Skip to main content
Type: rvn-aws-compliance · Latest version: 0.1.0

​
Readme

Manages an AWS compliance baseline with GuardDuty threat detection and Basic ECR image scanning on push across selected Regions.

​
Account-level setup

Deploy one module for an AWS account and select every Region you want covered. The runner Region controls where Terraform executes; the Regions list controls where both services are configured. Every selected Region must already be enabled for the account. Each Region receives a GuardDuty detector with explicitly managed protection plans and an ECR registry scanning rule covering all existing and future private repositories. The module supports threat-detection and vulnerability-scanning controls; application alarms, log retention, and other compliance controls remain in their respective modules.

​
GuardDuty

S3, EKS audit logs, EC2 malware, RDS login, and Lambda network protection are enabled by default. Runtime Monitoring is opt-in because it adds security-agent costs. Each protection plan is explicitly enabled or disabled in every selected Region. GuardDuty sends findings to EventBridge. The finding publishing frequency controls updates to existing findings, defaulting to every 15 minutes. Central aggregation and notification routing are configured separately. GuardDuty protection plans incur AWS charges.

​
ECR image scanning

Basic scan-on-push is always enabled with a registry-level * filter. It covers repositories used by ECS, EKS, EC2, Lambda, and other workloads, including repositories created later. This declares the registry settings checked by OneLeet’s image-scanning monitor. Basic scans check operating-system vulnerabilities on new image pushes. They do not provide continuous scanning or automatically scan all images pushed before this configuration was enabled.

​
Existing resources and ownership

GuardDuty detectors and ECR scanning configurations are shared by the whole account in each Region. Keep exactly one Terraform owner per account and Region; do not deploy overlapping instances or also manage them from a VPC or service module. If GuardDuty is already enabled, import the existing detectors into this module’s Terraform state before applying. Do not disable GuardDuty just to adopt this module. Existing protection-plan settings are reconciled to the selected inputs. Applying replaces any existing ECR Enhanced scanning or custom filters with Basic scan-on-push for all repositories. Review the current configuration before adoption. Manually configured ECR registries can be managed by applying this module. Removing a Region or destroying the module deletes its GuardDuty detector and findings and resets ECR scanning to Basic without registry rules. It does not delete ECR repositories or images.

​
Configuration

​
Learn more

​
Inputs reference

All inputs for rvn-aws-compliance version 0.1.0. Use the name shown for each field as the input key in module config.

​
AWS account & region

​
string
required
AWS account.
  • Immutable after creation
​
string
required
Region. Region where the Terraform runner executes. GuardDuty and ECR scanning are enabled in the Regions selected below.
  • Immutable after creation

​
Compliance regions

​
string_array
required
Regions. AWS Regions where GuardDuty and Basic ECR scan-on-push are enabled. ECR scanning covers every repository and replaces existing Enhanced scanning or custom filters. Use one module per account with all required Regions; each Region must already be enabled.

​
GuardDuty protection plans

​
boolean
S3 protection. Monitor S3 data events for suspicious access to buckets and objects.
  • Default: true
​
boolean
EKS protection. Monitor Kubernetes audit logs from EKS clusters.
  • Default: true
​
boolean
Malware protection for EC2. Scan EBS volumes attached to EC2 instances and container workloads when GuardDuty detects malicious behaviour.
  • Default: true
​
boolean
RDS protection. Monitor login activity to Aurora and supported RDS databases.
  • Default: true
​
boolean
Lambda protection. Monitor Lambda network activity logs.
  • Default: true
​
boolean
Runtime monitoring. OS-level threat detection for EKS, ECS Fargate, and EC2 workloads using the GuardDuty security agent. Adds agent cost per workload.
  • Default: false
​
string_array
Automated agent management. Workload types where GuardDuty installs and manages the Runtime Monitoring security agent automatically.
  • Default: ["EKS_ADDON_MANAGEMENT","ECS_FARGATE_AGENT_MANAGEMENT","EC2_AGENT_MANAGEMENT"]
  • Pattern: ^(EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT)$ — Must be EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT, or EC2_AGENT_MANAGEMENT.
  • Shown when: {"runtime_monitoring_enabled":true}

​
Findings

​
string
Finding publishing frequency. How often GuardDuty exports updated findings to EventBridge. New findings are always exported within five minutes.
  • Default: FIFTEEN_MINUTES
  • Allowed values: FIFTEEN_MINUTES (Every 15 minutes), ONE_HOUR (Every hour), SIX_HOURS (Every 6 hours)

​
Misc

​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}
​
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.