hervekhg

resource "aws_iam_policy" "lambda_policy" {
  name   = aws_iam_role.force_bucket_encryption.name
  path   = "/"
  policy = data.aws_iam_policy_document.lambda_policy_doc.json
}

resource "aws_iam_role_policy_attachment" "ec2_tags_enforced" {
  role       = aws_iam_role.force_bucket_encryption.name
  policy_arn = aws_iam_policy.lambda_policy.arn
}

hervekhg

resource "aws_lambda_layer_version" "dep" {
  layer_name = "force_bucket_encryption"
  s3_bucket  = var.lambda_s3_bucket
  s3_key     = "force_bucket_encryption/lib.zip"

  compatible_runtimes = ["python3.6"]
}

resource "aws_lambda_function" "force_bucket_encryption" {
  s3_bucket     = var.lambda_s3_bucket

hervekhg

resource "aws_cloudwatch_event_rule" "daily" {
  name        = "daily_enforce_bucket_kms_encryption"
  description = "run everyday"

  #schedule_expression = "${var.cron_schedule_enforce_bucket_encryption} "
  event_pattern = <<PATTERN
  {
    "source": [
      "aws.s3"
    ],

hervekhg

resource "aws_cloudwatch_event_target" "target_lambda" {
  rule      = aws_cloudwatch_event_rule.daily.name
  target_id = "enforce_bucket_kms_encryption"
  arn       = aws_lambda_function.force_bucket_encryption.arn
}

hervekhg

resource "aws_cloudwatch_event_target" "sns_target" {
  arn = var.sns_topic_arn
  rule = aws_cloudwatch_event_rule.daily.name
  target_id = "send-sns-notification"
}

hervekhg

cd terraform_code_folder
terraform init
terraform plan 
terraform apply 

hervekhg

###############################################
## Author : Hervekhg
## Description: This Lambda function enforce encryption on unencrypted S3 Bucket
#####################################################

from boto3 import resource, client
from logging import getLogger, info, error, debug
from os import environ
from botocore.exceptions import ClientError

hervekhg

###############################################
## Author : HKO
## Date: 16/02/2020
## Description: This Lambda function Add Bucket in VPC S3 Endpoint Policy
#####################################################

from boto3 import resource, client
from logging import getLogger, info, error, debug
from os import environ
from botocore.exceptions import ClientError

hervekhg

data "aws_iam_policy_document" "lambda_policy_doc" {
  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "config:PutEvaluations",
    ]

hervekhg

###############################################
## Author : HKO
## Date: 16/02/2020
## Description: This Lambda function Add Bucket in VPC S3 Endpoint Policy
#####################################################

from boto3 import resource, client
from logging import getLogger, info, error, debug
from os import environ
from botocore.exceptions import ClientError