Common Terraform for AWS Data Sources

Use these common data sources to automate evidence collection

Written By Micah Spieler

Looking for common data sources used for automating evidence collection from AWS? Look no further!

This list is not exhaustive of the possibilities of what can be collected from AWS via the Terraform integration, but hopefully provide a good starting point.

Administrator Access to Application	Provide a system-generated list of administrative users for applications in scope. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_iam_roles aws_iam_users aws_iam_group
Change Management - Developers	Provide a system-generated list of developers. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_iam_roles aws_iam_users aws_iam_group
Change Management - Production Access	Provide a system-generated list of internal users who can push changes to production. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_iam_roles aws_iam_users aws_iam_group
Configuration as Code	Provide evidence from the configuration management tool(s) showing that a standard infrastructure configuration is deployed across all environments. This can show that the tool is enabled or that standard settings are being applied. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_cloudformation_stack
Database Encryption	Provide the settings showing that sensitive data at rest is encrypted on the database or evidence that external database providers employ database encryption (via their SOC 2 or contractual documentation). If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_db_instance aws_rds_cluser aws_db_cluster_snapshot aws_redshift_cluster aws_dynamodb_table
Encryption in Transit	Provide configuration evidencing encryption-in-transit for connections between services (SFTP, VPN).	aws_vpn_gateway aws_customer_gateway aws_acm_certificate aws_lb aws_lb_listener
Firewall Rules	Provide the firewall rule configurations for the cloud service network. This can be via a dashboard, the rule settings, or the DMZ, if applicable. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_networkfirewall_firewall aws_route53_resolver_firewall_rules aws_wafv2_ip_set aws_wafv2_regex_pattern_set aws_wafv2_web_acl
Intrusion Detection Configuration	Provide the intrusion detection/ intrusion prevention system (IDS/IPS) configurations. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_instance aws_launch_template aws_vpc_peering_connection aws_network_acls aws_nat_gateway aws_ec2_network_insights_analysis
Intrusion Rules	Provide the intrusion detection system (IDS) alerting rules evidencing what type of activities prompt alerting. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_instance aws_launch_template aws_vpc_peering_connection aws_network_acls aws_nat_gateway aws_ec2_network_insights_analysis
Malware Alert	Provide the malware alerting configuration settings for the infrastructure. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_cloudwatch_event_bus
Multi Factor Authentication Evidence	Provide the settings that show that multi-factor authentication is turned on and enabled for internal users with access to critical systems. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_iam_policy
Patch Scan	Provide the tool configuration to scan the network for unpatched network devices and machines. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_ssm_patch_baseline
Separation of Environments	Provide (a) screenshot(s) showing the production and development environments are logically separated from one another. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_vpcs
Server Scan and Patch	Provide evidence of the most recent patch update following industry standards/updated patch available from vendors. If uploading a manually created screenshot as evidence, it should include the date/time stamp to be valid.	aws_ssm_patch_baseline

Was this helpful?

Still need help? Share an idea