feat: advanced event selectors (#251)

* Support Advanced Field Selectors Allow the caller to provide [advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) to e.g. log S3 data plane events (GetObject, etc). * style: tfsort --------- Co-authored-by: Dan Russell <[email protected]>
trussworks · Jan 13, 2025 · 5962305 · 5962305
1 parent ee14ba9
commit 5962305
Show file tree

Hide file tree

Showing 3 changed files with 74 additions and 36 deletions.
diff --git a/README.md b/README.md
@@ -58,6 +58,7 @@ previous invocations of the module prior to upgrading the version.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | s3_bucket_name | The name of the AWS S3 bucket. | `string` | n/a | yes |
+| advanced_event_selectors | A list of advanced event selectors for the trail. | ```list(object({ name = string field_selectors = list(object({ field = string equals = optional(list(string)) starts_with = optional(list(string)) ends_with = optional(list(string)) not_equals = optional(list(string)) not_starts_with = optional(list(string)) not_ends_with = optional(list(string)) })) }))``` | `[]` | no |
 | api_call_rate_insight | A measurement of write-only management API calls that occur per minute against a baseline API call volume. | `bool` | `false` | no |
 | api_error_rate_insight | A measurement of management API calls that result in error codes. The error is shown if the API call is unsuccessful. | `bool` | `false` | no |
 | cloudwatch_log_group_name | The name of the CloudWatch Log Group that receives CloudTrail events. | `string` | `"cloudtrail-events"` | no |

diff --git a/main.tf b/main.tf
@@ -300,6 +300,26 @@ resource "aws_cloudtrail" "main" {
     }
   }
 
+  dynamic "advanced_event_selector" {
+    for_each = var.advanced_event_selectors
+    content {
+      name = advanced_event_selector.value.name
+
+      dynamic "field_selector" {
+        for_each = advanced_event_selector.value.field_selectors
+        content {
+          field           = field_selector.value.field
+          equals          = field_selector.value.equals
+          starts_with     = field_selector.value.starts_with
+          ends_with       = field_selector.value.ends_with
+          not_equals      = field_selector.value.not_equals
+          not_starts_with = field_selector.value.not_starts_with
+          not_ends_with   = field_selector.value.not_ends_with
+        }
+      }
+    }
+  }
+
   tags = var.tags
 
   depends_on = [

diff --git a/variables.tf b/variables.tf
@@ -1,3 +1,32 @@
+variable "advanced_event_selectors" {
+  description = "A list of advanced event selectors for the trail."
+  default     = []
+  type = list(object({
+    name = string
+    field_selectors = list(object({
+      field           = string
+      equals          = optional(list(string))
+      starts_with     = optional(list(string))
+      ends_with       = optional(list(string))
+      not_equals      = optional(list(string))
+      not_starts_with = optional(list(string))
+      not_ends_with   = optional(list(string))
+    }))
+  }))
+}
+
+variable "api_call_rate_insight" {
+  description = "A measurement of write-only management API calls that occur per minute against a baseline API call volume."
+  default     = false
+  type        = bool
+}
+
+variable "api_error_rate_insight" {
+  description = "A measurement of management API calls that result in error codes. The error is shown if the API call is unsuccessful."
+  default     = false
+  type        = bool
+}
+
 variable "cloudwatch_log_group_name" {
   description = "The name of the CloudWatch Log Group that receives CloudTrail events."
   default     = "cloudtrail-events"
@@ -10,26 +39,15 @@ variable "enabled" {
   type        = bool
 }
 
-variable "log_retention_days" {
-  description = "Number of days to keep AWS logs around in specific log group."
-  default     = 90
-  type        = string
-}
-
-variable "s3_bucket_name" {
-  description = "The name of the AWS S3 bucket."
-  type        = string
-}
-
-variable "s3_bucket_account_id" {
-  description = "(optional) The AWS account ID which owns the S3 bucket. Only include if the S3 bucket is in a different account than the CloudTrail."
-  default     = null
+variable "iam_policy_name" {
+  description = "Name for the CloudTrail IAM policy"
+  default     = "cloudtrail-cloudwatch-logs-policy"
   type        = string
 }
 
-variable "org_trail" {
-  description = "Whether or not this is an organization trail. Only valid in master account."
-  default     = "false"
+variable "iam_role_name" {
+  description = "Name for the CloudTrail IAM role"
+  default     = "cloudtrail-cloudwatch-logs-role"
   type        = string
 }
 
@@ -39,21 +57,26 @@ variable "key_deletion_window_in_days" {
   type        = string
 }
 
-variable "trail_name" {
-  description = "Name for the Cloudtrail"
-  default     = "cloudtrail"
+variable "log_retention_days" {
+  description = "Number of days to keep AWS logs around in specific log group."
+  default     = 90
   type        = string
 }
 
-variable "iam_role_name" {
-  description = "Name for the CloudTrail IAM role"
-  default     = "cloudtrail-cloudwatch-logs-role"
+variable "org_trail" {
+  description = "Whether or not this is an organization trail. Only valid in master account."
+  default     = "false"
   type        = string
 }
 
-variable "iam_policy_name" {
-  description = "Name for the CloudTrail IAM policy"
-  default     = "cloudtrail-cloudwatch-logs-policy"
+variable "s3_bucket_account_id" {
+  description = "(optional) The AWS account ID which owns the S3 bucket. Only include if the S3 bucket is in a different account than the CloudTrail."
+  default     = null
+  type        = string
+}
+
+variable "s3_bucket_name" {
+  description = "The name of the AWS S3 bucket."
   type        = string
 }
 
@@ -75,14 +98,8 @@ variable "tags" {
   type        = map(string)
 }
 
-variable "api_call_rate_insight" {
-  description = "A measurement of write-only management API calls that occur per minute against a baseline API call volume."
-  default     = false
-  type        = bool
-}
-
-variable "api_error_rate_insight" {
-  description = "A measurement of management API calls that result in error codes. The error is shown if the API call is unsuccessful."
-  default     = false
-  type        = bool
+variable "trail_name" {
+  description = "Name for the Cloudtrail"
+  default     = "cloudtrail"
+  type        = string
 }