Supports configuring recording_mode for continuous vs periodic recording

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 4.1.0
+current_version = 4.2.0
 commit = True
 message = Bumps version to {new_version}
 tag = False

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/).
 
+### [4.2.0](https://github.com/plus3it/terraform-aws-tardigrade-config/releases/tag/4.2.0)
+
+**Released**: 2024.11.07
+
+**Summary**:
+
+*   Supports configuring recording_mode for continuous vs periodic recording
+
 ### [4.1.0](https://github.com/plus3it/terraform-aws-tardigrade-config/releases/tag/4.1.0)
 
 **Released**: 2024.09.04

README.md

@@ -26,13 +26,13 @@ make mockstack/clean
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.5.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.38.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.5.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.38.0 |
 
 ## Resources
 
@@ -43,7 +43,7 @@ make mockstack/clean
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_config"></a> [config](#input\_config) | Object of inputs for AWS Config service | <pre>object({<br>    configuration_recorder = object({<br>      name       = string<br>      is_enabled = optional(bool, true)<br><br>      role = optional(object({<br>        arn = string<br>      }))<br><br>      recording_group = optional(object({<br>        all_supported                 = optional(bool, true)<br>        include_global_resource_types = optional(bool)<br>        resource_types                = optional(list(string))<br><br>        exclusion_by_resource_types = optional(object({<br>          resource_types = list(string)<br>        }))<br><br>        recording_strategy = optional(object({<br>          use_only = string<br>        }))<br>      }))<br>    })<br><br>    delivery_channel = object({<br>      s3_bucket_name = string<br>      s3_key_prefix  = optional(string)<br>      s3_kms_key_arn = optional(string)<br>      sns_topic_arn  = optional(string)<br><br>      snapshot_delivery_properties = optional(object({<br>        delivery_frequency = string<br>      }))<br>    })<br>  })</pre> | n/a | yes |
+| <a name="input_config"></a> [config](#input\_config) | Object of inputs for AWS Config service | <pre>object({<br>    configuration_recorder = object({<br>      name       = string<br>      is_enabled = optional(bool, true)<br><br>      role = optional(object({<br>        arn = string<br>      }))<br><br>      recording_group = optional(object({<br>        all_supported                 = optional(bool, true)<br>        include_global_resource_types = optional(bool)<br>        resource_types                = optional(list(string))<br><br>        exclusion_by_resource_types = optional(object({<br>          resource_types = list(string)<br>        }))<br><br>        recording_strategy = optional(object({<br>          use_only = string<br>        }))<br>      }))<br><br>      recording_mode = optional(object({<br>        recording_frequency = string<br><br>        recording_mode_override = optional(object({<br>          description         = optional(string)<br>          resource_types      = list(string)<br>          recording_frequency = string<br>        }))<br>      }))<br>    })<br><br>    delivery_channel = object({<br>      s3_bucket_name = string<br>      s3_key_prefix  = optional(string)<br>      s3_kms_key_arn = optional(string)<br>      sns_topic_arn  = optional(string)<br><br>      snapshot_delivery_properties = optional(object({<br>        delivery_frequency = string<br>      }))<br>    })<br>  })</pre> | n/a | yes |
 
 ## Outputs
 

main.tf

@@ -24,6 +24,22 @@ resource "aws_config_configuration_recorder" "this" {
       }
     }
   }
+
+  dynamic "recording_mode" {
+    for_each = var.config.configuration_recorder.recording_mode != null ? [var.config.configuration_recorder.recording_mode] : []
+    content {
+      recording_frequency = recording_mode.value.recording_frequency
+
+      dynamic "recording_mode_override" {
+        for_each = recording_mode.value.recording_mode_override != null ? [recording_mode.value.recording_mode_override] : []
+        content {
+          description         = recording_mode_override.value.description
+          resource_types      = recording_mode_override.value.resource_types
+          recording_frequency = recording_mode_override.value.recording_frequency
+        }
+      }
+    }
+  }
 }
 
 resource "aws_config_delivery_channel" "this" {

tests/recording_mode_override/main.tf

@@ -0,0 +1,93 @@
+module "config" {
+  source = "../../"
+
+  config = {
+    configuration_recorder = {
+      name = "tardigrade-config-${random_string.this.result}"
+
+      recording_mode = {
+        recording_frequency = "CONTINUOUS"
+
+        recording_mode_override = {
+          description = "Only record EC2 network interfaces and internet gateways daily"
+          resource_types = [
+            "AWS::EC2::NetworkInterface",
+            "AWS::EC2::InternetGateway"
+          ]
+          recording_frequency = "DAILY"
+        }
+      }
+    }
+
+    delivery_channel = {
+      s3_bucket_name = aws_s3_bucket_policy.this.id
+    }
+  }
+}
+
+resource "aws_s3_bucket" "this" {
+  bucket        = "tardigrade-config-${random_string.this.result}"
+  force_destroy = true
+}
+
+resource "aws_s3_bucket_policy" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Sid" : "AWSConfigBucketPermissionsCheck",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "config.amazonaws.com"
+        },
+        "Action" : "s3:GetBucketAcl",
+        "Resource" : aws_s3_bucket.this.arn,
+        "Condition" : {
+          "StringEquals" : {
+            "AWS:SourceAccount" : data.aws_caller_identity.current.account_id
+          }
+        }
+      },
+      {
+        "Sid" : "AWSConfigBucketExistenceCheck",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "config.amazonaws.com"
+        },
+        "Action" : "s3:ListBucket",
+        "Resource" : aws_s3_bucket.this.arn,
+        "Condition" : {
+          "StringEquals" : {
+            "AWS:SourceAccount" : data.aws_caller_identity.current.account_id
+          }
+        }
+      },
+      {
+        "Sid" : "AWSConfigBucketDelivery",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "config.amazonaws.com"
+        },
+        "Action" : "s3:PutObject",
+        "Resource" : "${aws_s3_bucket.this.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/Config/*",
+        "Condition" : {
+          "StringEquals" : {
+            "s3:x-amz-acl" : "bucket-owner-full-control",
+            "AWS:SourceAccount" : data.aws_caller_identity.current.account_id
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "random_string" "this" {
+  length  = 6
+  numeric = false
+  upper   = false
+  special = false
+}
+
+data "aws_caller_identity" "current" {}

tests/recording_mode_periodic/main.tf

@@ -0,0 +1,84 @@
+module "config" {
+  source = "../../"
+
+  config = {
+    configuration_recorder = {
+      name = "tardigrade-config-${random_string.this.result}"
+
+      recording_mode = {
+        recording_frequency = "DAILY"
+      }
+    }
+
+    delivery_channel = {
+      s3_bucket_name = aws_s3_bucket_policy.this.id
+    }
+  }
+}
+
+resource "aws_s3_bucket" "this" {
+  bucket        = "tardigrade-config-${random_string.this.result}"
+  force_destroy = true
+}
+
+resource "aws_s3_bucket_policy" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Sid" : "AWSConfigBucketPermissionsCheck",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "config.amazonaws.com"
+        },
+        "Action" : "s3:GetBucketAcl",
+        "Resource" : aws_s3_bucket.this.arn,
+        "Condition" : {
+          "StringEquals" : {
+            "AWS:SourceAccount" : data.aws_caller_identity.current.account_id
+          }
+        }
+      },
+      {
+        "Sid" : "AWSConfigBucketExistenceCheck",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "config.amazonaws.com"
+        },
+        "Action" : "s3:ListBucket",
+        "Resource" : aws_s3_bucket.this.arn,
+        "Condition" : {
+          "StringEquals" : {
+            "AWS:SourceAccount" : data.aws_caller_identity.current.account_id
+          }
+        }
+      },
+      {
+        "Sid" : "AWSConfigBucketDelivery",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "config.amazonaws.com"
+        },
+        "Action" : "s3:PutObject",
+        "Resource" : "${aws_s3_bucket.this.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/Config/*",
+        "Condition" : {
+          "StringEquals" : {
+            "s3:x-amz-acl" : "bucket-owner-full-control",
+            "AWS:SourceAccount" : data.aws_caller_identity.current.account_id
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "random_string" "this" {
+  length  = 6
+  numeric = false
+  upper   = false
+  special = false
+}
+
+data "aws_caller_identity" "current" {}

variables.tf

@@ -22,6 +22,16 @@ variable "config" {
           use_only = string
         }))
       }))
+
+      recording_mode = optional(object({
+        recording_frequency = string
+
+        recording_mode_override = optional(object({
+          description         = optional(string)
+          resource_types      = list(string)
+          recording_frequency = string
+        }))
+      }))
     })
 
     delivery_channel = object({

versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.5.0"
+      version = ">= 5.38.0"
     }
   }
 }