dmarc-import-tf-module

dmarc-import-tf-module contains the Terraform configuration files to build the AWS infrastructure used for parsing DMARC aggregate reports. This repository goes along with dmarc-import, which contains the actual source code for ingesting, parsing, and saving the DMARC aggregate reports.

Here is a Cloudcraft.co diagram of the basic infrastructure created by these Terraform files:

Usage

module "dmarc_import" {
  source = "github.com/cisagov/dmarc-import-tf-module"

  providers = {
    aws = aws.dnsprovisionaccount
  }

  aws_region                = var.aws_region
  elasticsearch_domain_name = var.elasticsearch_domain_name
  elasticsearch_index       = var.elasticsearch_index
  elasticsearch_type        = var.elasticsearch_type
  emails                    = var.emails
  lambda_function_name      = var.lambda_function_name
  lambda_function_zip_file  = var.lambda_function_zip_file
  permanent_bucket_name     = var.permanent_bucket_name
  queue_name                = var.queue_name
  rule_set_name             = var.rule_set_name
  temporary_bucket_name     = var.temporary_bucket_name
}

Examples

No examples.

Requirements

Name	Version
terraform	>= 1.1
aws	>= 4.9

Providers

Name	Version
aws	>= 4.9

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_event_rule.lambda	resource
aws_cloudwatch_event_target.lambda	resource
aws_cloudwatch_log_group.es_logs	resource
aws_cloudwatch_log_group.logs	resource
aws_cloudwatch_log_resource_policy.es_cloudwatch_policy	resource
aws_cognito_identity_pool.dmarc	resource
aws_cognito_identity_pool_roles_attachment.dmarc	resource
aws_cognito_managed_user_pool_client.dmarc	resource
aws_cognito_user.dmarc	resource
aws_cognito_user_pool.dmarc	resource
aws_cognito_user_pool_domain.dmarc	resource
aws_elasticsearch_domain.es	resource
aws_iam_role.cognito_authenticated	resource
aws_iam_role.lambda	resource
aws_iam_role.opensearch_cognito	resource
aws_iam_role_policy.cloudwatch_policy	resource
aws_iam_role_policy.cognito_authenticated	resource
aws_iam_role_policy.es_policy	resource
aws_iam_role_policy.lambda_lambda	resource
aws_iam_role_policy.s3_lambda	resource
aws_iam_role_policy.sqs_policy	resource
aws_iam_role_policy_attachment.opensearch_cognito	resource
aws_lambda_function.lambda	resource
aws_lambda_permission.allow_cloudwatch	resource
aws_s3_bucket.permanent	resource
aws_s3_bucket.temporary	resource
aws_s3_bucket_notification.notification	resource
aws_s3_bucket_policy.permanent_policy	resource
aws_s3_bucket_policy.temporary_policy	resource
aws_ses_active_receipt_rule_set.active	resource
aws_ses_receipt_rule.rule	resource
aws_ses_receipt_rule_set.rules	resource
aws_sqs_queue.dead_letter	resource
aws_sqs_queue.dmarc_reports	resource
aws_sqs_queue_policy.dmarc_reports	resource
aws_caller_identity.current	data source
aws_iam_policy_document.assume_role	data source
aws_iam_policy_document.cloudwatch_lambda	data source
aws_iam_policy_document.cognito_authenticated	data source
aws_iam_policy_document.cognito_authenticated_role_policy	data source
aws_iam_policy_document.es_cloudwatch_doc	data source
aws_iam_policy_document.es_cognito_auth	data source
aws_iam_policy_document.es_lambda	data source
aws_iam_policy_document.lambda_lambda	data source
aws_iam_policy_document.opensearch_cognito_trust	data source
aws_iam_policy_document.s3_lambda	data source
aws_iam_policy_document.s3_sqs	data source
aws_iam_policy_document.ses_permanent_s3_doc	data source
aws_iam_policy_document.ses_temporary_s3_doc	data source
aws_iam_policy_document.sqs_lambda	data source

Inputs

Name	Description	Type	Default	Required
aws_region	The AWS region to deploy into (e.g. us-east-1).	string	"us-east-1"	no
cognito_authenticated_role_name	The name of the IAM role that grants authenticated access to the Elasticsearch database.	string	"dmarc-import-authenticated"	no
cognito_identity_pool_name	The name of the Cognito identity pool to use for access to the Elasticsearch database.	string	"dmarc-import"	no
cognito_user_pool_client_name	The name of the Cognito user pool client to use for access to the Elasticsearch database.	string	"dmarc-import"	no
cognito_user_pool_domain	The domain to use for the Cognito endpoint. For custom domains, this is the fully-qualified domain name, such as auth.example.com. For Amazon Cognito prefix domains, this is the prefix alone, such as auth.	string	"dmarc-import"	no
cognito_user_pool_name	The name of the Cognito user pool to use for access to the Elasticsearch database.	string	"dmarc-import"	no
cognito_usernames	A map whose keys are the usernames of each Cognito user and whose values are a map containing supported user attributes. The only currently-supported attribute is "email" (string). Example: { "firstname1.lastname1" = { "email" = "firstname1.lastname1@foo.gov" }, "firstname2.lastname2" = { "email" = "firstname2.lastname2@foo.gov" } }	map(object({ email = string }))	{}	no
elasticsearch_domain_name	The domain name of the Elasticsearch instance.	string	n/a	yes
elasticsearch_index	The Elasticsearch index to which to write DMARC aggregate report data.	string	n/a	yes
elasticsearch_type	The Elasticsearch type corresponding to a DMARC aggregate report.	string	n/a	yes
emails	A list of the email addresses at which DMARC aggregate reports are being received.	list(string)	n/a	yes
lambda_function_name	The name to use for the Lambda function.	string	n/a	yes
lambda_function_zip_file	The location of the zip file for the Lambda function.	string	n/a	yes
opensearch_service_role_for_auth_name	The name of the IAM role that gives Amazon OpenSearch Service permissions to configure the Amazon Cognito user and identity pools and use them for OpenSearch Dashboards/Kibana authentication.	string	"opensearch-service-cognito-access"	no
permanent_bucket_name	The name of the S3 bucket where the DMARC aggregate report emails are stored permanently.	string	n/a	yes
queue_name	The name of the SQS queue where events will be sent as DMARC aggregate reports are received.	string	n/a	yes
rule_set_name	The name of the SES rule set that processes DMARC aggregate reports.	string	n/a	yes
temporary_bucket_name	The name of the S3 bucket where the DMARC aggregate report emails are stored temporarily (until processed).	string	n/a	yes

Outputs

Name	Description
elasticsearch_domain	The Elasticsearch domain.

Notes

Running pre-commit requires running terraform init in every directory that contains Terraform code. In this repository, this is just the main directory.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.