This repo pairs with my fork of Prowler.

• Terraform >0.12.20
  • I use 0.12.20, but any version after this in the 0.12 minor version should work
  • The reliance on 0.12.20 and new is due to reliance on try

This module relies heavily on setting a series of defaults that are repeated across multiple AWS accounts. If specific variables are needing to be overwritten, this can be done in the module definition. If nothing needs to be overwritten, you can specify the module as such:

module "prowler" {
  source = "git@github.com:mencarellic/terraform-ecs-prowler?ref=v0.1.0"

  #----------------------------------------------#
  # Variables that aren't changing from defaults #
  #----------------------------------------------#

  #   kms_variables = {
  #       staging = { }
  #       production = { }
  #   }

  #   iam_variables = {
  #       staging = { }
  #       production = { }
  #   }

  #   cloudwatch_variables = {
  #       staging = { }
  #       production = { }
  #   }

  #   sg_variables = {
  #       staging = { }
  #       production = { }
  #   }

  #   ecs_variables = {
  #       staging = { }
  #       production = { }
  #   }

  #   ecr_variables = {
  #       staging = { }
  #       production = { }
  #   }

  #   s3_variables = {
  #     staging = { }
  #     production = { }
  #   }
}

The GitHub Action in mencarellic/prowler builds the Docker image and pushes it to ECR. This repo creates a repository that can be used by ECS to pull from.

This module will create two roles. One that executes the task in ECS (ecs_execute) and one that triggers the schedule in Cloudwatch (ecs_events).

A pretty basic cluster is created so the task will have somewhere to live. After that, the task itself is created, mainly specifying a lot of the container configuration options like cpu, memory, etc. This heredoc block is also where the default environment variables are defined.

First a Cloudwatch log group is created for ECS logging. Next an event rule is created for each Prowler group specified in the cloudwatch_defaults.scheduled_tasks variable (specified here) using a for_each loop. An event target for each group is created in a similar way.

The output from Prowler is uploaded to an S3 bucket that's defined at runtime. This S3 bucket is encrypted with a key generated and stored in KMS.

A private bucket in S3 is created for the output to be stored. This is encrypted by the key created in the module and can optionally be configued with lifecycle and versioning rules.

A generic SG is needed for the container, so one is created here with no ingress and open egress.

• Extract the requirement to have a AWS keys 😱
• Provide some additional examples