Adding ability to send multiple workspaces to the Azure sentinel role

[sylviamclaughlin]

Summary | Résumé

Fixes #324

Allows us to pass in multiple log analytics workspace ids to the Azure sentinel role. This is a temporary issue that we need to deal with since we are using 2 log workspaces to recreate the infrastructure in the new landing zone for the Sentinel connectors . Once we have recreated everything, we can move only to one workspace id.

I also removed the delay for the SQS queue since it was not necessary and updated the polling delay as well so in theory that should speed up the ingestion delay in Sentinel.

[github-actions]

Plan for org_account/main

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 2 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_iam_role.azure_sentinel
	aws_sqs_queue.cloudtrail_sqs_queue

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_role.azure_sentinel will be updated in-place
  ~ resource "aws_iam_role" "azure_sentinel" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          - "ForAnyValue:StringEquals" = {
                              - "sts:ExternalId" = [
                                  - "90ad7e41-b287-4d79-8c21-01f328f577b9",
                                  - "3774a838-caa6-4c0b-8b42-edabbc9d8fda",
                                ]
                            }
                          + StringEquals               = {
                              + "sts:ExternalId" = [
                                  + "90ad7e41-b287-4d79-8c21-01f328f577b9",
                                  + "3774a838-caa6-4c0b-8b42-edabbc9d8fda",
                                ]
                            }
                        }
                        # (4 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "AzureSentinelRole"
        name                  = "AzureSentinelRole"
        tags                  = {}
        # (10 unchanged attributes hidden)
    }

  # aws_sqs_queue.cloudtrail_sqs_queue will be updated in-place
  ~ resource "aws_sqs_queue" "cloudtrail_sqs_queue" {
      ~ delay_seconds                     = 90 -> 0
        id                                = "https://sqs.ca-central-1.amazonaws.com/274536870005/azure-sentinel-cloudtrail-queue"
        name                              = "azure-sentinel-cloudtrail-queue"
      ~ receive_wait_time_seconds         = 10 -> 5
        tags                              = {}
        # (11 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.publishing_bucket.aws_s3_bucket.this,
  on .terraform/modules/publishing_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_logging resource instead

(and 9 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.cds_sentinel_securityhub_rule"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.ct_list_controls"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.azure_sentinel"]
WARN - plan.json - main - Missing Common Tags: ["aws_kms_key.cds_sentinel_guard_duty_key"]
WARN - plan.json - main - Missing Common Tags: ["aws_sns_topic.critical"]
WARN - plan.json - main - Missing Common Tags: ["aws_sns_topic.warning"]
WARN - plan.json - main - Missing Common Tags: ["aws_sqs_queue.cloudtrail_sqs_queue"]
WARN - plan.json - main - Missing Common Tags: ["module.alarm_actions.aws_cloudwatch_metric_alarm.alarm_failure[\"Ops1\"]"]
WARN - plan.json - main - Missing Common Tags: ["module.alarm_actions.aws_cloudwatch_metric_alarm.alarm_failure[\"Ops2\"]"]
WARN - plan.json - main - Missing Common Tags: ["module.alarm_actions.aws_cloudwatch_metric_alarm.alarm_success[\"Ops1\"]"]
WARN - plan.json - main - Missing Common Tags: ["module.alarm_actions.aws_cloudwatch_metric_alarm.alarm_success[\"Ops2\"]"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_aft_management_detector.aws_guardduty_detector.ca_central_1"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_aft_management_detector.aws_guardduty_detector.us_east_1"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_aft_management_detector.aws_guardduty_detector.us_west_2"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_audit_detector.aws_guardduty_detector.ca_central_1"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_audit_detector.aws_guardduty_detector.us_east_1"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_audit_detector.aws_guardduty_detector.us_west_2"]
WARN - plan.json - main - Missing Common Tags: ["module.gd_log_archive_detector.aws_guardduty_detector.ca_central_1"]
WARN - plan.json - main - Missing Common Tags:...

[wanpengyang]

👍