Merge pull request #8 from clouddrove/feat/org

feat: feature organization setup

_example/example.tf

@@ -9,15 +9,25 @@ module "security-hub" {
   security_hub_enabled = true
 
   #member account add
-  enable_member_account = true
-  member_account_id     = "123344847783"
-  member_mail_id        = "[email protected]"
+  member_details = [
+    {
+      account_id = "1122334466"
+      mail_id    = "[email protected]"
+      invite     = true
+    },
+    {
+      account_id = "1122334455"
+      mail_id    = "[email protected]"
+      invite     = true
+    }
+  ]
 
   #standards 
   enabled_standards = [
     "standards/aws-foundational-security-best-practices/v/1.0.0",
     "ruleset/cis-aws-foundations-benchmark/v/1.2.0"
   ]
+
   #products
   enabled_products = [
     "product/aws/guardduty",

main.tf

@@ -14,7 +14,10 @@ locals {
 }
 
 resource "aws_securityhub_account" "security_hub" {
-  count = var.security_hub_enabled && var.enable ? 1 : 0
+  count                     = var.security_hub_enabled && var.enable ? 1 : 0
+  enable_default_standards  = var.enable_default_standards
+  control_finding_generator = var.control_finding_generator
+  auto_enable_controls      = var.auto_enable_controls
 }
 
 resource "aws_securityhub_standards_subscription" "standards" {
@@ -31,10 +34,12 @@ resource "aws_securityhub_product_subscription" "products" {
 
 # To enable add member account to security-hub. 
 resource "aws_securityhub_member" "example" {
-  count = var.enable_member_account && var.enable ? 1 : 0
+  for_each   = { for member in var.member_details : member.account_id => member }
+  account_id = each.value.account_id
+  email      = each.value.mail_id
+  invite     = each.value.invite
 
-  depends_on = [aws_securityhub_account.security_hub]
-  account_id = var.member_account_id
-  email      = var.member_mail_id
-  invite     = true
+  depends_on = [
+    aws_securityhub_account.security_hub
+  ]
 }

variables.tf

@@ -1,3 +1,33 @@
+variable "enable_default_standards" {
+  description = "Flag to indicate whether default standards should be enabled"
+  type        = bool
+  default     = true
+}
+
+variable "control_finding_generator" {
+  description = <<-DOC
+    Updates whether the calling account has consolidated control findings turned on. 
+    If the value for this field is set to SECURITY_CONTROL, 
+    Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. 
+    If the value for this field is set to STANDARD_CONTROL, 
+    Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. 
+    For accounts that are part of an organization, 
+    this value can only be updated in the administrator account.
+  DOC
+  type        = string
+  default     = null
+}
+
+variable "auto_enable_controls" {
+  description = <<-DOC
+    Whether to automatically enable new controls when they are added to standards that are enabled. 
+    By default, this is set to true, and new controls are enabled automatically. 
+    To not automatically enable new controls, set this to false.
+  DOC
+  type        = bool
+  default     = true
+}
+
 variable "enabled_standards" {
   description = <<-DOC
     The possible values are:
@@ -25,25 +55,14 @@ variable "security_hub_enabled" {
   default     = true
   description = "To Enable seucirty-hub in aws account"
 }
-variable "member_account_id" {
-  type        = string
-  default     = ""
-  description = "The ID of the member AWS account."
-}
-
-variable "member_mail_id" {
-  type        = string
-  default     = ""
-  description = "The email of the member AWS account."
-}
-
-variable "enable_member_account" {
-  type        = bool
-  default     = false
-  description = "To create member account "
-
-
 
+variable "member_details" {
+  type = list(object({
+    account_id = string
+    mail_id    = string
+    invite     = bool
+  }))
+  default = []
 }
 
 variable "enable" {
@@ -53,7 +72,6 @@ variable "enable" {
 }
 
 variable "name" {
-  type = string
+  type    = string
   default = ""
-
 }