From a13b14aa77f8d9aacd6a9c5138ecf38c76ac68fc Mon Sep 17 00:00:00 2001
From: Johan Steenhoven <1254233+sbkg0002@users.noreply.github.com>
Date: Fri, 3 Nov 2023 17:05:13 +0100
Subject: [PATCH] Add option to provide event_selector for CloudTrail

---
 cloudtrail.tf          | 10 ++++++++++
 examples/basic/main.tf |  4 +++-
 variables.tf           | 24 +++++++++++++++++++++++-
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/cloudtrail.tf b/cloudtrail.tf
index 7d99165..b4a8f9d 100644
--- a/cloudtrail.tf
+++ b/cloudtrail.tf
@@ -11,4 +11,14 @@ resource "aws_cloudtrail" "additional_auditing_trail" {
   s3_bucket_name             = var.additional_auditing_trail.bucket
   kms_key_id                 = var.additional_auditing_trail.kms_key_id
   tags                       = var.tags
+
+  event_selector {
+    data_resource {
+      type   = var.additional_auditing_trail.event_selector.data_resource.type
+      values = var.additional_auditing_trail.event_selector.data_resource.values
+    }
+    include_management_events        = var.additional_auditing_trail.event_selector.include_management_events
+    exclude_management_event_sources = var.additional_auditing_trail.event_selector.exclude_management_event_sources
+    read_write_type                  = var.additional_auditing_trail.event_selector.read_write_type
+  }
 }
diff --git a/examples/basic/main.tf b/examples/basic/main.tf
index 3f33bca..9efb386 100644
--- a/examples/basic/main.tf
+++ b/examples/basic/main.tf
@@ -32,7 +32,9 @@ provider "datadog" {
 }
 
 provider "mcaf" {
-  aws {}
+  aws {
+    region = "eu-west-1"
+  }
 }
 
 module "landing_zone" {
diff --git a/variables.tf b/variables.tf
index cd6442f..8c04795 100644
--- a/variables.tf
+++ b/variables.tf
@@ -3,8 +3,30 @@ variable "additional_auditing_trail" {
     name       = string
     bucket     = string
     kms_key_id = string
+    event_selector = object({
+      data_resource = optional(object({
+        type   = optional(string)
+        values = optional(list(string))
+      }))
+      exclude_management_event_sources = optional(set(string), null)
+      include_management_events        = optional(bool, true)
+      read_write_type                  = optional(string, "All")
+    })
   })
-  default     = null
+  default = {
+    name       = null
+    bucket     = null
+    kms_key_id = null
+    event_selector = {
+      data_resource = {
+        type   = null
+        values = []
+      }
+      exclude_management_event_sources = null
+      include_management_events        = true
+      read_write_type                  = null
+    }
+  }
   description = "CloudTrail configuration for additional auditing trail"
 }