br> "enabled": false<br>}</pre> | no |
| <a name="input_aws_inspector"></a> [aws\_inspector](#input\_aws\_inspector) | AWS Inspector settings, at least one of the scan options must be enabled | <pre>object({<br> enabled = optional(bool, false)<br> enable_scan_ec2 = optional(bool, true)<br> enable_scan_ecr = optional(bool, true)<br> enable_scan_lambda = optional(bool, true)<br> enable_scan_lambda_code = optional(bool, true)<br> resource_create_timeout = optional(string, "15m")<br> })</pre> | <pre>{<br> "enable_scan_ec2": true,<br> "enable_scan_ecr": true,<br> "enable_scan_lambda": true,<br> "enable_scan_lambda_code": true,<br> "enabled": false,<br> "resource_create_timeout": "15m"<br>}</pre> | no |
| <a name="input_aws_required_tags"></a> [aws\_required\_tags](#input\_aws\_required\_tags) | AWS Required tags settings | <pre>map(list(object({<br> name = string<br> values = optional(list(string))<br> enforced_for = optional(list(string))<br> })))</pre> | `null` | no |
| <a name="input_aws_security_hub"></a> [aws\_security\_hub](#input\_aws\_security\_hub) | AWS Security Hub settings | <pre>object({<br> enabled = optional(bool, true)<br> auto_enable_controls = optional(bool, true)<br> auto_enable_default_standards = optional(bool, false)<br> control_finding_generator = optional(string, "SECURITY_CONTROL")<br> create_cis_metric_filters = optional(bool, true)<br> product_arns = optional(list(string), [])<br> standards_arns = optional(list(string), null)<br> })</pre> | <pre>{<br> "auto_enable_controls": true,<br> "auto_enable_default_standards": false,<br> "control_finding_generator": "SECURITY_CONTROL",<br> "create_cis_metric_filters": true,<br> "enabled": true,<br> "product_arns": [],<br> "standards_arns": null<br>}</pre> | no |
| <a name="input_aws_security_hub_sns_subscription"></a> [aws\_security\_hub\_sns\_subscription](#input\_aws\_security\_hub\_sns\_subscription) | Subscription options for the LandingZone-SecurityHubFindings SNS topic | <pre>map(object({<br> endpoint = string<br> protocol = string<br> }))</pre> | `{}` | no |
Expand Down
4 changes: 4 additions & 0 deletions inspector.tf
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,10 @@ resource "aws_inspector2_enabler" "member_accounts" {
account_ids = toset(local.inspector_members_account_ids)
resource_types = local.inspector_enabled_resource_types

timeouts {
create = var.aws_inspector.resource_create_timeout
}

depends_on = [aws_inspector2_member_association.default]
}

Expand Down
2 changes: 2 additions & 0 deletions variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -127,13 +127,15 @@ variable "aws_inspector" {
enable_scan_ecr = optional(bool, true)
enable_scan_lambda = optional(bool, true)
enable_scan_lambda_code = optional(bool, true)
resource_create_timeout = optional(string, "15m")
})
default = {
enabled = false
enable_scan_ec2 = true
enable_scan_ecr = true
enable_scan_lambda = true
enable_scan_lambda_code = true
resource_create_timeout = "15m"
}
description = "AWS Inspector settings, at least one of the scan options must be enabled"
}
Expand Down

0 comments on commit 3498564

Please sign in to comment.