Terraform Components

This is a library of reusable Terraform "root module" components.

access-analyzer

This component is responsible for configuring AWS Identity and Access Management Access Analyzer within an AWS Organization

account

This component is responsible for provisioning the full account hierarchy along with Organizational Units (OUs)

account-map (1)

This component is responsible for provisioning information only: it simply populates Terraform state with data (account ids, groups, and roles) that other root modules need via outputs

account-quotas

This component is responsible for requesting service quota increases

account-settings

This component is responsible for provisioning account level settings: IAM password policy, AWS Account Alias, EBS encryption, and Service Quotas

acm

This component is responsible for requesting an ACM certificate for a domain and adding a CNAME record to the DNS zone to complete certificate validation

alb

This component is responsible for provisioning a generic Application Load Balancer

amplify

This component is responsible for provisioning AWS Amplify apps, backend environments, branches, domain associations, and webhooks

api-gateway-account-settings

This component is responsible for setting the global, regional settings required to allow API Gateway to write to CloudWatch logs

api-gateway-rest-api

This component is responsible for deploying an API Gateway REST API

argocd-github-repo

This component is responsible for creating and managing an ArgoCD desired state repository

athena

This component is responsible for provisioning an Amazon Athena workgroup, databases, and related resources

aurora-mysql

This component is responsible for provisioning Aurora MySQL RDS clusters

aurora-mysql-resources

This component is responsible for provisioning Aurora MySQL resources: additional databases, users, permissions, grants, etc

aurora-postgres

This component is responsible for provisioning Aurora Postgres RDS clusters

aurora-postgres-resources

This component is responsible for provisioning Aurora Postgres resources: additional databases, users, permissions, grants, etc

aws-backup

This component is responsible for provisioning an AWS Backup Plan

aws-config (1)

This component is responsible for configuring AWS Config

aws-inspector

This component is responsible for provisioning an [AWS Inspector](https://docs

aws-inspector2

This component is responsible for configuring Inspector V2 within an AWS Organization

aws-saml

This component is responsible for provisioning SAML metadata into AWS IAM as new SAML providers

aws-shield

This component is responsible for enabling AWS Shield Advanced Protection for the following resources:

Application Load Balancers (ALBs)
CloudFront Distributions
Elastic IPs
Route53 Hosted Zones

This component assumes that resources it is configured to protect are not already protected by other components that have their xxx_aws_shield_protection_enabled variable set to true

aws-team-roles

This component is responsible for provisioning user and system IAM roles outside the identity account

aws-teams

This component is responsible for provisioning all primary user and system roles into the centralized identity account

bastion

This component is responsible for provisioning a generic Bastion host within an ASG with parameterized user_data and support for AWS SSM Session Manager for remote access with IAM authentication

cloudtrail

This component is responsible for provisioning cloudtrail auditing in an individual account

cloudtrail-bucket

This component is responsible for provisioning a bucket for storing cloudtrail logs for auditing purposes

cloudwatch-logs

This component is responsible for creation of CloudWatch Log Streams and Log Groups

cognito

This component is responsible for provisioning and managing AWS Cognito resources

config-bucket

This module creates an S3 bucket suitable for storing AWS Config data

datadog-credentials (1)

This component is responsible for provisioning SSM or ASM entries for Datadog API keys

datadog-integration

This component is responsible for provisioning Datadog AWS integrations

datadog-lambda-forwarder

This component is responsible for provision all the necessary infrastructure to deploy [Datadog Lambda forwarders](https://github

datadog-logs-archive

This component is responsible for provisioning Datadog Log Archives

datadog-monitor

This component is responsible for provisioning Datadog monitors and assigning Datadog roles to the monitors

datadog-private-location-ecs

This component is responsible for creating a datadog private location and deploying it to ECS (EC2 / Fargate)

Usage

Note The app key required for this component requires admin level permissions if you are using the default roles

datadog-synthetics

This component provides the ability to implement [Datadog synthetic tests](https://docs

datadog-synthetics-private-location

This component provisions a Datadog synthetics private location on Datadog and a private location agent on EKS cluster

dns-delegated

This component is responsible for provisioning a DNS zone which manages subdomains delegated from a DNS zone in the primary DNS account

dns-primary

This component is responsible for provisioning the primary DNS zones into an AWS account

documentdb

This component is responsible for provisioning DocumentDB clusters

dynamodb

This component is responsible for provisioning a DynamoDB table

ec2-client-vpn

This component is responsible for provisioning VPN Client Endpoints

ec2-instance

This component is responsible for provisioning a single EC2 instance

ecr

This component is responsible for provisioning repositories, lifecycle rules, and permissions for streamlined ECR usage

ecs

This component is responsible for provisioning an ECS Cluster and associated load balancer

ecs-service

This component is responsible for creating an ECS service

efs

This component is responsible for provisioning an [EFS](https://aws

eks (28)

This component creates a Helm release for [actions-runner-controller](https://github

elasticache-redis

This component is responsible for provisioning [ElastiCache Redis](https://aws

elasticsearch

This component is responsible for provisioning an Elasticsearch cluster with built-in integrations with Kibana and Logstash

eventbridge

The eventbridge component is a Terraform module that defines a CloudWatch EventBridge rule

github-action-token-rotator

This component is responsible for provisioning [Github Action Token Rotator](https://github

github-oidc-provider

This component is responsible for authorizing the GitHub OIDC provider as an Identity provider for an AWS account

github-oidc-role

This component is responsible for creating IAM roles for GitHub Actions to assume

github-runners

This component is responsible for provisioning EC2 instances for GitHub runners

github-webhook

This component provisions a GitHub webhook for a single GitHub repository

global-accelerator

This component is responsible for provisioning AWS Global Accelerator and its listeners

global-accelerator-endpoint-group

This component is responsible for provisioning a Global Accelerator Endpoint Group

glue (10)

This component provisions Glue catalog databases

guardduty

This component is responsible for configuring GuardDuty within an AWS Organization

iam-role

This component is responsible for provisioning simple IAM roles

iam-service-linked-roles

This component is responsible for provisioning [IAM Service-Linked Roles](https://docs

This component is responsible for creating [AWS SSO Permission Sets][1] and creating AWS SSO Account Assignments, that is, assigning IdP (Okta) groups and/or users to AWS SSO permission sets in specific AWS Accounts

ipam

This component is responsible for provisioning IPAM per region in a centralized account

kinesis-stream

This component is responsible for provisioning an Amazon Kinesis data stream

kms

This component is responsible for provisioning a KMS Key

lakeformation

This component is responsible for provisioning Amazon Lake Formation resources

lambda

This component is responsible for provisioning Lambda functions

macie

This component is responsible for configuring Macie within an AWS Organization

managed-grafana (3)

This component is responsible for provisioning an API Key for an Amazon Managed Grafana workspace

managed-grafana-data-source (2)

This component is responsible for provisioning a Loki data source for an Amazon Managed Grafana workspace

managed-prometheus (1)

This component is responsible for provisioning a workspace for Amazon Managed Service for Prometheus, also known as Amazon Managed Prometheus (AMP)

memorydb

This component provisions an AWS MemoryDB cluster

mq-broker

This component is responsible for provisioning an AmazonMQ broker and corresponding security group

msk

This component is responsible for provisioning [Amazon Managed Streaming](https://aws

mwaa

This component provisions Amazon managed workflows for Apache Airflow

network-firewall

This component is responsible for provisioning [AWS Network Firewall](https://aws

opsgenie-team (1)

This component is responsible for provisioning Opsgenie teams and related services, rules, schedules

philips-labs-github-runners

This component is responsible for provisioning the surrounding infrastructure for the github runners

rds

This component is responsible for provisioning an RDS instance

redshift

This component is responsible for provisioning a RedShift instance

redshift-serverless

This component is responsible for provisioning Redshift clusters

route53-resolver-dns-firewall

This component is responsible for provisioning [Route 53 Resolver DNS Firewall](https://docs

runs-on

This component is responsible for provisioning an RunsOn (https://runs-on

s3-bucket

This component is responsible for provisioning S3 buckets

security-hub

This component is responsible for configuring Security Hub within an AWS Organization

ses

This component is responsible for provisioning SES to act as an SMTP gateway

sftp

This component is responsible for provisioning SFTP Endpoints

site-to-site-vpn

This component provisions a [Site-To-Site VPN](https://aws

snowflake-account

This component sets up the requirements for all other Snowflake components, including creating the Terraform service user

snowflake-database

All data in Snowflake is stored in database tables, logically structured as collections of columns and rows

sns-topic

This component is responsible for provisioning an SNS topic

spa-s3-cloudfront

This component is responsible for provisioning:

S3 bucket
CloudFront distribution for a Single Page Application
ACM placed in us-east-1 regardless of the stack region (requirement of CloudFront)

NOTE: The component does not use the ACM created by dns-delegated, because the ACM region has to be us-east-1