Adds support for monitoring IAM access

[fernandogoncalves-me]

This PR adds the capability of monitoring the activity of the root user and any other IAM User or IAM Role.

The main purpose of this change is to monitor when users with privileged access interact with our accounts. The CloudWatch Rule pattern will look for both Console and API activity.

For the core accounts, the root user will be automatically monitored and all activities will be reported to the topic LandingZone-MonitorIAMAccess in the audit account.

For the avm created accounts, the monitoring is optional and can be enabled by passing the ARN of SNS Topic that should receive notifications. If enabled, the root user of the account will also be automatically monitored.

[github-actions]

Terraform Security Scan Failed

Show Output

Problem 1

  [AWS016][ERROR] Resource 'aws_sns_topic.monitor_iam_access' defines an unencrypted SNS topic.
  /github/workspace/audit.tf:48-50

      45 |   }
      46 | }
      47 | 
      48 | resource "aws_sns_topic" "monitor_iam_access" {
      49 |   name = "LandingZone-MonitorIAMAccess"
      50 | }
      51 | 
      52 | resource "aws_sns_topic_policy" "monitor_iam_access" {
      53 |   arn    = aws_sns_topic.monitor_iam_access.arn

  See https://tfsec.dev/docs/aws/AWS016/ for more information.

  disk i/o             6.746145ms
  parsing HCL          57.102µs
  evaluating values    7.38436ms
  running checks       959.721µs
  files loaded         12

1 potential problems detected.

[shoekstra]

Looks really great @fgoncalves-io, have a minor q regarding casing in an SNS topic name but otherwise ready to go I think!

[shoekstra]

If we're going to capitalise certain letters shouldn't we do it the whole string, e.g.

Suggested change

	name = "aws-controltower-AllConfigNotifications"
	name = "AWS-ControlTower-AllConfigNotifications"

What do you think?

[fernandogoncalves-me]

This is how AWS creates the Control Tower SNS Topics...I also think it's a bit strange but I believe there isn't much we can do...

[shoekstra]

Ah fair enough, if it's inline with other resources then all is good 👍