Terraform module for configuring an integration with Lacework and AWS for cloud resource configuration assessment.
| Name | Version |
|---|---|
| terraform | >= 0.14 |
| aws | >= 3.35.0 |
| lacework | ~> 2.0 |
| random | >= 2.1 |
| time | ~> 0.7 |
| Name | Version |
|---|---|
| aws | >= 3.35.0 |
| lacework | ~> 2.0 |
| random | >= 2.1 |
| time | ~> 0.7 |
| Name | Source | Version |
|---|---|---|
| lacework_cfg_iam_role | lacework/iam-role/aws | ~> 0.4 |
| Name | Type |
|---|---|
| aws_iam_policy.lacework_audit_policy | resource |
| aws_iam_policy.lacework_audit_policy_2025_1 | resource |
| aws_iam_policy.lacework_audit_policy_2025_2 | resource |
| aws_iam_role_policy_attachment.lacework_audit_policy_attachment | resource |
| aws_iam_role_policy_attachment.lacework_audit_policy_attachment_b | resource |
| aws_iam_role_policy_attachment.lacework_audit_policy_attachment_c | resource |
| aws_iam_role_policy_attachment.security_audit_policy_attachment | resource |
| lacework_integration_aws_cfg.default | resource |
| random_id.uniq | resource |
| time_sleep.wait_time | resource |
| aws_iam_policy_document.lacework_audit_policy | data source |
| aws_iam_policy_document.lacework_audit_policy_2025_1 | data source |
| aws_iam_policy_document.lacework_audit_policy_2025_2 | data source |
| lacework_metric_module.lwmetrics | data source |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| external_id_length | Deprecated - Will be removed on our next major release v1.0.0 | number |
16 |
no |
| iam_role_arn | The IAM role ARN is required when setting use_existing_iam_role to true |
string |
"" |
no |
| iam_role_external_id | The external ID configured inside the IAM role is required when setting use_existing_iam_role to true |
string |
"" |
no |
| iam_role_name | The IAM role name. Required to match with iam_role_arn if use_existing_iam_role is set to true |
string |
"" |
no |
| lacework_audit_policy_name | The name of the custom audit policy (which extends SecurityAudit) to allow Lacework to read configs. Defaults to lwaudit-policy-${random_id.uniq.hex} when empty | string |
"" |
no |
| lacework_aws_account_id | The Lacework AWS account that the IAM role will grant access | string |
"434813966438" |
no |
| lacework_integration_name | The name of the integration in Lacework | string |
"TF config" |
no |
| permission_boundary_arn | Optional - ARN of the policy that is used to set the permissions boundary for the role. | string |
null |
no |
| tags | A map/dictionary of Tags to be assigned to created resources | map(string) |
{} |
no |
| use_existing_iam_role | Set this to true to use an existing IAM role | bool |
false |
no |
| use_existing_iam_role_policy | Set this to true to use an existing policy on the IAM role, rather than attaching a new one |
bool |
false |
no |
| wait_time | Amount of time to wait before the next resource is provisioned | string |
"10s" |
no |
| Name | Description |
|---|---|
| external_id | The External ID configured into the IAM role |
| iam_role_arn | The IAM Role ARN |
| iam_role_name | The IAM Role name |
| lacework_integration_guid | The GUID for the created Lacework integration |
Release for 0.19.0(Feb 2025): Terraform changes to add a second policy and its attachment under the same role.(This changes is to bypass the 6144 chars limit for one policy) Add permissions for kinesisvideo, amp, appstream, personalize, codeartifact, fis; Add missing permission for services ses, backup Add permissions for future services to come: memoryDB, resource groups, qbusiness, qapps, qconnect, servicecatalogappregistry, oam, clouddirectory, optimizationhub, budgets,billingconsole
The audit policy is comprised of the following permissions:
| sid | actions | resources |
|---|---|---|
| GetEbsEncryptionByDefault | ec2:GetEbsEncryptionByDefault | * |
| GetBucketPublicAccessBlock | s3:GetBucketPublicAccessBlock | * |
| EFS | elasticfilesystem:DescribeFileSystemPolicy | * |
| elasticfilesystem:DescribeLifecycleConfiguration | ||
| elasticfilesystem:DescribeAccessPoints | ||
| elasticfilesystem:DescribeAccountPreferences | ||
| elasticfilesystem:DescribeBackupPolicy | ||
| elasticfilesystem:DescribeReplicationConfigurations | ||
| elasticfilesystem:ListTagsForResource | ||
| EMR | elasticmapreduce:ListBootstrapActions | * |
| elasticmapreduce:ListInstanceFleets | ||
| elasticmapreduce:ListInstanceGroups | ||
| SAGEMAKER | sagemaker:GetModelPackageGroupPolicy | * |
| sagemaker:GetLineageGroupPolicy | ||
| IDENTITYSTORE | identitystore:DescribeGroup | * |
| identitystore:DescribeGroupMembership | ||
| identitystore:DescribeUser | ||
| identitystore:ListGroupMemberships | ||
| identitystore:ListGroupMembershipsForMember | ||
| identitystore:ListGroups | ||
| identitystore:ListUsers | ||
| SSO | sso:DescribeAccountAssignmentDeletionStatus | * |
| sso:DescribeInstanceAccessControlAttributeConfiguration | ||
| sso:GetInlinePolicyForPermissionSet | ||
| GLACIER | glacier:ListTagsForVault | * |
| APIGATEWAY | apigateway:GET | arn:aws:apigateway:::/apikeys, arn:aws:apigateway:::/apikeys/* |
| WAFREGIONAL | waf-regional:ListRules | * |
| waf-regional:GetRule | ||
| waf-regional:ListRuleGroups | ||
| waf-regional:GetRuleGroup | ||
| waf-regional:ListActivatedRulesInRuleGroup | ||
| GLUE | glue:ListWorkflows | * |
| glue:BatchGetWorkflows | ||
| glue:GetTags | ||
| CODEBUILD | codebuild:ListBuilds | * |
| codebuild:BatchGetBuilds | ||
| SNS | sns:GetDataProtectionPolicy | * |
| sns:ListPlatformApplications | ||
| sns:GetSubscriptionAttributes | ||
| SES | ses:ListContactLists | * |
| ses:GetContactList | ||
| ses:ListContacts | ||
| ses:GetContact | ||
| ses:ListCustomVerificationEmailTemplates | ||
| ses:GetCustomVerificationEmailTemplate | ||
| ses:GetDedicatedIpPool | ||
| ses:GetBlacklistReports | ||
| ses:GetDedicatedIp | ||
| ses:ListDeliverabilityTestReports | ||
| ses:GetDeliverabilityTestReport | ||
| ses:ListEmailIdentities | ||
| ses:GetEmailIdentity | ||
| ses:GetEmailIdentityPolicies | ||
| ses:ListEmailTemplates | ||
| ses:GetEmailTemplate | ||
| ses:ListImportJobs | ||
| ses:GetImportJob | ||
| ses:ListRecommendations | ||
| ses:ListSuppressedDestinations | ||
| ses:GetSuppressedDestination | ||
| ses:ListTagsForResource | ||
| BACKUP | backup:ListBackupJobs | * |
| backup:DescribeBackupJob | ||
| backup:ListBackupPlanTemplates | ||
| backup:GetBackupPlanFromTemplate | ||
| backup:ListBackupPlans | ||
| backup:GetBackupPlan | ||
| backup:ListBackupPlanVersions | ||
| backup:ListBackupSelections | ||
| backup:GetBackupSelection | ||
| backup:DescribeBackupVault | ||
| backup:ListRecoveryPointsByBackupVault | ||
| backup:DescribeRecoveryPoint | ||
| backup:GetRecoveryPointRestoreMetadata | ||
| backup:ListCopyJobs | ||
| backup:ListFrameworks | ||
| backup:DescribeFramework | ||
| backup:ListLegalHolds | ||
| backup:GetLegalHold | ||
| backup:ListRecoveryPointsByLegalHold | ||
| backup:ListProtectedResources | ||
| backup:DescribeProtectedResource | ||
| backup:ListRecoveryPointsByResource | ||
| backup:ListReportPlans | ||
| backup:ListRestoreJobs | ||
| backup:ListTags | ||
| COGNITO-IDP | cognito-idp:GetSigningCertificate | |
| cognito-idp:GetCSVHeader | ||
| cognito-idp:GetUserPoolMfaConfig | ||
| cognito-idp:GetUICustomization | ||
| COMPUTEOPTIMIZER | compute-optimizer:DescribeRecommendationExportJobs | * |
| compute-optimizer:GetAutoScalingGroupRecommendations | ||
| compute-optimizer:GetEffectiveRecommendationPreferences | ||
| compute-optimizer:GetEBSVolumeRecommendations | ||
| compute-optimizer:GetEC2InstanceRecommendations | ||
| compute-optimizer:GetEnrollmentStatus | ||
| compute-optimizer:GetLambdaFunctionRecommendations | ||
| compute-optimizer:GetRecommendationPreferences | ||
| compute-optimizer:GetRecommendationSummaries | ||
| compute-optimizer:GetEcsServiceRecommendations | ||
| compute-optimizer:GetLicenseRecommendations | ||
| KINESISANALYTICS | kinesisanalytics:ListApplicationSnapshots | |
| kinesisanalytics:ListApplicationVersions | ||
| kinesisanalytics:DescribeApplicationVersion | ||
| kinesisanalytics:DescribeApplication | ||
| KINESISVIDEO | kinesisvideo:GetSignalingChannelEndpoint | * |
| kinesisvideo:GetDataEndpoint | ||
| kinesisvideo:DescribeImageGenerationConfiguration | ||
| AMP | aps:ListScrapers | * |
| aps:DescribeScraper | ||
| aps:ListWorkspaces | ||
| aps:DescribeAlertManagerDefinition | ||
| aps:DescribeLoggingConfiguration | ||
| aps:DescribeWorkspace | ||
| aps:ListRuleGroupsNamespaces | ||
| aps:DescribeRuleGroupsNamespace | ||
| aps:ListTagsForResource | ||
| APPSTREAM | appstream:Describe* | |
| appstream:List* | ||
| PERSONALIZE | personalize:Describe* | |
| personalize:List* | ||
| personalize:GetSolutionMetrics | ||
| CODEARTIFACT | codeartifact:ListDomains | * |
| codeartifact:DescribeDomain | ||
| codeartifact:DescribeRepository | ||
| codeartifact:ListPackages | ||
| codeartifact:GetRepositoryEndpoint | ||
| codeartifact:DescribePackage | ||
| codeartifact:ListPackageVersions | ||
| codeartifact:DescribePackageVersion | ||
| codeartifact:GetPackageVersionReadme | ||
| codeartifact:ListPackageVersionDependencies | ||
| codeartifact:ListPackageVersionAssets | ||
| codeartifact:GetPackageVersionAsset | ||
| codeartifact:ListTagsForResource | ||
| FIS | fis:ListActions | * |
| fis:GetAction | ||
| fis:ListExperimentTemplates | ||
| fis:GetExperimentTemplate | ||
| fis:ListTargetAccountConfigurations | ||
| fis:ListExperiments | ||
| fis:GetExperiment | ||
| fis:ListExperimentResolvedTargets | ||
| MEMORYDB | memorydb:DescribeMultiRegionClusters | * |
| memorydb:DescribeSnapshots | ||
| memorydb:DescribeSubnetGroups | ||
| memorydb:DescribeParameterGroups | ||
| memorydb:DescribeParameters | ||
| memorydb:DescribeUsers | ||
| memorydb:DescribeACLs | ||
| memorydb:DescribeServiceUpdates | ||
| memorydb:DescribeEngineVersions | ||
| memorydb:DescribeReservedNodes | ||
| memorydb:DescribeReservedNodesOfferings | ||
| memorydb:ListTags | ||
| memorydb:ListAllowedNodeTypeUpdates | ||
| memorydb:ListAllowedMultiRegionClusterUpdates | ||
| QBUSINESS | qbusiness:GetApplication | * |
| qbusiness:GetChatControlsConfiguration | ||
| qbusiness:GetPolicy | ||
| qbusiness:ListAttachments | ||
| qbusiness:ListConversations | ||
| qbusiness:ListMessages | ||
| qbusiness:ListDataAccessors | ||
| qbusiness:GetDataAccessor | ||
| qbusiness:GetIndex | ||
| qbusiness:GetDataSource | ||
| qbusiness:GetPlugin | ||
| qbusiness:ListPluginActions | ||
| qbusiness:GetRetriever | ||
| qbusiness:GetWebExperience | ||
| qbusiness:ListPluginTypeMetadata | ||
| qbusiness:ListPluginTypeActions | ||
| QAPPS | qapps:DescribeQAppPermissions | * |
| qapps:GetLibraryItem | ||
| qapps:GetQApp | ||
| qapps:GetQAppSession | ||
| qapps:GetQAppSessionMetadata | ||
| qapps:ListCategories | ||
| qapps:ListLibraryItems | ||
| qapps:ListQAppSessionData | ||
| qapps:ListQApps | ||
| qapps:ListTagsForResource | ||
| QCONNECT | wisdom:GetAIAgent | * |
| wisdom:GetAIGuardrail | ||
| wisdom:GetAIPrompt | ||
| wisdom:GetContent | ||
| wisdom:GetImportJob | ||
| wisdom:GetKnowledgeBase | ||
| wisdom:GetMessageTemplate | ||
| wisdom:GetQuickResponse | ||
| wisdom:ListAIAgentVersions | ||
| wisdom:ListAIAgents | ||
| wisdom:ListAIGuardrailVersions | ||
| wisdom:ListAIGuardrails | ||
| wisdom:ListAIPromptVersions | ||
| wisdom:ListAIPrompts | ||
| wisdom:ListAssistantAssociations | ||
| wisdom:ListAssistants | ||
| wisdom:ListContentAssociations | ||
| wisdom:ListContents | ||
| wisdom:ListImportJobs | ||
| wisdom:ListKnowledgeBases | ||
| wisdom:ListMessageTemplateVersions | ||
| wisdom:ListMessageTemplates | ||
| wisdom:ListQuickResponses | ||
| wisdom:ListTagsForResource | ||
| RESOURCEGROUPS | resource-groups:ListGroups | * |
| resource-groups:GetGroupQuery | ||
| resource-groups:GetGroupConfiguration | ||
| SERVICECATALOGAPPREGISTRY | servicecatalog:GetApplication | * |
| servicecatalog:ListApplications | ||
| servicecatalog:GetAssociatedResource | ||
| servicecatalog:ListAssociatedResources | ||
| servicecatalog:ListAssociatedAttributeGroups | ||
| servicecatalog:GetAttributeGroup | ||
| servicecatalog:ListAttributeGroups | ||
| servicecatalog:ListTagsForResource | ||
| servicecatalog:ListAttributeGroupsForApplication | ||
| servicecatalog:GetConfiguration | ||
| OAM | oam:GetLink | * |
| oam:GetSink | ||
| oam:GetSinkPolicy | ||
| oam:ListAttachedLinks | ||
| oam:ListLinks | ||
| oam:ListSinks | ||
| CLOUDDIRECTORY | clouddirectory:GetAppliedSchemaVersion | * |
| clouddirectory:GetDirectory | ||
| clouddirectory:GetFacet | ||
| clouddirectory:GetLinkAttributes | ||
| clouddirectory:GetObjectAttributes | ||
| clouddirectory:GetObjectInformation | ||
| clouddirectory:GetSchemaAsJson | ||
| clouddirectory:GetTypedLinkFacetInformation | ||
| clouddirectory:ListAppliedSchemaArns | ||
| clouddirectory:ListAttachedIndices | ||
| clouddirectory:ListDevelopmentSchemaArns | ||
| clouddirectory:ListFacetAttributes | ||
| clouddirectory:ListFacetNames | ||
| clouddirectory:ListIncomingTypedLinks | ||
| clouddirectory:ListIndex | ||
| clouddirectory:ListManagedSchemaArns | ||
| clouddirectory:ListObjectAttributes | ||
| clouddirectory:ListObjectChildren | ||
| clouddirectory:ListObjectParentPaths | ||
| clouddirectory:ListObjectParents | ||
| clouddirectory:ListObjectPolicies | ||
| clouddirectory:ListOutgoingTypedLinks | ||
| clouddirectory:ListPolicyAttachments | ||
| clouddirectory:ListPublishedSchemaArns | ||
| clouddirectory:ListTagsForResource | ||
| clouddirectory:ListTypedLinkFacetAttributes | ||
| clouddirectory:ListTypedLinkFacetNames | ||
| COSTOPTIMIZATIONHUB | cost-optimization-hub:GetPreferences | * |
| cost-optimization-hub:GetRecommendation | ||
| cost-optimization-hub:ListEnrollmentStatuses | ||
| cost-optimization-hub:ListRecommendationSummaries | ||
| cost-optimization-hub:ListRecommendations | ||
| BUDGETS | budgets:DescribeBudgetAction | * |
| budgets:DescribeBudgetActionHistories | ||
| budgets:DescribeBudgetActionsForAccount | ||
| budgets:DescribeBudgetActionsForBudget | ||
| budgets:ListTagsForResource | ||
| budgets:ViewBudget | ||
| BILLINGCONSOLE | aws-portal:GetConsoleActionSetEnforced | * |
| aws-portal:ViewAccount | ||
| aws-portal:ViewBilling | ||
| aws-portal:ViewPaymentMethods | ||
| aws-portal:ViewUsage | ||
| ACM-PCA | acm-pca:GetCertificateAuthorityCertificate | * |
| acm-pca:GetCertificateAuthorityCertificate | * | |
| acm-pca:GetCertificateAuthorityCsr | ||
| APPCONFIG | appconfig:GetConfigurationProfile | * |
| appconfig:GetDeploymentStrategy | ||
| appconfig:GetExtension | ||
| appconfig:GetExtensionAssociation | ||
| appconfig:GetHostedConfigurationVersion | ||
| appconfig:ListApplications | ||
| appconfig:ListConfigurationProfiles | ||
| appconfig:ListDeployments | ||
| appconfig:ListDeploymentStrategies | ||
| appconfig:ListEnvironments | ||
| appconfig:ListExtensionAssociations | ||
| appconfig:ListExtensions | ||
| appconfig:ListHostedConfigurationVersions | ||
| appconfig:ListTagsForResource | ||
| APPFLOW | appflow:DescribeConnectorEntity | * |
| appflow:DescribeConnectorProfiles | ||
| appflow:DescribeConnectors | ||
| appflow:DescribeFlow | ||
| appflow:DescribeFlowExecutionRecords | ||
| appflow:ListConnectorEntities | ||
| appflow:ListConnectors | ||
| DYNAMODB | dynamodb:DescribeContributorInsights | * |
| dynamodb:GetResourcePolicy | ||
| EBS | ebs:GetSnapshotBlock | * |
| ebs:ListSnapshotBlocks | ||
| FREETIER | freetier:GetFreeTierUsage | * |
| LAKEFORMATION | lakeformation:DescribeLakeFormationIdentityCenterConfiguration | * |
| lakeformation:GetDataLakePrincipal | ||
| lakeformation:GetDataLakeSettings | ||
| lakeformation:GetEffectivePermissionsForPath | ||
| lakeformation:GetTableObjects | ||
| lakeformation:ListDataCellsFilter | ||
| lakeformation:ListPermissions | ||
| lakeformation:ListResources | ||
| lakeformation:ListTableStorageOptimizers | ||
| lakeformation:ListTransactions | ||
| LAMBDA | lambda:GetFunction | * |
| lambda:GetFunctionCodeSigningConfig | ||
| SCHEDULER | scheduler:GetSchedule | * |
| scheduler:GetScheduleGroup | ||
| scheduler:ListScheduleGroups | ||
| scheduler:ListSchedules | ||
| scheduler:ListTagsForResource | ||
| SCHEMAS | schemas:GetCodeBindingSource | * |
| DATASYNC | datasync:DescribeTaskExecution | * |
| datasync:DescribeLocationEfs | ||
| datasync:ListAgents | ||
| datasync:ListLocations | ||
| datasync:ListTaskExecutions | ||
| datasync:ListStorageSystems | ||
| datasync:DescribeLocationSmb | ||
| datasync:DescribeAgent | ||
| datasync:DescribeLocationFsxWindows | ||
| datasync:DescribeTask | ||
| datasync:DescribeLocationS3 | ||
| datasync:DescribeDiscoveryJob | ||
| datasync:DescribeLocationObjectStorage | ||
| datasync:DescribeStorageSystem | ||
| datasync:DescribeLocationAzureBlob | ||
| datasync:ListTagsForResource | ||
| datasync:ListTasks | ||
| datasync:DescribeLocationHdfs | ||
| datasync:DescribeLocationFsxLustre | ||
| datasync:ListDiscoveryJobs | ||
| datasync:DescribeLocationNfs |