Global Alert Firehose

stream_alert_cli/terraform/generate.py

@@ -181,6 +181,13 @@ def generate_main(**kwargs):
             's3_bucket_name': firehose_s3_bucket_name
         }
 
+    main_dict['module']['globals'] = {
+        'source': 'modules/tf_stream_alert_globals',
+        'account_id': config['global']['account']['aws_account_id'],
+        'region': config['global']['account']['region'],
+        'prefix': config['global']['account']['prefix']
+    }
+
     # KMS Key and Alias creation
     main_dict['resource']['aws_kms_key']['stream_alert_secrets'] = {
         'enable_key_rotation': True,

terraform/modules/tf_stream_alert/iam.tf

@@ -50,7 +50,7 @@ data "aws_iam_policy_document" "rule_processor_invoke_alert_proc" {
   }
 }
 
-// IAM Role Policy: Allow the Rule Processor to put records on Firehose
+// IAM Role Policy: Allow the Rule Processor to put data on Firehose
 resource "aws_iam_role_policy" "streamalert_rule_processor_firehose" {
   name = "FirehoseWriteData"
   role = "${aws_iam_role.streamalert_rule_processor_role.id}"
@@ -216,7 +216,7 @@ resource "aws_iam_role_policy" "streamalert_alert_processor_s3_outputs" {
 EOF
 }
 
-// IAM Role Policy: Allow the Alert Processor to to Firehose
+// IAM Role Policy: Allow the Alert Processor to write alerts to Firehose
 resource "aws_iam_role_policy" "streamalert_alert_processor_firehose" {
   name = "FirehoseWriteAlerts"
   role = "${aws_iam_role.streamalert_alert_processor_role.id}"
@@ -234,7 +234,7 @@ data "aws_iam_policy_document" "alert_processor_firehose" {
     ]
 
     resources = [
-      "${aws_kinesis_firehose_delivery_stream.stream_alerts.arn}",
+      "arn:aws:firehose:${var.region}:${var.account_id}:deliverystream/${var.prefix}_streamalert_alert_delivery",
     ]
   }
 }

terraform/modules/tf_stream_alert/variables.tf

@@ -54,18 +54,6 @@ variable "input_sns_topics" {
   default = []
 }
 
-variable "firehose_buffer_size" {
-  default = 128
-}
-
-variable "firehose_buffer_interval" {
-  default = 300
-}
-
-variable "firehose_compression_format" {
-  default = "GZIP"
-}
-
 variable "kms_key_arn" {
   type = "string"
 }

terraform/modules/tf_stream_alert_globals/README.md

@@ -0,0 +1,51 @@
+# Stream Alert Globals
+* This Terraform module creates various global infrastructure components
+
+## Components
+* Kinesis Firehose Delivery Stream for Putting Alerts on S3
+
+## Example
+```
+module "globals" {
+  source                       = "../modules/tf_stream_alert_globals"
+  account_id                   = "112233445566"
+  region                       = "us-east-1"
+  prefix                       = "mycompany"
+}
+```
+
+## Inputs
+<table>
+  <tr>
+    <th>Property</th>
+    <th>Description</th>
+    <th>Default</th>
+    <th>Required</th>
+  </tr>
+  <tr>
+    <td>account_id</td>
+    <td>Your AWS Account ID</td>
+    <td>None</td>
+    <td>True</td>
+  </tr>
+  <tr>
+    <td>region</td>
+    <td>The AWS region for your stream</td>
+    <td>None</td>
+    <td>True</td>
+  </tr>
+  <tr>
+    <td>prefix</td>
+    <td>The resource prefix, normally an organizational name or descriptor</td>
+    <td>None</td>
+    <td>True</td>
+  </tr>
+</table>
+
+## Outputs
+<table>
+  <tr>
+    <th>Property</th>
+    <th>Description</th>
+  </tr>
+</table>

terraform/modules/tf_stream_alert/firehose.tf → terraform/modules/tf_stream_alert_globals/alerts_firehose/iam.tf

@@ -1,6 +1,6 @@
 // IAM Role: Alert Firehose S3 Role
 resource "aws_iam_role" "firehose" {
-  name = "${var.prefix}_${var.cluster}_streamalert_delivery_firehose"
+  name = "${var.prefix}_streamalert_delivery_firehose"
 
   assume_role_policy = "${data.aws_iam_policy_document.firehose_assume_role_policy.json}"
 }
@@ -50,7 +50,7 @@ data "aws_iam_policy_document" "firehose_s3" {
 
 // CloudWatch Log Group: Firehose
 resource "aws_cloudwatch_log_group" "firehose" {
-  name              = "/aws/kinesisfirehose/${var.prefix}_${var.cluster}_streamalert_alert_delivery"
+  name              = "/aws/kinesisfirehose/${var.prefix}_streamalert_alert_delivery"
   retention_in_days = "${var.cloudwatch_log_retention}"
 }
 
@@ -91,28 +91,7 @@ data "aws_iam_policy_document" "firehose_cloudwatch" {
     ]
 
     resources = [
-      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/kinesisfirehose/${var.prefix}_${var.cluster}_streamalert_alert_delivery:*",
+      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/kinesisfirehose/${var.prefix}_streamalert_alert_delivery:*",
     ]
   }
 }
-
-// AWS Firehose Stream for Alerts
-resource "aws_kinesis_firehose_delivery_stream" "stream_alerts" {
-  name        = "${var.prefix}_${var.cluster}_streamalert_alert_delivery"
-  destination = "s3"
-
-  s3_configuration {
-    role_arn           = "${aws_iam_role.firehose.arn}"
-    bucket_arn         = "arn:aws:s3:::${var.prefix}.streamalerts"
-    prefix             = "alerts/"
-    buffer_size        = "${var.firehose_buffer_size}"
-    buffer_interval    = "${var.firehose_buffer_interval}"
-    compression_format = "${var.firehose_compression_format}"
-
-    cloudwatch_logging_options {
-      enabled         = true
-      log_group_name  = "/aws/kinesisfirehose/${var.prefix}_${var.cluster}_streamalert_alert_delivery"
-      log_stream_name = "S3Delivery"
-    }
-  }
-}

terraform/modules/tf_stream_alert_globals/alerts_firehose/main.tf

@@ -0,0 +1,20 @@
+// AWS Firehose Stream for Alerts to S3
+resource "aws_kinesis_firehose_delivery_stream" "stream_alerts" {
+  name        = "${var.prefix}_streamalert_alert_delivery"
+  destination = "s3"
+
+  s3_configuration {
+    role_arn           = "${aws_iam_role.firehose.arn}"
+    bucket_arn         = "arn:aws:s3:::${var.prefix}.streamalerts"
+    prefix             = "alerts/"
+    buffer_size        = "${var.buffer_size}"
+    buffer_interval    = "${var.buffer_interval}"
+    compression_format = "${var.compression_format}"
+
+    cloudwatch_logging_options {
+      enabled         = true
+      log_group_name  = "/aws/kinesisfirehose/${var.prefix}_streamalert_alert_delivery"
+      log_stream_name = "S3Delivery"
+    }
+  }
+}

terraform/modules/tf_stream_alert_globals/alerts_firehose/variables.tf

@@ -0,0 +1,21 @@
+variable "account_id" {}
+
+variable "buffer_size" {
+  default = 128
+}
+
+variable "buffer_interval" {
+  default = 300
+}
+
+variable "cloudwatch_log_retention" {
+  default = 30
+}
+
+variable "compression_format" {
+  default = "GZIP"
+}
+
+variable "prefix" {}
+
+variable "region" {}

terraform/modules/tf_stream_alert_globals/main.tf

@@ -0,0 +1,6 @@
+module "alerts_firehose" {
+  source     = "alerts_firehose"
+  account_id = "${var.account_id}"
+  prefix     = "${var.prefix}"
+  region     = "${var.region}"
+}

terraform/modules/tf_stream_alert_globals/variables.tf

@@ -0,0 +1,5 @@
+variable "account_id" {}
+
+variable "prefix" {}
+
+variable "region" {}