AWS SecurityLake Terraform聚合区域配置疑问及实现咨询

核心问题澄清 #

Terraform的aws_securitylake_data_lake完全支持多区域数据聚合到指定区域，不需要通过replication_configuration，而是通过主聚合区域的configuration块定义贡献区域，同时在每个贡献区域单独启用SecurityLake并配置数据流向主区域。

关键参数说明 #

• region：指定当前Terraform资源部署的AWS区域，即要启用SecurityLake的区域（主聚合区或贡献区均适用）。
• configuration：在主聚合区域的资源中，通过该块定义所有向该区域贡献数据的区域列表，同时配置数据加密、生命周期等规则。

符合GDPR要求的多区域聚合代码示例 #

1. 定义欧盟区域列表 #

将需要纳入聚合的欧盟区域定义为变量：

variable "eu_regions" {
  type    = list(string)
  default = [
    "eu-west-1",
    "eu-west-2",
    "eu-west-3",
    "eu-central-1",
    "eu-north-1",
    "eu-south-1",
    "eu-south-2"
  ]
}

variable "primary_aggregation_region" {
  type    = string
  default = "eu-west-1"
}

2. 主聚合区域（eu-west-1）配置 #

在主区域配置SecurityLake，接收所有欧盟区域的数据，同时启用GDPR要求的加密规则：

provider "aws" {
  region = var.primary_aggregation_region
}

resource "aws_kms_key" "securitylake" {
  description         = "KMS密钥用于SecurityLake数据加密（符合GDPR要求）"
  enable_key_rotation = true
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "securitylake.amazonaws.com"
        }
        Action = [
          "kms:GenerateDataKey",
          "kms:Decrypt"
        ]
        Resource = "*"
      }
    ]
  })
}

resource "aws_securitylake_data_lake" "primary" {
  region = var.primary_aggregation_region

  configuration {
    encryption_configuration {
      kms_key_id = aws_kms_key.securitylake.arn
    }

    lifecycle_configuration {
      expiration_days = 365 # 可根据GDPR数据保留要求调整
    }

    regions = [for region in var.eu_regions : region if region != var.primary_aggregation_region]
  }
}

3. 欧盟贡献区域配置 #

遍历所有欧盟区域，在每个贡献区域部署SecurityLake并配置数据流向主聚合区：

provider "aws" {
  alias  = "contributor"
  region = each.value
}

resource "aws_securitylake_data_lake" "contributor" {
  for_each = { for region in var.eu_regions : region => region if region != var.primary_aggregation_region }

  provider = aws.contributor

  region = each.value

  replication_configuration {
    region     = var.primary_aggregation_region
    role_arn   = aws_iam_role.securitylake_replication[each.value].arn
  }
}

resource "aws_iam_role" "securitylake_replication" {
  for_each = { for region in var.eu_regions : region => region if region != var.primary_aggregation_region }

  name = "securitylake-replication-role-${each.value}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "securitylake.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "securitylake_replication" {
  for_each = { for region in var.eu_regions : region => region if region != var.primary_aggregation_region }

  role       = aws_iam_role.securitylake_replication[each.value].name
  policy_arn = "arn:aws:iam::aws:policy/AwsSecurityLakeReplicationRolePolicy"
}

GDPR合规关键要点 #

• 数据加密：全程使用KMS密钥加密静态数据，启用密钥自动轮换。
• 数据保留：通过lifecycle_configuration设置符合GDPR要求的保留期限，避免冗余数据存储。
• 区域限制：所有数据仅在欧盟区域内聚合、存储，不流向非欧盟AWS区域。
• 权限最小化：复制角色仅使用AWS托管的最小权限策略AwsSecurityLakeReplicationRolePolicy。

内容的提问来源于stack exchange，提问作者dobbs