fix(firewall): add both log destinations for all

- When selecting the all option two log destinations should be created one for the flow logs and one for the alert logs
hamlet-io · Sep 20, 2023 · 51d02cf · 51d02cf
1 parent 4f4f3c3
commit 51d02cf
Show file tree

Hide file tree

Showing 3 changed files with 99 additions and 26 deletions.
diff --git a/aws/components/firewall/setup.ftl b/aws/components/firewall/setup.ftl
@@ -142,19 +142,19 @@
                 [#break]
         [/#switch]
 
-        [#local logType = ""]
+        [#local logTypes = []]
         [#switch solution.Logging.Events]
             [#case "all"]
-                [#local logType = "flow"]
+                [#local logTypes = ["flow", "alert"]]
                 [#break]
 
             [#case "alert-only"]
-                [#local logType = "alert"]
+                [#local logTypes = ["alert"]]
                 [#break]
         [/#switch]
 
         [#local logConfig = getNetworkFirewallLoggingConfiguration(
-                                logType,
+                                logTypes,
                                 solution.Logging.DestinationType,
                                 loggingDestinationId,
                                 loggingS3Prefix)]

diff --git a/aws/services/networkfirewall/resource.ftl b/aws/services/networkfirewall/resource.ftl
@@ -172,7 +172,7 @@
     /]
 [/#macro]
 
-[#function getNetworkFirewallLoggingConfiguration logType destinationType destinationId s3Prefix ]
+[#function getNetworkFirewallLoggingConfiguration logTypes destinationType destinationId s3Prefix ]
 
     [#local logDestination = {}]
 
@@ -205,28 +205,38 @@
             /]
     [/#switch]
 
-    [#switch logType?upper_case ]
-        [#case "FLOW"]
-        [#case "ALERT"]
-            [#local logType = logType?upper_case]
-            [#break]
+    [#local result = []]
 
-        [#default]
-            [@fatal
-                message="Invalid network firewall log type"
-                context={
-                    "provided" : logType
-                }
-            /]
-    [/#switch]
+    [#list logTypes as logType ]
+        [#switch logType?upper_case ]
+            [#case "FLOW"]
+            [#case "ALERT"]
+                [#local logType = logType?upper_case]
+                [#break]
 
-    [#return
-        {
-            "LogDestinationType" : destinationType,
-            "LogType" : logType,
-            "LogDestination" : logDestination
-        }
-    ]
+            [#default]
+                [@fatal
+                    message="Invalid network firewall log type"
+                    context={
+                        "provided" : logType
+                    }
+                /]
+        [/#switch]
+
+        [#local result = combineEntities(
+                result,
+                [
+                    {
+                        "LogDestinationType" : destinationType,
+                        "LogType" : logType?upper_case,
+                        "LogDestination" : logDestination
+                    }
+                ],
+                APPEND_COMBINE_BEHAVIOUR
+            )]
+    [/#list]
+
+    [#return result ]
 [/#function]
 
 [#macro createNetworkFirewallLogging id
@@ -239,7 +249,7 @@
         properties={
             "FirewallArn" : getArn(firewallId),
             "LoggingConfiguration" : {
-                "LogDestinationConfigs" : asArray(logDestinationConfigs)
+                "LogDestinationConfigs" : logDestinationConfigs
             }
         }
         outputs=AWS_NETWORK_FIREWALL_LOGGING_OUTPUT_MAPPINGS

diff --git a/awstest/modules/firewall/module.ftl b/awstest/modules/firewall/module.ftl
@@ -74,6 +74,69 @@
         }
     /]
 
+    [#-- flowlogs --]
+    [@loadModule
+        blueprint={
+            "Tiers" : {
+                "mgmt" : {
+                    "Components" : {
+                        "firewalllogs" : {
+                            "Type": "firewall",
+                            "deployment:Unit" : "aws-firewall",
+                            "Profiles" : {
+                                "Testing" : ["firewalllogs"]
+                            },
+                            "Logging": {
+                                "Events": "all"
+                            },
+                            "Engine" : "network",
+                            "Rules" : {
+                                "default" : {
+                                    "Action" : "drop",
+                                    "Priority" : "default",
+                                    "Inspection" : "Stateless"
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "TestCases" : {
+                "firewalllogs" : {
+                    "OutputSuffix" : "template.json",
+                    "Structural" : {
+                        "CFN" : {
+                            "Resource" : {
+                                "loggingConfig" : {
+                                    "Name" : "networkfirewallloggingXmgmtXfirewalllogs",
+                                    "Type" : "AWS::NetworkFirewall::LoggingConfiguration"
+                                }
+                            }
+                        },
+                        "JSON" : {
+                            "Length" : {
+                                "LogDestinations" : {
+                                    "Path": "Resources.networkfirewallloggingXmgmtXfirewalllogs.Properties.LoggingConfiguration.LogDestinationConfigs",
+                                    "Count": 2
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "TestProfiles" : {
+                "firewalllogs" : {
+                    "firewall" : {
+                        "TestCases" : [ "firewalllogs" ]
+                    },
+                    "*" : {
+                        "TestCases" : [ "_cfn-lint" ]
+                    }
+                }
+            }
+        }
+    /]
+
     [#-- Simple Network rule --]
     [@loadModule
         blueprint={