[new modules] Add AWS Security Hub

Add Terraform modules for the AWS security hub data streams.

.changelog/49.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+Generate Terraform modules for the aws.securityhub Fleet integration.
+```

Makefile

@@ -43,6 +43,9 @@ fleet-modules: install
 		"log/*/*" \
 		"sql/*/*" \
 		"winlog/*/*"
+	# Ignore shadowing for these packages. See https://github.com/elastic/integrations/issues/6148.
+	fleet-terraform-generator generate batch --packages-dir ../integrations/packages --ignore-var-shadow --out . \
+		"aws/securityhub/*/*"
 
 .PHONY: install
 install:

fleet_integration/aws.securityhub.securityhub_findings.httpjson/README.md

@@ -0,0 +1,53 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_fleet_package_policy"></a> [fleet\_package\_policy](#module\_fleet\_package\_policy) | ../../fleet_package_policy | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_access_key_id"></a> [access\_key\_id](#input\_access\_key\_id) | n/a | `string` | `null` | no |
+| <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | AWS Region. | `string` | n/a | yes |
+| <a name="input_credential_profile_name"></a> [credential\_profile\_name](#input\_credential\_profile\_name) | n/a | `string` | `null` | no |
+| <a name="input_default_region"></a> [default\_region](#input\_default\_region) | Default region to use prior to connecting to region specific services/endpoints if no AWS region is set from environment variable, credentials or instance profile. If none of the above are set and no default region is set as well, `us-east-1` is used. A region, either from environment variable, credentials or instance profile or from this default region setting, needs to be set when using regions in non-regular AWS environments such as AWS China or US Government Isolated. | `string` | `""` | no |
+| <a name="input_enable_request_tracer"></a> [enable\_request\_tracer](#input\_enable\_request\_tracer) | The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. | `bool` | `null` | no |
+| <a name="input_fleet_agent_policy_id"></a> [fleet\_agent\_policy\_id](#input\_fleet\_agent\_policy\_id) | Agent policy ID to add the package policy to. | `string` | n/a | yes |
+| <a name="input_fleet_data_stream_namespace"></a> [fleet\_data\_stream\_namespace](#input\_fleet\_data\_stream\_namespace) | Namespace to use for the data stream. | `string` | `"default"` | no |
+| <a name="input_fleet_package_policy_description"></a> [fleet\_package\_policy\_description](#input\_fleet\_package\_policy\_description) | Description to use for the package policy. | `string` | `""` | no |
+| <a name="input_fleet_package_policy_name_suffix"></a> [fleet\_package\_policy\_name\_suffix](#input\_fleet\_package\_policy\_name\_suffix) | Suffix to append to the end of the package policy name. | `string` | `""` | no |
+| <a name="input_fleet_package_version"></a> [fleet\_package\_version](#input\_fleet\_package\_version) | Version of the aws package to use. | `string` | `"2.23.0"` | no |
+| <a name="input_initial_interval"></a> [initial\_interval](#input\_initial\_interval) | How far back to pull the AWS Security Hub Findings from AWS. (Initial Interval should be greater than 1 hour.) | `string` | `"24h"` | no |
+| <a name="input_interval"></a> [interval](#input\_interval) | Interval to fetch AWS Security Hub Findings from AWS. (Interval should be greater than 1 hour.) | `string` | `"1h"` | no |
+| <a name="input_preserve_duplicate_custom_fields"></a> [preserve\_duplicate\_custom\_fields](#input\_preserve\_duplicate\_custom\_fields) | Preserve aws.security\_findings fields that were copied to Elastic Common Schema (ECS) fields. | `bool` | `false` | no |
+| <a name="input_preserve_original_event"></a> [preserve\_original\_event](#input\_preserve\_original\_event) | Preserves a raw copy of the original event, added to the field `event.original`. | `bool` | `false` | no |
+| <a name="input_processors_yaml"></a> [processors\_yaml](#input\_processors\_yaml) | Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. | `string` | `null` | no |
+| <a name="input_proxy_url"></a> [proxy\_url](#input\_proxy\_url) | URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format. | `string` | `null` | no |
+| <a name="input_role_arn"></a> [role\_arn](#input\_role\_arn) | n/a | `string` | `null` | no |
+| <a name="input_secret_access_key"></a> [secret\_access\_key](#input\_secret\_access\_key) | n/a | `string` | `null` | no |
+| <a name="input_session_token"></a> [session\_token](#input\_session\_token) | n/a | `string` | `null` | no |
+| <a name="input_shared_credential_file"></a> [shared\_credential\_file](#input\_shared\_credential\_file) | Directory of the shared credentials file | `string` | `null` | no |
+| <a name="input_ssl_yaml"></a> [ssl\_yaml](#input\_ssl\_yaml) | i.e. certificate\_authorities, supported\_protocols, verification\_mode etc. | `string` | `"#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n"` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | n/a | `list(string)` | <pre>[<br>  "forwarded",<br>  "aws_securityhub_findings"<br>]</pre> | no |
+| <a name="input_tld"></a> [tld](#input\_tld) | n/a | `string` | `"amazonaws.com"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_id"></a> [id](#output\_id) | Package policy ID |
+<!-- END_TF_DOCS -->

fleet_integration/aws.securityhub.securityhub_findings.httpjson/module.tf.json

@@ -0,0 +1,202 @@
+{
+  "//": "Generated by fleet-terraform-generator - DO NOT EDIT",
+  "variable": {
+    "access_key_id": {
+      "type": "string",
+      "default": null,
+      "sensitive": true
+    },
+    "aws_region": {
+      "type": "string",
+      "description": "AWS Region.",
+      "nullable": false
+    },
+    "credential_profile_name": {
+      "type": "string",
+      "default": null
+    },
+    "default_region": {
+      "type": "string",
+      "description": "Default region to use prior to connecting to region specific services/endpoints if no AWS region is set from environment variable, credentials or instance profile. If none of the above are set and no default region is set as well, `us-east-1` is used. A region, either from environment variable, credentials or instance profile or from this default region setting, needs to be set when using regions in non-regular AWS environments such as AWS China or US Government Isolated.",
+      "default": ""
+    },
+    "enable_request_tracer": {
+      "type": "bool",
+      "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.",
+      "default": null
+    },
+    "fleet_agent_policy_id": {
+      "type": "string",
+      "description": "Agent policy ID to add the package policy to."
+    },
+    "fleet_data_stream_namespace": {
+      "type": "string",
+      "description": "Namespace to use for the data stream.",
+      "default": "default"
+    },
+    "fleet_package_policy_description": {
+      "type": "string",
+      "description": "Description to use for the package policy.",
+      "default": ""
+    },
+    "fleet_package_policy_name_suffix": {
+      "type": "string",
+      "description": "Suffix to append to the end of the package policy name.",
+      "default": ""
+    },
+    "fleet_package_version": {
+      "type": "string",
+      "description": "Version of the aws package to use.",
+      "default": "2.23.0"
+    },
+    "initial_interval": {
+      "type": "string",
+      "description": "How far back to pull the AWS Security Hub Findings from AWS. (Initial Interval should be greater than 1 hour.)",
+      "default": "24h",
+      "nullable": false
+    },
+    "interval": {
+      "type": "string",
+      "description": "Interval to fetch AWS Security Hub Findings from AWS. (Interval should be greater than 1 hour.)",
+      "default": "1h",
+      "nullable": false
+    },
+    "preserve_duplicate_custom_fields": {
+      "type": "bool",
+      "description": "Preserve aws.security_findings fields that were copied to Elastic Common Schema (ECS) fields.",
+      "default": false,
+      "nullable": false
+    },
+    "preserve_original_event": {
+      "type": "bool",
+      "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
+      "default": false,
+      "nullable": false
+    },
+    "processors_yaml": {
+      "type": "string",
+      "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
+      "default": null
+    },
+    "proxy_url": {
+      "type": "string",
+      "description": "URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.",
+      "default": null
+    },
+    "role_arn": {
+      "type": "string",
+      "default": null
+    },
+    "secret_access_key": {
+      "type": "string",
+      "default": null,
+      "sensitive": true
+    },
+    "session_token": {
+      "type": "string",
+      "default": null,
+      "sensitive": true
+    },
+    "shared_credential_file": {
+      "type": "string",
+      "description": "Directory of the shared credentials file",
+      "default": null
+    },
+    "ssl_yaml": {
+      "type": "string",
+      "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc.",
+      "default": "#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n"
+    },
+    "tags": {
+      "type": "list(string)",
+      "default": [
+        "forwarded",
+        "aws_securityhub_findings"
+      ],
+      "nullable": false
+    },
+    "tld": {
+      "type": "string",
+      "default": "amazonaws.com",
+      "nullable": false
+    }
+  },
+  "output": {
+    "id": {
+      "description": "Package policy ID",
+      "value": "${module.fleet_package_policy.id}"
+    }
+  },
+  "module": {
+    "fleet_package_policy": {
+      "agent_policy_id": "${var.fleet_agent_policy_id}",
+      "all_data_streams": [
+        "securityhub_findings",
+        "securityhub_insights"
+      ],
+      "all_policy_template_inputs": [
+        "awshealth-aws/metrics",
+        "billing-aws/metrics",
+        "cloudtrail-aws-s3",
+        "cloudtrail-aws-cloudwatch",
+        "cloudtrail-httpjson",
+        "cloudwatch-aws-cloudwatch",
+        "cloudwatch-aws/metrics",
+        "dynamodb-aws/metrics",
+        "ebs-aws/metrics",
+        "ec2-aws-s3",
+        "ec2-aws-cloudwatch",
+        "ec2-aws/metrics",
+        "ecs-aws/metrics",
+        "elb-aws-s3",
+        "elb-aws-cloudwatch",
+        "elb-aws/metrics",
+        "lambda-aws/metrics",
+        "natgateway-aws/metrics",
+        "firewall-aws-s3",
+        "firewall-aws-cloudwatch",
+        "firewall-aws/metrics",
+        "rds-aws/metrics",
+        "s3-aws-s3",
+        "s3-aws/metrics",
+        "s3_storage_lens-aws/metrics",
+        "sns-aws/metrics",
+        "sqs-aws/metrics",
+        "transitgateway-aws/metrics",
+        "usage-aws/metrics",
+        "vpcflow-aws-s3",
+        "vpcflow-aws-cloudwatch",
+        "vpn-aws/metrics",
+        "waf-aws-s3",
+        "waf-aws-cloudwatch",
+        "route53-aws-cloudwatch",
+        "route53-aws-s3",
+        "cloudfront-aws-s3",
+        "redshift-aws/metrics",
+        "kinesis-aws/metrics",
+        "securityhub-httpjson",
+        "inspector-httpjson",
+        "guardduty-httpjson",
+        "guardduty-aws-s3",
+        "apigateway-aws/metrics",
+        "apigateway-aws-s3",
+        "apigateway-aws-cloudwatch",
+        "emr-aws/metrics",
+        "emr-aws-s3",
+        "emr-aws-cloudwatch",
+        "kafka-aws/metrics"
+      ],
+      "data_stream": "securityhub_findings",
+      "data_stream_variables_json": "${jsonencode({\n  aws_region = var.aws_region\n  enable_request_tracer = var.enable_request_tracer\n  initial_interval = var.initial_interval\n  interval = var.interval\n  preserve_duplicate_custom_fields = var.preserve_duplicate_custom_fields\n  preserve_original_event = var.preserve_original_event\n  processors = var.processors_yaml\n  proxy_url = var.proxy_url\n  ssl = var.ssl_yaml\n  tags = var.tags\n  tld = var.tld\n})}",
+      "description": "${var.fleet_package_policy_description}",
+      "input_type": "httpjson",
+      "namespace": "${var.fleet_data_stream_namespace}",
+      "package_name": "aws",
+      "package_policy_name": "aws-securityhub_findings-${var.fleet_data_stream_namespace}${var.fleet_package_policy_name_suffix}",
+      "package_variables_json": "${jsonencode({\n  access_key_id = var.access_key_id\n  credential_profile_name = var.credential_profile_name\n  default_region = var.default_region\n  proxy_url = var.proxy_url\n  role_arn = var.role_arn\n  secret_access_key = var.secret_access_key\n  session_token = var.session_token\n  shared_credential_file = var.shared_credential_file\n})}",
+      "package_version": "${var.fleet_package_version}",
+      "policy_template": "securityhub",
+      "source": "../../fleet_package_policy"
+    }
+  }
+}