AWS CLI script variables

AWS script variables.

Required variables

The script for adding an AWS environment uses the following variables:

Variable

Description

EXTERNAL _ID

Specify this for the assumed role that Sophos Cloud Optix uses when acting on your behalf. It is added in the trust policy of the read-only role that Sophos Cloud Optix creates in your environment.

CUSTOMER_ID

The Customer UUID used for all uploads and connections.

REQUEST_ID

The self-generated ID used to validate the account addition request and associate the callback from the environment for linking the account added.

The REQUEST_ID keeps refreshing and is valid for 7 days to allow multiple environments to be added from within a customer account via scripting.

DNS_PREFIX_FLOW

The customer specific prefix that allows connection back to the appropriate collector node in the Sophos Cloud Optix backend for flowlogs.

DNS_PREFIX_CLOUDTRAIL

The customer specific prefix that allows connection back to the appropriate collector node in the Sophos Cloud Optix backend for CloudTrial logs.

Optional variables

Optionally, the script can also use the following variables if they are specified:

Variable

Default

Description

OPTIX_RESOURCE_KEY

created_by

Key used to tag all resources.

OPTIX_RESOURCE_VALUE

optix

Value used to tag all resources.

CLOUDTRAIL_BUCKET_NAME

Sophos-Optix-$USERACCOUNT

Name of S3 bucket used to export CloudTrail. Specify to use an existing bucket for CloudTrail export.

CLOUDTRAIL_BUCKET_FOLDER

Sophos-Optix-cloudtrail

Name of the S3 bucket folder used to export CloudTrail.

CLOUDTRAIL_SNS_TOPIC

Sophos-Optix-cloudtrail-s3-sns-topic

Name of SNS used to export CloudTrail.

CLOUDTRAIL_S3_RETENTION

365

Number of days to retain logs in CloudTrail bucket. Older logs are deleted.

SET_RETENTION_ON_S3_CLOUDTRAIL

1

Set to 1 to turn on retention in CloudTrail bucket, 0 to turn off.

FLOW_LOGS_S3_RETENTION

1

Number of days to retain logs in flow log bucket. Older logs are deleted.

SET_RETENTION_ON_S3_FLOW

1

Set to 1 to turn on retention of flow log bucket, 0 to turn off.

ENABLE_SPEND_MONITORING

true

enable spend monitoring or not

AWS_DEFAULT_REGION

us-west-1

Default region where all resources that are specific to single regions are created, when adding environments. Per-region resources are not affected.

FLOW_LOGS

1

Set to 1 to turn on VPC flow logs, 0 to turn off.

CLOUDTRAIL_LOGS

1

Set to 1 to turn CloudTrail on, 0 to turn off.

USE_EXISTING_TRAIL_SETUP

null

Set to true only if you want to use your existing trail and have followed the steps in Using an existing AWS CloudTrail.

ENABLE_FLOW_ONE_REGION

0

Set to 1 for flow logs to be exported to single S3 bucket, 0 to turn off.

FLOW_ONE_REGION_VALUE

null

Specify a region for flow logs to be exported to a single S3 in a region different to the default region.

FLOWLOG_REGIONS

null

Specify a list of regions for which flow logs should be turned on, if you do not want to turn it on in all regions.

FLOW_LOG_SINGLE_OPT_OUT

OptInRegions=ap-east-1,eu-south-1,me-south-1,af-south-1

The opt-in regions are ignored by default. If you want to add environments to any of these regions, remove those regions from the input parameters. For example, to add environments from af-south-1, use FLOW_LOG_SINGLE_OPT_OUT="OptInRegions-ap-east-1,eu-south-1,me-south-1 in your command.