terraform-aws-tardigrade-config

Manage AWS Config

Testing

Manual testing:

# Replace "xxx" with an actual AWS profile, then execute the integration tests.
export AWS_PROFILE=xxx 
make terraform/pytest PYTEST_ARGS="-v --nomock"

For automated testing, PYTEST_ARGS is optional and no profile is needed:

make mockstack/up
make terraform/pytest PYTEST_ARGS="-v"
make mockstack/clean

Requirements

Name	Version
terraform	>= 0.12

Providers

Name	Version
aws	n/a

Resources

Name	Type
aws_caller_identity.current	data source
aws_iam_policy_document.config	data source
aws_iam_policy_document.config_assume_role	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
config_bucket	Name of S3 bucket for AWS Config inventory; bucket must already exist	string	n/a	yes
exclude_resource_types	A list of specific resource types for AWS Config to not records changes to. This variable is mutually exclusive from include_resource_types and if both are set, include_resource_types will take priority. See AWS documenation for types https://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType	list(string)	[]	no
iam_role_arn	ARN for the IAM role to attach to the config recorder. If blank, a minimal role will be created	string	null	no
include_resource_types	A list of specific resource types for AWS Config to records changes to. See AWS documenation for types https://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType	list(string)	[]	no
name	Name of the AWS Config recorder	string	"default"	no
snapshot_delivery_frequency	Frequency with which AWS Config recurringly delivers configuration snapshots, see https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigSnapshotDeliveryProperties.html#API_ConfigSnapshotDeliveryProperties_Contents	string	"TwentyFour_Hours"	no
tags	Map of tags to apply to the resources	map(string)	{}	no

Outputs

Name	Description
config_delivery_channel_id	The name of the AWS Config delivery channel
config_iam_role_arn	The Amazon Resource Name (ARN) of the config service role
config_iam_role_name	The name of the config service role
config_recorder_id	The name of the AWS Config recorder
config_sns_topic_arn	The Amazon Resource Name (ARN) of the config SNS topic