corelight/terraform-aws-enrichment

GitHub: corelight/terraform-aws-enrichment

Corelight AWS Cloud Enrichment 的 Terraform 基础设施模块，用于自动化部署网络数据收集与增强所需的 AWS Serverless 资源。

Stars: 1 | Forks: 0

# ⚠️ 已弃用 — 此仓库已迁移 **新地址：** [`modules/aws/enrichment`](https://github.com/corelight/terraform/tree/main/modules/aws/enrichment) **请更新您的模块 `source`**（将 `` 替换为[发布标签](https://github.com/corelight/terraform/releases)，例如 `v29.0.5-5`）： ``` module "enrichment" { source = "github.com/corelight/terraform//modules/aws/enrichment?ref=" } ``` 请查看 [monorepo README](https://github.com/corelight/terraform#readme) 获取完整的模块列表。 [#](#) terraform-aws-enrichment ## 用法 ``` resource "aws_s3_bucket" "enrichment_bucket" { bucket = "corelight-enrichment" } module "enrichment_eventbridge_role" { source = "github.com/corelight/terraform-aws-enrichment//modules/iam/eventbridge" primary_event_bus_arn = module.enrichment.primary_event_bus_arn } module "enrichment_lambda_role" { source = "github.com/corelight/terraform-aws-enrichment//modules/iam/lambda" enrichment_bucket_arn = aws_s3_bucket.enrichment_bucket.arn enrichment_ecr_repository_arn = data.aws_ecr_repository.enrichment_repo.arn lambda_cloudwatch_log_group_arn = module.enrichment.cloudwatch_log_group_arn } module "enrichment" { source = "github.com/corelight/terraform-aws-enrichment" corelight_cloud_enrichment_image = "123456789111.dkr.ecr.us-east-1.amazonaws.com/corelight-sensor-enrichment-aws" corelight_cloud_enrichment_image_tag = "0.1.0" enrichment_bucket_name = aws_s3_bucket.enrichment_bucket.bucket eventbridge_iam_cross_region_role_arn = module.enrichment_eventbridge_role.cross_region_role_arn lambda_iam_role_arn = module.enrichment_lambda_role.lambda_iam_role_arn } ``` ## 准备工作 基于镜像的 Lambda 必须从私有 Elastic Container Registry (ECR) 仓库进行部署，因此必须将 Corelight 提供的数据收集无服务器容器镜像从 Dockerhub 复制并推送到您自己的 ECR 仓库。 #### 创建 ECR 仓库 (CLI) ``` aws ecr create-repository --repository-name corelight/sensor-enrichment-aws ``` #### 创建 ECR 仓库 (Terraform) ``` resource "aws_ecr_repository" "enrichemnt_repo" { name = "corelight/sensor-enrichment-aws" } ``` #### 复制 Corelight 镜像 登录 AWS 账户的镜像仓库 ``` aws ecr get-login-password --region | docker login \ --username AWS \ --password-stdin <[account id].dkr.ecr.[region].amazonaws.com> ``` 从 Dockerhub 拉取并将镜像推送到 ECR ``` AWS_ACCOUNT= AWS_REGION= ECR_REGISTRY="${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com" # 从 Dockerhub 拉取 CORELIGHT_REPO=corelight CORELIGHT_IMAGE_NAME=sensor-enrichment-aws CORELIGHT_IMAGE_TAG=0.1.1 # Dockerhub 镜像: corelight/sensor-enrichment-aws:0.1.1 SRC_IMAGE="$CORELIGHT_REPO/$CORELIGHT_IMAGE_NAME:$CORELIGHT_IMAGE_TAG" # ECR 目标: .dkr.ecr..amazonaws.com/corelight/sensor-enrichment-aws:0.1.1 DST_IMAGE="$ECR_REGISTRY/$CORELIGHT_REPO/$CORELIGHT_IMAGE_NAME:$CORELIGHT_IMAGE_TAG" # 拉取 Corelight 镜像 docker pull $SRC_IMAGE --platform linux/arm64 docker image tag $SRC_IMAGE $DST_IMAGE docker image push $DST_IMAGE --platform linux/arm64 ``` ## 部署 此模块的所有变量都具有默认值，可以根据您的命名和合规标准进行覆盖。 唯一没有默认值的变量是 Lambda 的 ECR 镜像名称和标签，您将在准备阶段进行设置。 部署示例可以在[此处][]找到。 ## 许可证 该项目基于 [MIT][] 许可证授权。