Adds IL and ME regions

analyzer_baselines.tf

@@ -243,3 +243,31 @@ module "analyzer_baseline_us-west-2" {
 
   tags = var.tags
 }
+
+module "analyzer_baseline_il-central-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "il-central-1") ? 1 : 0
+  source = "./modules/analyzer-baseline"
+
+  providers = {
+    aws = aws.il-central-1
+  }
+
+  analyzer_name   = var.analyzer_name
+  is_organization = local.is_master_account
+
+  tags = var.tags
+}
+
+module "analyzer_baseline_me-central-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "me-central-1") ? 1 : 0
+  source = "./modules/analyzer-baseline"
+
+  providers = {
+    aws = aws.me-central-1
+  }
+
+  analyzer_name   = var.analyzer_name
+  is_organization = local.is_master_account
+
+  tags = var.tags
+}

ebs_baselines.tf

@@ -154,3 +154,21 @@ module "ebs_baseline_us-west-2" {
     aws = aws.us-west-2
   }
 }
+
+module "ebs_baseline_il-central-1" {
+  count  = contains(var.target_regions, "il-central-1") ? 1 : 0
+  source = "./modules/ebs-baseline"
+
+  providers = {
+    aws = aws.il-central-1
+  }
+}
+
+module "ebs_baseline_me-central-1" {
+  count  = contains(var.target_regions, "me-central-1") ? 1 : 0
+  source = "./modules/ebs-baseline"
+
+  providers = {
+    aws = aws.me-central-1
+  }
+}

examples/organization/master/main.tf

@@ -25,6 +25,7 @@ resource "aws_organizations_organization" "org" {
     "access-analyzer.amazonaws.com",
     "cloudtrail.amazonaws.com",
     "config.amazonaws.com",
+    "securityhub.amazonaws.com"
   ]
   feature_set = "ALL"
 }
@@ -59,6 +60,8 @@ module "secure_baseline" {
     aws.eu-west-1      = aws.eu-west-1
     aws.eu-west-2      = aws.eu-west-2
     aws.eu-west-3      = aws.eu-west-3
+    aws.il-central-1   = aws.il-central-1
+    aws.me-central-1   = aws.me-central-1
     aws.sa-east-1      = aws.sa-east-1
     aws.us-east-1      = aws.us-east-1
     aws.us-east-2      = aws.us-east-2

examples/organization/master/variables.tf

@@ -17,3 +17,4 @@ variable "region" {
   default     = "us-east-1"
 }
 
+

examples/organization/member/main.tf

@@ -52,6 +52,8 @@ module "secure_baseline" {
     aws.eu-west-1      = aws.eu-west-1
     aws.eu-west-2      = aws.eu-west-2
     aws.eu-west-3      = aws.eu-west-3
+    aws.il-central-1   = aws.il-central-1
+    aws.me-central-1   = aws.me-central-1
     aws.sa-east-1      = aws.sa-east-1
     aws.us-east-1      = aws.us-east-1
     aws.us-east-2      = aws.us-east-2

examples/select-region/main.tf

@@ -50,6 +50,8 @@ module "secure_baseline" {
     aws.eu-west-1      = aws.eu-west-1
     aws.eu-west-2      = aws.eu-west-2
     aws.eu-west-3      = aws.eu-west-3
+    aws.il-central-1   = aws.il-central-1
+    aws.me-central-1   = aws.me-central-1
     aws.sa-east-1      = aws.sa-east-1
     aws.us-east-1      = aws.us-east-1
     aws.us-east-2      = aws.us-east-2

examples/simple/main.tf

@@ -21,7 +21,20 @@ resource "aws_iam_user" "admin" {
 }
 
 module "secure_baseline" {
-  source = "../../"
+  # Option 1: Using HTTPS
+  source = "git::https://github.com/YOUR_USERNAME/terraform-aws-secure-baseline.git"
+
+  # Option 2: Using SSH
+  # source = "git::ssh://[email protected]/YOUR_USERNAME/terraform-aws-secure-baseline.git"
+
+  # Option 3: Using a specific branch
+  # source = "git::https://github.com/YOUR_USERNAME/terraform-aws-secure-baseline.git?ref=feature-branch"
+
+  # Option 4: Using a specific tag
+  # source = "git::https://github.com/YOUR_USERNAME/terraform-aws-secure-baseline.git?ref=v1.0.0"
+
+  # Option 5: Using a specific commit
+  # source = "git::https://github.com/YOUR_USERNAME/terraform-aws-secure-baseline.git?ref=abcd1234"
 
   audit_log_bucket_name           = var.audit_s3_bucket_name
   aws_account_id                  = data.aws_caller_identity.current.account_id
@@ -47,6 +60,8 @@ module "secure_baseline" {
     aws.eu-west-1      = aws.eu-west-1
     aws.eu-west-2      = aws.eu-west-2
     aws.eu-west-3      = aws.eu-west-3
+    aws.il-central-1   = aws.il-central-1
+    aws.me-central-1   = aws.me-central-1
     aws.sa-east-1      = aws.sa-east-1
     aws.us-east-1      = aws.us-east-1
     aws.us-east-2      = aws.us-east-2

examples/simple/regions.tf

@@ -88,3 +88,13 @@ provider "aws" {
   alias  = "us-west-2"
 }
 
+provider "aws" {
+  region = "il-central-1"
+  alias  = "il-central-1"
+}
+
+provider "aws" {
+  region = "me-central-1"
+  alias  = "me-central-1"
+}
+

main.tf

@@ -16,6 +16,8 @@ terraform {
         aws.eu-central-1,
         aws.eu-north-1,
         aws.eu-west-1, aws.eu-west-2, aws.eu-west-3,
+        aws.il-central-1,
+        aws.me-central-1,
         aws.sa-east-1,
         aws.us-east-1, aws.us-east-2,
         aws.us-west-1, aws.us-west-2,

modules/secure-bucket/main.tf

@@ -18,6 +18,14 @@ data "aws_iam_policy_document" "access_log_policy" {
   }
 }
 
+resource "aws_s3_bucket_ownership_controls" "access_log" {
+  bucket = aws_s3_bucket.access_log.id
+
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
 resource "aws_s3_bucket" "access_log" {
   bucket        = var.log_bucket_name
   force_destroy = var.force_destroy
@@ -28,6 +36,9 @@ resource "aws_s3_bucket" "access_log" {
 resource "aws_s3_bucket_acl" "access_log" {
   bucket = aws_s3_bucket.access_log.id
   acl    = "log-delivery-write"
+  depends_on = [
+    aws_s3_bucket_ownership_controls.access_log,
+  ]
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "access_log" {
@@ -75,6 +86,14 @@ resource "aws_s3_bucket_public_access_block" "access_log" {
   restrict_public_buckets = true
 }
 
+resource "aws_s3_bucket_ownership_controls" "content" {
+  bucket = aws_s3_bucket.content.id
+
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
 resource "aws_s3_bucket" "content" {
   bucket        = var.bucket_name
   force_destroy = var.force_destroy
@@ -89,6 +108,10 @@ resource "aws_s3_bucket" "content" {
 resource "aws_s3_bucket_acl" "content" {
   bucket = aws_s3_bucket.content.id
   acl    = "private"
+
+  depends_on = [
+    aws_s3_bucket_ownership_controls.content,
+  ]
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "content" {

securityhub_baselines.tf

@@ -294,3 +294,37 @@ module "securityhub_baseline_us-west-2" {
   master_account_id                = local.securityhub_master_account_id
   member_accounts                  = local.securityhub_member_accounts
 }
+
+module "securityhub_baseline_il-central-1" {
+  count  = contains(var.target_regions, "il-central-1") && var.securityhub_enabled ? 1 : 0
+  source = "./modules/securityhub-baseline"
+
+  providers = {
+    aws = aws.il-central-1
+  }
+
+  aggregate_findings               = var.region == "il-central-1"
+  enable_cis_standard              = var.securityhub_enable_cis_standard
+  enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
+  enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
+  enable_product_arns              = var.securityhub_enable_product_arns
+  master_account_id                = local.securityhub_master_account_id
+  member_accounts                  = local.securityhub_member_accounts
+}
+
+module "securityhub_baseline_me-central-1" {
+  count  = contains(var.target_regions, "me-central-1") && var.securityhub_enabled ? 1 : 0
+  source = "./modules/securityhub-baseline"
+
+  providers = {
+    aws = aws.me-central-1
+  }
+
+  aggregate_findings               = var.region == "me-central-1"
+  enable_cis_standard              = var.securityhub_enable_cis_standard
+  enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
+  enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
+  enable_product_arns              = var.securityhub_enable_product_arns
+  master_account_id                = local.securityhub_master_account_id
+  member_accounts                  = local.securityhub_member_accounts
+}

variables.tf

@@ -55,6 +55,8 @@ variable "target_regions" {
     "eu-west-1",
     "eu-west-2",
     "eu-west-3",
+    "il-central-1",
+    "me-central-1",
     "sa-east-1",
     "us-east-1",
     "us-east-2",

vpc_baselines.tf

@@ -385,3 +385,41 @@ module "vpc_baseline_us-west-2" {
 
   tags = var.tags
 }
+
+module "vpc_baseline_il-central-1" {
+  count  = var.vpc_enable && contains(var.target_regions, "il-central-1") ? 1 : 0
+  source = "./modules/vpc-baseline"
+
+  providers = {
+    aws = aws.il-central-1
+  }
+
+  enable_flow_logs            = var.vpc_enable_flow_logs
+  flow_logs_destination_type  = var.vpc_flow_logs_destination_type
+  flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
+  flow_logs_iam_role_arn      = local.flow_logs_to_cw_logs ? aws_iam_role.flow_logs_publisher[0].arn : null
+  flow_logs_retention_in_days = var.vpc_flow_logs_retention_in_days
+  flow_logs_s3_arn            = local.flow_logs_s3_arn
+  flow_logs_s3_key_prefix     = var.vpc_flow_logs_s3_key_prefix
+
+  tags = var.tags
+}
+
+module "vpc_baseline_me-central-1" {
+  count  = var.vpc_enable && contains(var.target_regions, "me-central-1") ? 1 : 0
+  source = "./modules/vpc-baseline"
+
+  providers = {
+    aws = aws.me-central-1
+  }
+
+  enable_flow_logs            = var.vpc_enable_flow_logs
+  flow_logs_destination_type  = var.vpc_flow_logs_destination_type
+  flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
+  flow_logs_iam_role_arn      = local.flow_logs_to_cw_logs ? aws_iam_role.flow_logs_publisher[0].arn : null
+  flow_logs_retention_in_days = var.vpc_flow_logs_retention_in_days
+  flow_logs_s3_arn            = local.flow_logs_s3_arn
+  flow_logs_s3_key_prefix     = var.vpc_flow_logs_s3_key_prefix
+
+  tags = var.tags
+}