terraform-aws-cloudtrail

Terraform module that provisions an AWS CloudTrail trail, its optional S3 destination, and optional CloudWatch Logs delivery.

Compatibility

This module requires Terraform 1.6.0 or later and supports AWS provider versions from 5.40.0 up to, but not including, 7.0.0.

Requirements

Name	Version
terraform	>= 1.6.0
aws	>= 5.40.0, < 7.0.0

Providers

Name	Version
aws	>= 5.40.0, < 7.0.0

Modules

No modules.

Resources

Name	Type
aws_cloudtrail.default	resource
aws_cloudwatch_log_group.cloudtrail	resource
aws_iam_role.cloudwatch_logs	resource
aws_iam_role_policy.cloudwatch_logs	resource
aws_iam_role_policy.cloudwatch_logs_organizations	resource
aws_s3_bucket.default	resource
aws_s3_bucket_acl.default	resource
aws_s3_bucket_lifecycle_configuration.logs	resource
aws_s3_bucket_ownership_controls.default	resource
aws_s3_bucket_policy.default	resource
aws_s3_bucket_public_access_block.default	resource
aws_s3_bucket_server_side_encryption_configuration.default	resource
aws_iam_policy_document.cloudwatch_assume_role	data source
aws_iam_policy_document.cloudwatch_logs_role	data source
aws_iam_policy_document.cloudwatch_logs_role_organizations	data source
aws_iam_policy_document.default	data source

Inputs

Name	Description	Type	Default	Required
create_s3_bucket	(Optional) Automatically creates the S3 bucket for CloudTrail.	bool	true	no
enable_cloudwatchlogs	(Required) Enables log delivery to CloudWatch Logs.	bool	false	no
enable_log_file_validation	(Optional) Specifies whether log file integrity validation is enabled.	bool	true	no
enable_logging	(Optional) Enables logging for the trail.	bool	true	no
event_selector	(Optional) Specifies event selectors for enabling data event logging.	list(object({ include_management_events = bool read_write_type = string data_resource = object({ type = string values = list(string) }) }))	[]	no
force_destroy	A boolean indicating whether all objects can be deleted when destroying the bucket.	string	false	no
include_global_service_events	(Optional) Specifies whether the trail publishes events from global services.	bool	true	no
is_multi_region_trail	(Optional) Specifies whether the trail is created in the current region or in all regions.	bool	true	no
is_organization_trail	(Optional) Specifies whether the trail is an AWS Organizations trail.	bool	false	no
kms_key_id	(Optional) Specifies the KMS key ARN used to encrypt CloudTrail logs.	string	null	no
log_retention_days	Number of days to keep AWS logs in the CloudWatch Logs group.	string	180	no
name	(Required) Specifies the name of the trail.	string	n/a	yes
s3_block_public_acls	Whether Amazon S3 should block public ACLs for this bucket.	bool	true	no
s3_block_public_policy	Whether Amazon S3 should block public bucket policies for this bucket.	bool	true	no
s3_bucket_name	(Optional) Required when create_s3_bucket is false, the existing S3 bucket name.	string	null	no
s3_ignore_public_acls	Whether Amazon S3 should ignore public ACLs for this bucket.	bool	true	no
s3_lifecycle_expiration_days	Days until objects in the bucket expire.	number	1825	no
s3_restrict_public_buckets	Whether Amazon S3 should restrict public bucket policies for this bucket.	bool	true	no
tags	(Optional) A map of tags to assign to the trail.	map(string)	{}	no

Outputs

Name	Description
cloudtrail_arn	The Amazon Resource Name of the trail.
cloudtrail_home_region	The region in which the trail was created.
cloudtrail_id	The name of the trail.
cloudwatch_log_group_name	The CloudWatch Logs group name.

Example

See examples/complete.