Terraform module for configuring AWS to integrate with Expel Workbench.

Configures a CloudTrail stack (CloudTrail & S3 bucket) with a notification queue that Expel Workbench consumes. Cloudtrail, S3 bucket, SQS and SNS (optionally for existing Cloudtrail) queue are encrypted by default using a custom managed KMS key.

module "expel_aws_cloudtrail" {
  source  = "expel-io/cloudtrail/aws"
  version = "1.3.0"

  expel_customer_organization_guid = "Replace with your organization GUID from Expel Workbench"
  region = "AWS region in which notification queue for CloudTrail will be created"
}

Once you have configured your AWS environment, go to https://workbench.expel.io/settings/security-devices?setupIntegration=aws and create an AWS CloudTrail security device to enable Expel to begin monitoring your AWS environment.

The permissions allocated by this module allow Expel Workbench to perform investigations and get a broad understanding of your AWS footprint.

1. Creating a new AWS CloudTrail for an AWS organization (default)
2. Creating a new AWS CloudTrail for a single AWS account (Set enable_organization_trail input to false)
3. Reusing an existing AWS Cloudtrail for a single AWS account or an AWS organization with all the existing resources deployed in the same account (Set existing_cloudtrail_bucket_name input to the name of the existing log bucket)

• This module only supports integrating with Expel when all the necessary resources are deployed in the same account.
• This module does not support integrating with Expel when all the necessary resources are deployed across multiple aws accounts.

  Ex. ControlTower Environments are not supported via this module. To integrate an AWS ControlTower environment with Expel refer to this guide in order to do so.

Please contact your Engagement Manager if you have an existing CloudTrail with a different configuration.