diff --git a/connector/terraform/README.md b/connector/terraform/README.md
index fcc8bc3..649f1e0 100644
--- a/connector/terraform/README.md
+++ b/connector/terraform/README.md
@@ -106,23 +106,23 @@ No resources.
## Inputs
-| Name | Description | Type | Default | Required |
-| ------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | :------: |
-| [disable_customer_managed_iam_policies](#input_disable_customer_managed_iam_policies) | If this is set to `false` (or omitted), then the stack will create
additional customer-managed IAM policies that you can attach to your
IAM identities to grant them direct access to the Elastio Connector stack.
This way you can use elastio CLI directly to list Elastio scan jobs or
submit new scan jobs. Set this to `true` if you don't need these policies. | `bool` | `null` | no |
-| [ecr_public_prefix](#input_ecr_public_prefix) | Repository prefix for the ECR Public registry. Used to configure a pull-through
cache for elastio images that are downloaded from ECR Public. You can configure
your own cache via ECR private, and then specify the repository prefix here.
This field supports 'account_id' and 'region' interpolation.
For example, such value can be provided:
'{{account\_id}}.dkr.ecr.{{region}}.amazonaws.com/ecr-public' | `string` | `null` | no |
-| [elastio_cloud_connectors](#input_elastio_cloud_connectors) | List of regions where Cloud Connectors are to be deployed, VPC and subnet(s) to use,
and other regional configurations (mostly for regulatory compliance). | list(object({
region = string
# Should not be set if `network_configuration`
# is set to `Auto` (which is the default)
vpc_id = optional(string)
subnet_ids = optional(list(string))
s3_access_logging = optional(object({
target_bucket = string
target_prefix = optional(string)
# Can be one of the following:
# - SimplePrefix
# - PartitionedPrefix:EventTime
# - PartitionedPrefix:DeliveryTime
target_object_key_format = optional(string)
}))
})) | n/a | yes |
-| [elastio_nat_provision_stack](#input_elastio_nat_provision_stack) | Specifies the version of Elastio NAT provision stack to deploy (e.g. `v5`).
This is a CloudFormation stack that automatically provisions NAT Gateways in
your VPC when Elastio worker instances run to provide them with the outbound
Internet access when Elastio is deployed in private subnets.
If you don't need this stack (e.g. you already have NAT gateways in your VPC
or you deploy into public subnets) you can omit this parameter. The default
value of `null` means there won't be any NAT provision stack deployed.
The source code of this stack can be found here:
https://github.com/elastio/contrib/tree/master/elastio-nat-provision-lambda | `string` | `null` | no |
-| [elastio_pat](#input_elastio_pat) | Personal Access Token generated by the Elastio Portal | `string` | n/a | yes |
-| [elastio_tenant](#input_elastio_tenant) | Name of your Elastio tenant. For example `mycompany.app.elastio.com` | `string` | n/a | yes |
-| [encrypt_with_cmk](#input_encrypt_with_cmk) | Provision additional customer-managed KMS keys to encrypt
Lambda environment variables, DynamoDB tables, S3. Note that
by default data is encrypted with AWS-managed keys.
Enable this option only if your compliance requirements mandate the usage of CMKs.
If this option is disabled Elastio creates only 1 CMK per region where
the Elastio Connector stack is deployed. If this option is enabled then
Elastio creates 1 KMS key per AWS account and 2 KMS keys per every AWS
region where Elastio is deployed in your AWS account.
If you have `elastio_nat_provision_stack` enabled as well, then 1 more KMS key
will be created as part of that stack as well (for a total of 3 KMS keys per region). | `bool` | `null` | no |
-| [global_managed_policies](#input_global_managed_policies) | List of IAM managed policies ARNs to attach to all Elastio IAM roles | `set(string)` | `null` | no |
-| [global_permission_boundary](#input_global_permission_boundary) | The ARN of the IAM managed policy to use as a permission boundary for all Elastio IAM roles | `string` | `null` | no |
-| [iam_resource_names_prefix](#input_iam_resource_names_prefix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
-| [iam_resource_names_static](#input_iam_resource_names_static) | If enabled, the stack will use static resource names without random characters in them.
This parameter is set to `true` by default, and it shouldn't be changed. The older
versions of Elastio stack used random names generated by CloudFormation for IAM
resources, which is inconvenient to work with. New deployments that use the terraform
automation should have this set to `true` for easier management of IAM resources. | `bool` | `true` | no |
-| [iam_resource_names_suffix](#input_iam_resource_names_suffix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
-| [lambda_tracing](#input_lambda_tracing) | Enable AWS X-Ray tracing for Lambda functions. This increases the cost of
the stack. Enable only if needed | `bool` | `null` | no |
-| [network_configuration](#input_network_configuration) | Can be set to either `Auto` or `Manual`. If set to `Auto`, Elastio will
automatically create a VPC and subnets in the specified regions for the
scan clusters to run in.
If set to `Manual`, you must provide the VPC ID and subnet IDs in the
`elastio_cloud_connectors` with the network config for each region. | `string` | `"Auto"` | no |
-| [service_linked_roles](#input_service_linked_roles) | By default the CFN stack creates the service-linked IAM roles needed by the stack.
Since these are global in your account, they can't be defined as regular resources
in the CFN, because these roles may already exist in your account and thus
the deployment would fail on a name conflict.
Instead, by default, they are deployed using an AWS::CloudFormation::CustomResource
which invokes an AWS Lambda function that creates the service-linked roles only if
they don't exist and doesn't fail if they do.
The default approach of creating the service-linked roles via the CFN requires
creating a lambda function in your environment that has IAM write permission of
`iam:CreateServiceLinkedRole`. If you can't afford creating such a lambda function
then set this parameter to `tf` and this terraform module will create the
service-linked roles without the need for a lambda function.
If you set this to `tf`, then make sure you have the AWS CLI installed and
configured with the necessary credentials on the machine where you run terraform. | `string` | `"cfn"` | no |
+| Name | Description | Type | Default | Required |
+| ------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | :------: |
+| [disable_customer_managed_iam_policies](#input_disable_customer_managed_iam_policies) | If this is set to `false` (or omitted), then the stack will create
additional customer-managed IAM policies that you can attach to your
IAM identities to grant them direct access to the Elastio Connector stack.
This way you can use elastio CLI directly to list Elastio scan jobs or
submit new scan jobs. Set this to `true` if you don't need these policies. | `bool` | `null` | no |
+| [ecr_public_prefix](#input_ecr_public_prefix) | Repository prefix for the ECR Public registry. Used to configure a pull-through
cache for elastio images that are downloaded from ECR Public. You can configure
your own cache via ECR private, and then specify the repository prefix here.
This field supports 'account_id' and 'region' interpolation.
For example, such value can be provided:
'{{account\_id}}.dkr.ecr.{{region}}.amazonaws.com/ecr-public' | `string` | `null` | no |
+| [elastio_cloud_connectors](#input_elastio_cloud_connectors) | List of regions where Cloud Connectors are to be deployed, VPC and subnet(s) to use,
and other regional configurations (mostly for regulatory compliance). | list(object({
region = string
# Should not be set if `network_configuration`
# is set to `Auto` (which is the default)
vpc_id = optional(string)
subnet_ids = optional(list(string))
s3_access_logging = optional(object({
target_bucket = string
target_prefix = optional(string)
# Can be one of the following:
# - SimplePrefix
# - PartitionedPrefix:EventTime
# - PartitionedPrefix:DeliveryTime
target_object_key_format = optional(string)
}))
})) | n/a | yes |
+| [elastio_nat_provision_stack](#input_elastio_nat_provision_stack) | Specifies the version of Elastio NAT provision stack to deploy (e.g. `v5`).
This is a CloudFormation stack that automatically provisions NAT Gateways in
your VPC when Elastio worker instances run to provide them with the outbound
Internet access when Elastio is deployed in private subnets.
If you don't need this stack (e.g. you already have NAT gateways in your VPC
or you deploy into public subnets) you can omit this parameter. The default
value of `null` means there won't be any NAT provision stack deployed.
The source code of this stack can be found here:
https://github.com/elastio/contrib/tree/master/elastio-nat-provision-lambda | `string` | `null` | no |
+| [elastio_pat](#input_elastio_pat) | Personal Access Token generated by the Elastio Portal | `string` | n/a | yes |
+| [elastio_tenant](#input_elastio_tenant) | Name of your Elastio tenant. For example `mycompany.app.elastio.com` | `string` | n/a | yes |
+| [encrypt_with_cmk](#input_encrypt_with_cmk) | Provision additional customer-managed KMS keys to encrypt
Lambda environment variables, DynamoDB tables, S3. Note that
by default data is encrypted with AWS-managed keys.
Enable this option only if your compliance requirements mandate the usage of CMKs.
If this option is disabled Elastio creates only 1 CMK per region where
the Elastio Connector stack is deployed. If this option is enabled then
Elastio creates 1 KMS key per AWS account and 2 KMS keys per every AWS
region where Elastio is deployed in your AWS account.
If you have `elastio_nat_provision_stack` enabled as well, then 1 more KMS key
will be created as part of that stack as well (for a total of 3 KMS keys per region). | `bool` | `null` | no |
+| [global_managed_policies](#input_global_managed_policies) | List of IAM managed policies ARNs to attach to all Elastio IAM roles | `set(string)` | `null` | no |
+| [global_permission_boundary](#input_global_permission_boundary) | The ARN of the IAM managed policy to use as a permission boundary for all Elastio IAM roles | `string` | `null` | no |
+| [iam_resource_names_prefix](#input_iam_resource_names_prefix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
+| [iam_resource_names_static](#input_iam_resource_names_static) | If enabled, the stack will use static resource names without random characters in them.
This parameter is set to `true` by default, and it shouldn't be changed. The older
versions of Elastio stack used random names generated by CloudFormation for IAM
resources, which is inconvenient to work with. New deployments that use the terraform
automation should have this set to `true` for easier management of IAM resources. | `bool` | `true` | no |
+| [iam_resource_names_suffix](#input_iam_resource_names_suffix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
+| [lambda_tracing](#input_lambda_tracing) | Enable AWS X-Ray tracing for Lambda functions. This increases the cost of
the stack. Enable only if needed | `bool` | `null` | no |
+| [network_configuration](#input_network_configuration) | Can be set to either `Auto` or `Manual`. If set to `Auto`, Elastio will
automatically create a VPC and subnets in the specified regions for the
scan clusters to run in.
If set to `Manual`, you must provide the VPC ID and subnet IDs in the
`elastio_cloud_connectors` with the network config for each region. | `string` | `"Manual"` | no |
+| [service_linked_roles](#input_service_linked_roles) | By default the CFN stack creates the service-linked IAM roles needed by the stack.
Since these are global in your account, they can't be defined as regular resources
in the CFN, because these roles may already exist in your account and thus
the deployment would fail on a name conflict.
Instead, by default, they are deployed using an AWS::CloudFormation::CustomResource
which invokes an AWS Lambda function that creates the service-linked roles only if
they don't exist and doesn't fail if they do.
The default approach of creating the service-linked roles via the CFN requires
creating a lambda function in your environment that has IAM write permission of
`iam:CreateServiceLinkedRole`. If you can't afford creating such a lambda function
then set this parameter to `tf` and this terraform module will create the
service-linked roles without the need for a lambda function.
If you set this to `tf`, then make sure you have the AWS CLI installed and
configured with the necessary credentials on the machine where you run terraform. | `string` | `"cfn"` | no |
## Outputs
diff --git a/connector/terraform/examples/advanced/main.tf b/connector/terraform/examples/advanced/main.tf
index 8bbddd3..a1fed04 100644
--- a/connector/terraform/examples/advanced/main.tf
+++ b/connector/terraform/examples/advanced/main.tf
@@ -4,6 +4,8 @@ module "elastio_connectors" {
elastio_tenant = var.elastio_tenant
elastio_pat = var.elastio_pat
+ network_configuration = "Auto"
+
elastio_cloud_connectors = [
{
region = "us-east-1"
diff --git a/connector/terraform/examples/basic/main.tf b/connector/terraform/examples/basic/main.tf
index 62c974b..f8a93fa 100644
--- a/connector/terraform/examples/basic/main.tf
+++ b/connector/terraform/examples/basic/main.tf
@@ -4,6 +4,8 @@ module "elastio_connectors" {
elastio_tenant = var.elastio_tenant
elastio_pat = var.elastio_pat
+ network_configuration = "Auto"
+
elastio_cloud_connectors = [
{
region = "us-east-1"
diff --git a/connector/terraform/modules/account/README.md b/connector/terraform/modules/account/README.md
index 9c76c77..223ea16 100644
--- a/connector/terraform/modules/account/README.md
+++ b/connector/terraform/modules/account/README.md
@@ -49,22 +49,22 @@ No modules.
## Inputs
-| Name | Description | Type | Default | Required |
-| ------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | :------: |
-| [disable_customer_managed_iam_policies](#input_disable_customer_managed_iam_policies) | If this is set to `false` (or omitted), then the stack will create
additional customer-managed IAM policies that you can attach to your
IAM identities to grant them direct access to the Elastio Connector stack.
This way you can use elastio CLI directly to list Elastio scan jobs or
submit new scan jobs. Set this to `true` if you don't need these policies. | `bool` | `null` | no |
-| [ecr_public_prefix](#input_ecr_public_prefix) | Repository prefix for the ECR Public registry. Used to configure a pull-through
cache for elastio images that are downloaded from ECR Public. You can configure
your own cache via ECR private, and then specify the repository prefix here.
This field supports 'account_id' and 'region' interpolation.
For example, such value can be provided:
'{{account\_id}}.dkr.ecr.{{region}}.amazonaws.com/ecr-public' | `string` | `null` | no |
-| [elastio_pat](#input_elastio_pat) | Personal Access Token generated by the Elastio Portal | `string` | n/a | yes |
-| [elastio_tenant](#input_elastio_tenant) | Name of your Elastio tenant. For example `mycompany.app.elastio.com` | `string` | n/a | yes |
-| [encrypt_with_cmk](#input_encrypt_with_cmk) | Provision additional customer-managed KMS keys to encrypt
Lambda environment variables, DynamoDB tables, S3. Note that
by default data is encrypted with AWS-managed keys.
Enable this option only if your compliance requirements mandate the usage of CMKs.
If this option is disabled Elastio creates only 1 CMK per region where
the Elastio Connector stack is deployed. If this option is enabled then
Elastio creates 1 KMS key per AWS account and 2 KMS keys per every AWS
region where Elastio is deployed in your AWS account.
If you have `elastio_nat_provision_stack` enabled as well, then 1 more KMS key
will be created as part of that stack as well (for a total of 3 KMS keys per region). | `bool` | `null` | no |
-| [global_managed_policies](#input_global_managed_policies) | List of IAM managed policies ARNs to attach to all Elastio IAM roles | `set(string)` | `null` | no |
-| [global_permission_boundary](#input_global_permission_boundary) | The ARN of the IAM managed policy to use as a permission boundary for all Elastio IAM roles | `string` | `null` | no |
-| [iam_resource_names_prefix](#input_iam_resource_names_prefix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
-| [iam_resource_names_static](#input_iam_resource_names_static) | If enabled, the stack will use static resource names without random characters in them.
This parameter is set to `true` by default, and it shouldn't be changed. The older
versions of Elastio stack used random names generated by CloudFormation for IAM
resources, which is inconvenient to work with. New deployments that use the terraform
automation should have this set to `true` for easier management of IAM resources. | `bool` | `true` | no |
-| [iam_resource_names_suffix](#input_iam_resource_names_suffix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
-| [lambda_tracing](#input_lambda_tracing) | Enable AWS X-Ray tracing for Lambda functions. This increases the cost of
the stack. Enable only if needed | `bool` | `null` | no |
-| [network_configuration](#input_network_configuration) | Can be set to either `Auto` or `Manual`. If set to `Auto`, Elastio will
automatically create a VPC and subnets in the specified regions for the
scan clusters to run in.
If set to `Manual`, you must provide the `vpc_id` and `subnet_ids` in the
`region` module with the network config for each region. | `string` | `"Auto"` | no |
-| [regional_configs](#input_regional_configs) | Regional configurations for connectors (mostly for regulatory compliance). | list(object({
region = string
s3_access_logging = optional(object({
target_bucket = string
target_prefix = optional(string)
# Can be one of the following:
# - SimplePrefix
# - PartitionedPrefix:EventTime
# - PartitionedPrefix:DeliveryTime
target_object_key_format = optional(string)
}))
})) | `[]` | no |
-| [service_linked_roles](#input_service_linked_roles) | By default the CFN stack creates the service-linked IAM roles needed by the stack.
Since these are global in your account, they can't be defined as regular resources
in the CFN, because these roles may already exist in your account and thus
the deployment would fail on a name conflict.
Instead, by default, they are deployed using an AWS::CloudFormation::CustomResource
which invokes an AWS Lambda function that creates the service-linked roles only if
they don't exist and doesn't fail if they do.
The default approach of creating the service-linked roles via the CFN requires
creating a lambda function in your environment that has IAM write permission of
`iam:CreateServiceLinkedRole`. If you can't afford creating such a lambda function
then set this parameter to `tf` and this terraform module will create the
service-linked roles without the need for a lambda function.
If you set this to `tf`, then make sure you have the AWS CLI installed and
configured with the necessary credentials on the machine where you run terraform. | `string` | `"cfn"` | no |
+| Name | Description | Type | Default | Required |
+| ------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | :------: |
+| [disable_customer_managed_iam_policies](#input_disable_customer_managed_iam_policies) | If this is set to `false` (or omitted), then the stack will create
additional customer-managed IAM policies that you can attach to your
IAM identities to grant them direct access to the Elastio Connector stack.
This way you can use elastio CLI directly to list Elastio scan jobs or
submit new scan jobs. Set this to `true` if you don't need these policies. | `bool` | `null` | no |
+| [ecr_public_prefix](#input_ecr_public_prefix) | Repository prefix for the ECR Public registry. Used to configure a pull-through
cache for elastio images that are downloaded from ECR Public. You can configure
your own cache via ECR private, and then specify the repository prefix here.
This field supports 'account_id' and 'region' interpolation.
For example, such value can be provided:
'{{account\_id}}.dkr.ecr.{{region}}.amazonaws.com/ecr-public' | `string` | `null` | no |
+| [elastio_pat](#input_elastio_pat) | Personal Access Token generated by the Elastio Portal | `string` | n/a | yes |
+| [elastio_tenant](#input_elastio_tenant) | Name of your Elastio tenant. For example `mycompany.app.elastio.com` | `string` | n/a | yes |
+| [encrypt_with_cmk](#input_encrypt_with_cmk) | Provision additional customer-managed KMS keys to encrypt
Lambda environment variables, DynamoDB tables, S3. Note that
by default data is encrypted with AWS-managed keys.
Enable this option only if your compliance requirements mandate the usage of CMKs.
If this option is disabled Elastio creates only 1 CMK per region where
the Elastio Connector stack is deployed. If this option is enabled then
Elastio creates 1 KMS key per AWS account and 2 KMS keys per every AWS
region where Elastio is deployed in your AWS account.
If you have `elastio_nat_provision_stack` enabled as well, then 1 more KMS key
will be created as part of that stack as well (for a total of 3 KMS keys per region). | `bool` | `null` | no |
+| [global_managed_policies](#input_global_managed_policies) | List of IAM managed policies ARNs to attach to all Elastio IAM roles | `set(string)` | `null` | no |
+| [global_permission_boundary](#input_global_permission_boundary) | The ARN of the IAM managed policy to use as a permission boundary for all Elastio IAM roles | `string` | `null` | no |
+| [iam_resource_names_prefix](#input_iam_resource_names_prefix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
+| [iam_resource_names_static](#input_iam_resource_names_static) | If enabled, the stack will use static resource names without random characters in them.
This parameter is set to `true` by default, and it shouldn't be changed. The older
versions of Elastio stack used random names generated by CloudFormation for IAM
resources, which is inconvenient to work with. New deployments that use the terraform
automation should have this set to `true` for easier management of IAM resources. | `bool` | `true` | no |
+| [iam_resource_names_suffix](#input_iam_resource_names_suffix) | Add a custom prefix to names of all IAM resources deployed by this stack.
The sum of the length of the prefix and suffix must not exceed 14 characters. | `string` | `null` | no |
+| [lambda_tracing](#input_lambda_tracing) | Enable AWS X-Ray tracing for Lambda functions. This increases the cost of
the stack. Enable only if needed | `bool` | `null` | no |
+| [network_configuration](#input_network_configuration) | Can be set to either `Auto` or `Manual`. If set to `Auto`, Elastio will
automatically create a VPC and subnets in the specified regions for the
scan clusters to run in.
If set to `Manual`, you must provide the `vpc_id` and `subnet_ids` in the
`region` module with the network config for each region. | `string` | `"Manual"` | no |
+| [regional_configs](#input_regional_configs) | Regional configurations for connectors (mostly for regulatory compliance). | list(object({
region = string
s3_access_logging = optional(object({
target_bucket = string
target_prefix = optional(string)
# Can be one of the following:
# - SimplePrefix
# - PartitionedPrefix:EventTime
# - PartitionedPrefix:DeliveryTime
target_object_key_format = optional(string)
}))
})) | `[]` | no |
+| [service_linked_roles](#input_service_linked_roles) | By default the CFN stack creates the service-linked IAM roles needed by the stack.
Since these are global in your account, they can't be defined as regular resources
in the CFN, because these roles may already exist in your account and thus
the deployment would fail on a name conflict.
Instead, by default, they are deployed using an AWS::CloudFormation::CustomResource
which invokes an AWS Lambda function that creates the service-linked roles only if
they don't exist and doesn't fail if they do.
The default approach of creating the service-linked roles via the CFN requires
creating a lambda function in your environment that has IAM write permission of
`iam:CreateServiceLinkedRole`. If you can't afford creating such a lambda function
then set this parameter to `tf` and this terraform module will create the
service-linked roles without the need for a lambda function.
If you set this to `tf`, then make sure you have the AWS CLI installed and
configured with the necessary credentials on the machine where you run terraform. | `string` | `"cfn"` | no |
## Outputs
diff --git a/connector/terraform/modules/account/variables.tf b/connector/terraform/modules/account/variables.tf
index 93976d3..b5467b9 100644
--- a/connector/terraform/modules/account/variables.tf
+++ b/connector/terraform/modules/account/variables.tf
@@ -54,7 +54,7 @@ variable "network_configuration" {
DESCR
type = string
- default = "Auto"
+ default = "Manual"
nullable = false
validation {
diff --git a/connector/terraform/variables.tf b/connector/terraform/variables.tf
index 9a9bc46..178c446 100644
--- a/connector/terraform/variables.tf
+++ b/connector/terraform/variables.tf
@@ -59,7 +59,7 @@ variable "network_configuration" {
DESCR
type = string
- default = "Auto"
+ default = "Manual"
nullable = false
validation {