AWS Managed Service for Grafana (AMG) Terraform module

Version2.3.2

Upstream version 2.3.2

0 controls from CIS AWS Benchmark v1.4.0 requirements

Terraform Module Source

cisv140.compliance.tf/terraform-aws-modules/managed-service-grafana/aws

Compliance Inputs Outputs Resources Rules Diff (0)README

56 unique

Name	Type	Default	Description
Optional
account_access_type	string	"CURRENT_ACCOUNT"	The type of account access for the workspace. Valid values are `CURRENT_ACCOUNT` and `ORGANIZATION`
associate_license	bool	true	Determines whether a license will be associated with the workspace
authentication_providers	list(string)	["AWS_SSO"]	The authentication providers for the workspace. Valid values are `AWS_SSO`, `SAML`, or both
configuration	string	null	The configuration string for the workspace
create	bool	true	Determines whether a resources will be created
create_iam_role	bool	true	Determines whether a an IAM role is created or to use an existing IAM role
create_saml_configuration	bool	true	Determines whether the SAML configuration will be created
create_security_group	bool	true	Determines if a security group is created
create_workspace	bool	true	Determines whether a workspace will be created or to use an existing workspace
data_sources	list(string)	[]	The data sources for the workspace. Valid values are `AMAZON_OPENSEARCH_SERVICE`, `ATHENA`, `CLOUDWATCH`, `PROMETHEUS`, `REDSHIFT`, `SITEWISE`, `TIMESTREAM`, `XRAY`
description	string	null	The workspace description
enable_alerts	bool	false	Determines whether IAM permissions for alerting are enabled for the workspace IAM role
grafana_token	string	null	A token from Grafana Labs that ties your AWS account with a Grafana Labs account
grafana_version	string	null	Specifies the version of Grafana to support in the new workspace. If not specified, the default version for the `aws_grafana_workspace` resource will be used. See `aws_grafana_workspace` documentation for available options.
iam_role_arn	string	null	Existing IAM role ARN for the workspace. Required if `create_iam_role` is set to `false`
iam_role_description	string	null	The description of the workspace IAM role
iam_role_force_detach_policies	bool	true	Determines whether the workspace IAM role policies will be forced to detach
iam_role_max_session_duration	number	null	Maximum session duration (in seconds) that you want to set for the IAM role
iam_role_name	string	null	Name to use on workspace IAM role created
iam_role_path	string	null	Workspace IAM role path
iam_role_permissions_boundary	string	null	ARN of the policy that is used to set the permissions boundary for the IAM role
iam_role_policy_arns	list(string)	[]	List of ARNs of IAM policies to attach to the workspace IAM role
iam_role_tags	map(string)	{}	A map of additional tags to add to the IAM role created
license_type	string	"ENTERPRISE"	The type of license for the workspace license association. Valid values are `ENTERPRISE` and `ENTERPRISE_FREE_TRIAL`
name	string	null	The Grafana workspace name
network_access_control	any	{}	Configuration for network access to your workspace
notification_destinations	list(string)	[]	The notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to `SNS`
organization_role_name	string	null	The role name that the workspace uses to access resources through Amazon Organizations
organizational_units	list(string)	[]	The Amazon Organizations organizational units that the workspace is authorized to use data sources from
permission_type	string	"SERVICE_MANAGED"	The permission type of the workspace. If `SERVICE_MANAGED` is specified, the IAM roles and IAM policy attachments are generated automatically. If `CUSTOMER_MANAGED` is specified, the IAM roles and IAM policy attachments will not be created
role_associations	any	{}	Map of maps to assocaite user/group IDs to a role. Map key can be used as the `role`
saml_admin_role_values	list(string)	[]	SAML authentication admin role values
saml_allowed_organizations	list(string)	[]	SAML authentication allowed organizations
saml_editor_role_values	list(string)	[]	SAML authentication editor role values
saml_email_assertion	string	null	SAML authentication email assertion
saml_groups_assertion	string	null	SAML authentication groups assertion
saml_idp_metadata_url	string	null	SAML authentication IDP Metadata URL. Note that either `saml_idp_metadata_url` or `saml_idp_metadata_xml`
saml_idp_metadata_xml	string	null	SAML authentication IDP Metadata XML. Note that either `saml_idp_metadata_url` or `saml_idp_metadata_xml`
saml_login_assertion	string	null	SAML authentication email assertion
saml_login_validity_duration	number	null	SAML authentication login validity duration
saml_name_assertion	string	null	SAML authentication name assertion
saml_org_assertion	string	null	SAML authentication org assertion
saml_role_assertion	string	null	SAML authentication role assertion
security_group_description	string	null	Description of the security group created
security_group_name	string	null	Name to use on security group created
security_group_rules	any	{}	Security group rules to add to the security group created
security_group_tags	map(string)	{}	A map of additional tags to add to the security group created
security_group_use_name_prefix	bool	true	Determines whether the security group name (`security_group_name`) is used as a prefix
stack_set_name	string	null	The AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace
tags	map(string)	{}	A map of tags to add to all resources
use_iam_role_name_prefix	bool	true	Determines whether the IAM role name (`wokspace_iam_role_name`) is used as a prefix
vpc_configuration	any	{}	The configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to
workspace_api_keys	any	{}	Map of workspace API key definitions to create
workspace_id	string	""	The ID of an existing workspace to use when `create_workspace` is `false`
workspace_service_account_tokens	any	{}	Map of workspace service account tokens to create
workspace_service_accounts	any	{}	Map of workspace service account definitions to create