expel-io / terraform-aws-cloudtrail Goto Github PK

I see a variable for existing_cloudtrail_kms_key_arn. However, it's not used if a new S3 bucket will be provisioned. Additionally, the permissions for the key are not appropriate.

Please allow a custom Key ARN to take priority over a new key. Adding a variable for a custom key policy could also be helpful.

Hi, due to the way Terragrunt handles maps (converts them to strings under the hood), and the fact that variables.tf does not have a type declaration for var.tags (see here), we are unable to add custom tags to the expel resources created by this module.

The fix seems to be to add a type (in this case likely map(string)) to the variable declaration.

terragrunt.hcl:

terraform { source = "tfr:///expel-io/cloudtrail/aws?version=1.3.3" }

include { path = find_in_parent_folders() }

inputs = {
  expel_customer_organization_guid = "<redacted>"
  existing_cloudtrail_bucket_name  = "<redacted>"
  existing_cloudtrail_kms_key_arn  = "<redacted>"
  existing_sns_topic_arn           = "<redacted>"
  tags = {
    Application : "expel"
    Terraform : "true"
  }
}

│ Error: Error in function call
│
│   on aws.tf line 12, in locals:
│   12:   tags = merge(
│   13:     var.tags,
│   14:     local.default_tags,
│   15:   )
│     ├────────────────
│     │ while calling merge(maps...)
│     │ local.default_tags is object with 1 attribute "vendor"
│     │ var.tags is "{\"Application\":\"expel\",\"Terraform\":\"true\"}"

We have a variety of OUs to help organize our accounts. Some of them have Service Control Policies with explicit Deny All rules. In order to deploy at the Organization level, we need to specify either the OUs to target, or the OUs to exclude.