AWS CSPM Terraform Configuration

Configure AWS cloud monitoring with Terraform Direct link to this section

You can configure scanning for your AWS cloud environment configurations using Terraform. Cloud scans are part of your Cloud Security Posture Management (CSPM) service.

Requirements Direct link to this section

• A valid Arctic Wolf® Managed Risk license
• The following tools, which are automatically configured during installation:
  • Terraform binary version 1.3.7 or newer

    Tip: Run terraform version to verify your existing Terraform version.

  • AWS CLI
  • CSPM AWS Terraform script

Before you begin Direct link to this section

• Obtain the Arctic Wolf AWS Account ID. To view this value, go to the Arctic Wolf Portal, and then click My Account > Arctic Wolf IP Addresses. The AWS account ID is listed under CSPM AWS Account ID.

Steps Direct link to this section

1. Configure IAM user permissions
   1. Create an IAM policy
   2. Create a new IAM user
   3. Create an access key
   4. Configure the AWS CLI
2. Configure the CSPM Terraform script
3. Provide credentials to Arctic Wolf

Step 1a: Create an IAM policy Direct link to this section

Terraform needs permissions to create, update, and delete various AWS resources.

1. In the AWS IAM console, click Policies.
2. Click Create policy.
3. Select JSON and add the following values to the Statement array:

       "Statement": [
         {
           "Sid": "CustomPolicyForACGAWSTFCourse",
           "Action": [
           "iam:GetPolicy",
           "iam:GetPolicyVersion",
           "iam:CreatePolicy",
           "iam:CreateRole",
           "iam:TagRole",
           "iam:GetRole",
           "iam:ListRolePolicies",
           "iam:ListAttachedRolePolicies",
           "iam:ListInstanceProfilesForRole",
           "iam:DeleteRole",
           "iam:DeletePolicy",
           "iam:AttachRolePolicy"
           ],
           "Effect": "Allow",
           "Resource": "*"
         }
       ]

4. Click Next: Tags.
5. (Optional) Add any tags you want associated with the policy.
6. Click Next: Review.
7. Click Create Policy.

Step 1b: Create a new IAM user Direct link to this section

1. In the AWS IAM console, click Add users to create a new IAM user.
2. Enter a name for the IAM user.
3. Click Next.
4. Select Attach policies directly and choose the policy that you created in Create an IAM policy.
5. Click Next.
6. Click Create user.

Step 1c: Create an access key Direct link to this section

1. In the AWS IAM console, click Users.
2. Click the gear icon.
3. Ensure that Access ID is toggled on.
4. Navigate back to the Users page and click the user you just created.
5. Select Security credentials.
6. In the Access keys section, click Create access key.
7. Select Command Line Interface (CLI).
8. Select I understand the above recommendation and want to proceed to create an access key.
9. Click Next.
10. Enter a description for the access key.
11. Click Create access key.
12. Copy the access key and the secret access key for later use in Configure the CSPM Terraform script.

Step 1d: Configure the AWS CLI Direct link to this section

1. In your terminal, run:

   aws configure

2. In the AWS Access Key ID field, enter your access key ID.
3. In the AWS Secret Access Key field, enter your secret access key.

   Note: You do not need to fill in the Default region name or Default output format fields.

Step 2: Configure the CSPM Terraform script Direct link to this section

1. Navigate to the folder where you extracted the Arctic Wolf Terraform script.
2. In a text editor, open the file terraform.tfvars.
3. In the following line, replace the value with the AWS account ID that will be scanned:

aws-account-id = "123456789012"

4. In the following line, replace the value with the Arctic Wolf account ID:

   Tip: To determine the correct Arctic Wolf AWS account ID needed to create a new Identity and Access Management (IAM) role, go to the Arctic Wolf Portal, and then click MyAccount > Arctic Wolf IP Addresses. The AWS account ID is listed under CSPM AWS Account ID.

awn-account = "123456789012"

5. Open a terminal and navigate to the Terraform directory.
6. Initialize Terraform:

   terraform init

7. Run the following commands to confirm that the module has been properly implemented:

terraform validate
terraform plan
terraform apply

Step 3: Provide credentials to Arctic Wolf Direct link to this section

1. Sign in to the Arctic Wolf Portal.

2. In the navigation menu, click Connected Accounts to open the Connected Accounts page.

3. Click +Add Account to open the Add Account form.

4. Select Cloud Security Posture Management as the Account Type.

5. Click AWS, and then fill in the form:

   • Account Name — Enter a unique name for this cloud account.
   • Account ID — Enter your AWS account ID.
   • Role ARN — Enter the following, where <aws_account> is your AWS account ID:

     arn:aws:iam::<aws_account>:role/AWNCSPMTrustRole

6. Click Submit to CST.

7. When prompted with the confirmation message, review your submission, and then click Done.

   You are returned to the Connected Accounts page.

8. Verify that the newly-submitted credential entry appears in the cloud services list with the status Connection Pending.

After your Concierge Security® Team adds this account to your scan configuration, the status of your credentials changes to Connected.

Manage your Terraform CSPM configuration Direct link to this section

These are different tasks you can perform to manage and alter your Terraform CSPM configuration after it has been set up:

• Enable Terraform debugging
• Remove your Terraform configuration

Enable Terraform debugging Direct link to this section

To troubleshoot potential issues with the Terraform configuration, debug logging must be configured and enabled.

1. If you don’t suspect an existing configuration to be present, set up the log level:

   export TF_LOG="DEBUG"

2. Verify the log level:

   echo $TF_LOG

3. Set up the log path:

   export TF__LOG_PATH="./example/"

4. Verify the logs generated by Terraform:

   terraform apply

5. Verify that the debug logs are available at the path that you set earlier.

Remove your Terraform configuration Direct link to this section

• If you need to remove your Terraform configuration, run terraform destroy in the CLI.

See also Direct link to this section

• Terraform documentation
• Terraform Azure documentation
• Microsoft Terraform documentation