arun9theja / terraform-aws-root-login-notifications Goto Github PK

Enables notifications to an SNS topic when someone successfully logs in using the root account via the AWS Console in commercial AWS or using the Administrator user in AWS GovCloud.

Creates the following resources:

• CloudWatch event rule to filter for console logins with the root account or Administrator user.
• CloudWatch metric to trigger CW event when console rule is triggered
• CloudWatch event target to send notifications to an SNS topic (optional)

Usage

module "root-login-notifications" {
  source  = "trussworks/root-login-notifications/aws"
  version = "2.2.0"

  sns_topic_name = "slack-events"
}

Requirements

Providers

Inputs

Outputs

No output.

PagerDuty Setup

There are two methods to generate root logins alerts in PagerDuty.

Method 1: CloudWatch Rule

Use this method if already have a SNS topic handling existing CW Events.

1. In TF or manually create a PagerDuty CloudWatch integration
2. In TF ensure that the PagerDuty endpoint provided is assigned/subscribed to the SNS topic. For more info see the AWS topic about the proper policy.
3. Apply this module to the SNS topic.
4. Test by logging in as root

Method 2: Custom PagerDuty Event

Use this method if wishing to have a dedicated SNS topic for PagerDuty alerts or custom message parsing for advanced PagerDuty features.

1. In TF or manually create a PagerDuty Custom Event Transformer CloudWatch
2. In TF ensure that the PagerDuty endpoint provided is assigned/subscribed to the SNS topic. For more info see the AWS topic about the proper policy.
3. Apply this module to the SNS topic with the send_sns = true and customizing the input_template as needed.
4. Test by logging in as root