Skip to content

Commit 1842707

Browse files
magreenbaumantonbabenko
magreenbaum
and
antonbabenko
authored
feat: Support aws_cloudwatch_log_account_policy (#71)
Co-authored-by: Anton Babenko <[email protected]>
1 parent 080a276 commit 1842707

File tree

57 files changed

+710
-52
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+710
-52
lines changed

‎README.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,23 @@ module "composite_alarm" {
207207
}
208208
```
209209

210+
### Log Account Policy
211+
212+
```hcl
213+
module "log_account_policy" {
214+
source = "terraform-aws-modules/cloudwatch/aws//modules/log-account-policy"
215+
version = "~> 4.0"
216+
217+
log_account_policy_name = "account-data-protection"
218+
log_account_policy_type = "DATA_PROTECTION_POLICY"
219+
create_log_data_protection_policy = true
220+
log_data_protection_policy_name = "redact-addresses"
221+
222+
data_identifiers = ["arn:aws:dataprotection::aws:data-identifier/Address"]
223+
findings_destination_cloudwatch_log_group = "my-cloudwatch-audit-log-group"
224+
}
225+
```
226+
210227
## Examples
211228

212229
- [Complete Cloudwatch log metric filter and alarm](https://github.com/terraform-aws-modules/terraform-aws-cloudwatch/tree/master/examples/complete-log-metric-filter-and-alarm)
@@ -217,6 +234,7 @@ module "composite_alarm" {
217234
- [Cloudwatch query definition](https://github.com/terraform-aws-modules/terraform-aws-cloudwatch/tree/master/examples/query-definition)
218235
- [Cloudwatch Metric Stream](https://github.com/terraform-aws-modules/terraform-aws-cloudwatch/tree/master/examples/metric-stream)
219236
- [Cloudwatch Composite Alarm](https://github.com/terraform-aws-modules/terraform-aws-cloudwatch/tree/master/examples/composite-alarm)
237+
- [Cloudwatch Log Account Policy](https://github.com/terraform-aws-modules/terraform-aws-cloudwatch/tree/master/examples/log-account-policy)
220238

221239
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
222240
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/cis-alarms/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Note that this example may create resources which cost money. Run `terraform des
2020
| Name | Version |
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.58 |
2424

2525
## Providers
2626

‎examples/cis-alarms/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.0"
7+
version = ">= 5.58"
88
}
99
}
1010
}

‎examples/complete-log-metric-filter-and-alarm/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Note that this example may create resources which cost money. Run `terraform des
2020
| Name | Version |
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.30 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.58 |
2424

2525
## Providers
2626

‎examples/complete-log-metric-filter-and-alarm/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.30"
7+
version = ">= 5.58"
88
}
99
}
1010
}

‎examples/composite-alarm/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Note that this example may create resources which cost money. Run `terraform des
2020
| Name | Version |
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.12 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.58 |
2424

2525
## Providers
2626

‎examples/composite-alarm/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.12"
7+
version = ">= 5.58"
88
}
99
}
1010
}

‎examples/fixtures/aws_cloudwatch_log_group/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.0"
7+
version = ">= 5.58"
88
}
99

1010
random = {

‎examples/fixtures/aws_kms_key/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.0"
7+
version = ">= 5.58"
88
}
99

1010
random = {

‎examples/fixtures/aws_lambda_function/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.0"
7+
version = ">= 5.58"
88
}
99

1010
random = {

‎examples/fixtures/aws_sns_topic/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.0"
7+
version = ">= 5.58"
88
}
99

1010
random = {

‎examples/lambda-metric-alarm/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Note that this example may create resources which cost money. Run `terraform des
2020
| Name | Version |
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.58 |
2424

2525
## Providers
2626

‎examples/lambda-metric-alarm/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.0"
7+
version = ">= 5.58"
88
}
99
}
1010
}

‎examples/log-account-policy/README.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Complete Cloudwatch log account policy
2+
3+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4+
## Requirements
5+
6+
| Name | Version |
7+
|------|---------|
8+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
9+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.58 |
10+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.5 |
11+
12+
## Providers
13+
14+
| Name | Version |
15+
|------|---------|
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.58 |
17+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.5 |
18+
19+
## Modules
20+
21+
| Name | Source | Version |
22+
|------|--------|---------|
23+
| <a name="module_audit_destination_group"></a> [audit\_destination\_group](#module\_audit\_destination\_group) | ../../modules/log-group | n/a |
24+
| <a name="module_cw_logs_to_firehose"></a> [cw\_logs\_to\_firehose](#module\_cw\_logs\_to\_firehose) | terraform-aws-modules/iam/aws//modules/iam-assumable-role | ~> 5.0 |
25+
| <a name="module_cw_logs_to_firehose_policy"></a> [cw\_logs\_to\_firehose\_policy](#module\_cw\_logs\_to\_firehose\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | ~> 5.0 |
26+
| <a name="module_excluded_log_group"></a> [excluded\_log\_group](#module\_excluded\_log\_group) | ../../modules/log-group | n/a |
27+
| <a name="module_firehose_to_s3"></a> [firehose\_to\_s3](#module\_firehose\_to\_s3) | terraform-aws-modules/iam/aws//modules/iam-assumable-role | ~> 5.0 |
28+
| <a name="module_firehose_to_s3_policy"></a> [firehose\_to\_s3\_policy](#module\_firehose\_to\_s3\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | ~> 5.0 |
29+
| <a name="module_log_account_data_retention_policy"></a> [log\_account\_data\_retention\_policy](#module\_log\_account\_data\_retention\_policy) | ../../modules/log-account-policy | n/a |
30+
| <a name="module_log_account_subscription_filter_policy"></a> [log\_account\_subscription\_filter\_policy](#module\_log\_account\_subscription\_filter\_policy) | ../../modules/log-account-policy | n/a |
31+
| <a name="module_log_group"></a> [log\_group](#module\_log\_group) | ../../modules/log-group | n/a |
32+
| <a name="module_logs_bucket"></a> [logs\_bucket](#module\_logs\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 4.0 |
33+
34+
## Resources
35+
36+
| Name | Type |
37+
|------|------|
38+
| [aws_kinesis_firehose_delivery_stream.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream) | resource |
39+
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
40+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
41+
| [aws_iam_policy_document.custom_trust_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
42+
| [aws_iam_policy_document.cw_logs_to_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
43+
| [aws_iam_policy_document.firehose_to_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
44+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
45+
46+
## Inputs
47+
48+
No inputs.
49+
50+
## Outputs
51+
52+
| Name | Description |
53+
|------|-------------|
54+
| <a name="output_log_account_data_retention_policy_name"></a> [log\_account\_data\_retention\_policy\_name](#output\_log\_account\_data\_retention\_policy\_name) | Name of Cloudwatch log account policy |
55+
| <a name="output_log_account_subscription_filter_retention_policy_name"></a> [log\_account\_subscription\_filter\_retention\_policy\_name](#output\_log\_account\_subscription\_filter\_retention\_policy\_name) | Name of Cloudwatch log account policy |
56+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/log-account-policy/main.tf

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
data "aws_region" "current" {}
6+
7+
data "aws_caller_identity" "current" {}
8+
9+
module "log_group" {
10+
source = "../../modules/log-group"
11+
12+
name_prefix = "my-log-group-"
13+
retention_in_days = 7
14+
}
15+
16+
module "excluded_log_group" {
17+
source = "../../modules/log-group"
18+
19+
name_prefix = "my-excluded-log-group-"
20+
retention_in_days = 7
21+
}
22+
23+
module "audit_destination_group" {
24+
source = "../../modules/log-group"
25+
26+
name_prefix = "audit-destination-log-group-"
27+
retention_in_days = 7
28+
}
29+
30+
module "log_account_data_retention_policy" {
31+
source = "../../modules/log-account-policy"
32+
33+
log_account_policy_name = "account-data-protection"
34+
log_account_policy_type = "DATA_PROTECTION_POLICY"
35+
36+
# custom data identifier not yet supported by the data source for aws_cloudwatch_log_data_protection_policy within the module
37+
# specify your own json policy document if this is needed using policy_document argument
38+
create_log_data_protection_policy = true
39+
log_data_protection_policy_name = "redact-addresses"
40+
41+
data_identifiers = ["arn:aws:dataprotection::aws:data-identifier/Address"]
42+
findings_destination_cloudwatch_log_group = module.audit_destination_group.cloudwatch_log_group_name
43+
}
44+
45+
# This example requires two terraform applies and will error on the first run due to firehose stream not in ACTIVE state even with depends_on set
46+
# Related: https://github.com/hashicorp/terraform-provider-aws/issues/17049
47+
module "log_account_subscription_filter_policy" {
48+
source = "../../modules/log-account-policy"
49+
50+
log_account_policy_name = "account-subscription-filter"
51+
log_account_policy_type = "SUBSCRIPTION_FILTER_POLICY"
52+
policy_document = jsonencode(
53+
{
54+
DestinationArn = aws_kinesis_firehose_delivery_stream.logs.arn
55+
FilterPattern = "%test%"
56+
RoleArn = module.cw_logs_to_firehose.iam_role_arn
57+
}
58+
)
59+
log_account_policy_selection_criteria = "LogGroupName NOT IN [\"${module.excluded_log_group.cloudwatch_log_group_name}\"]"
60+
61+
depends_on = [
62+
aws_kinesis_firehose_delivery_stream.logs,
63+
module.cw_logs_to_firehose,
64+
module.cw_logs_to_firehose_policy
65+
]
66+
}
67+
68+
################################################################################
69+
# Supporting Resources
70+
################################################################################
71+
72+
resource "random_pet" "this" {
73+
length = 2
74+
}
75+
76+
module "logs_bucket" {
77+
source = "terraform-aws-modules/s3-bucket/aws"
78+
version = "~> 4.0"
79+
80+
bucket_prefix = "${random_pet.this.id}-logs"
81+
82+
force_destroy = true
83+
}
84+
85+
resource "aws_kinesis_firehose_delivery_stream" "logs" {
86+
name = "${random_pet.this.id}-logs"
87+
destination = "extended_s3"
88+
89+
extended_s3_configuration {
90+
role_arn = module.firehose_to_s3.iam_role_arn
91+
bucket_arn = module.logs_bucket.s3_bucket_arn
92+
prefix = "from-firehose-logs/"
93+
}
94+
}
95+
96+
module "firehose_to_s3" {
97+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
98+
version = "~> 5.0"
99+
100+
trusted_role_services = [
101+
"firehose.amazonaws.com"
102+
]
103+
104+
create_role = true
105+
106+
role_name_prefix = "${random_pet.this.id}-firehose-to-s3-"
107+
role_requires_mfa = false
108+
109+
custom_role_policy_arns = [
110+
module.firehose_to_s3_policy.arn
111+
]
112+
}
113+
114+
module "firehose_to_s3_policy" {
115+
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
116+
version = "~> 5.0"
117+
118+
name = "${random_pet.this.id}-firehose-to-s3"
119+
path = "/"
120+
description = "Pipes logging firehose to s3 policy"
121+
122+
policy = data.aws_iam_policy_document.firehose_to_s3.json
123+
}
124+
125+
data "aws_iam_policy_document" "firehose_to_s3" {
126+
statement {
127+
effect = "Allow"
128+
129+
actions = [
130+
"s3:AbortMultipartUpload",
131+
"s3:GetBucketLocation",
132+
"s3:GetObject",
133+
"s3:ListBucket",
134+
"s3:ListBucketMultipartUploads",
135+
"s3:PutObject",
136+
]
137+
138+
resources = [
139+
module.logs_bucket.s3_bucket_arn,
140+
"${module.logs_bucket.s3_bucket_arn}/*",
141+
]
142+
}
143+
}
144+
145+
module "cw_logs_to_firehose" {
146+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
147+
version = "~> 5.0"
148+
149+
create_role = true
150+
151+
role_name_prefix = "${random_pet.this.id}-cw-logs-to-firehose-"
152+
role_requires_mfa = false
153+
create_custom_role_trust_policy = true
154+
custom_role_trust_policy = data.aws_iam_policy_document.custom_trust_policy.json
155+
156+
custom_role_policy_arns = [
157+
module.cw_logs_to_firehose_policy.arn
158+
]
159+
}
160+
161+
data "aws_iam_policy_document" "custom_trust_policy" {
162+
statement {
163+
effect = "Allow"
164+
actions = ["sts:AssumeRole"]
165+
166+
condition {
167+
test = "StringLike"
168+
variable = "aws:SourceArn"
169+
values = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:*"]
170+
}
171+
172+
principals {
173+
identifiers = ["logs.amazonaws.com"]
174+
type = "Service"
175+
}
176+
}
177+
}
178+
179+
module "cw_logs_to_firehose_policy" {
180+
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
181+
version = "~> 5.0"
182+
183+
name = "${random_pet.this.id}-cw-logs-to-firehose"
184+
path = "/"
185+
description = "Cloudwatch logs to firehose policy"
186+
187+
policy = data.aws_iam_policy_document.cw_logs_to_firehose.json
188+
}
189+
190+
data "aws_iam_policy_document" "cw_logs_to_firehose" {
191+
statement {
192+
effect = "Allow"
193+
194+
actions = [
195+
"firehose:PutRecord",
196+
]
197+
198+
resources = [
199+
aws_kinesis_firehose_delivery_stream.logs.arn,
200+
]
201+
}
202+
}

0 commit comments

Comments
 (0)