forked from tothenew/terraform-aws-vpc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
vpc-flow-logs.tf
87 lines (74 loc) · 3.18 KB
/
vpc-flow-logs.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
################################################################################
# Flow Log
################################################################################
resource "aws_flow_log" "flow_log" {
count = var.enable_flow_log ? 1 : 0
log_destination_type = var.flow_log_destination_type
log_destination = aws_cloudwatch_log_group.flow_log[0].arn
log_format = var.flow_log_log_format
iam_role_arn = aws_iam_role.vpc_flow_log_cloudwatch[0].arn
traffic_type = var.flow_log_traffic_type
vpc_id = module.vpc_main.vpc_id
max_aggregation_interval = var.flow_log_max_aggregation_interval
tags = merge(local.common_tags, tomap({
"Name" : "${local.project_name_prefix}-vpc-flow-log"
}))
}
################################################################################
# Flow Log CloudWatch
################################################################################
resource "aws_cloudwatch_log_group" "flow_log" {
count = var.flow_log_destination_type == "cloud-watch-logs" && var.enable_flow_log ? 1 : 0
name = "${local.project_name_prefix}-vpc-flow-log"
retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
tags = merge(local.common_tags, tomap({
"Name" : "${local.project_name_prefix}-vpc-flow-log"
}))
}
resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
count = var.flow_log_destination_type == "cloud-watch-logs" && var.enable_flow_log ? 1 : 0
name = "${local.project_name_prefix}-vpc-flow-log"
assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
tags = merge(local.common_tags, tomap({
"Name" : "${local.project_name_prefix}-vpc-flow-log"
}))
}
data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
count = var.flow_log_destination_type == "cloud-watch-logs" && var.enable_flow_log ? 1 : 0
statement {
sid = "AWSVPCFlowLogsAssumeRole"
principals {
type = "Service"
identifiers = ["vpc-flow-logs.amazonaws.com"]
}
effect = "Allow"
actions = ["sts:AssumeRole"]
}
}
resource "aws_iam_role_policy_attachment" "vpc_flow_log_cloudwatch" {
count = var.flow_log_destination_type == "cloud-watch-logs" && var.enable_flow_log ? 1 : 0
role = aws_iam_role.vpc_flow_log_cloudwatch[0].name
policy_arn = aws_iam_policy.vpc_flow_log_cloudwatch[0].arn
}
resource "aws_iam_policy" "vpc_flow_log_cloudwatch" {
count = var.flow_log_destination_type == "cloud-watch-logs" && var.enable_flow_log ? 1 : 0
name = "${local.project_name_prefix}-vpc-flow-log"
policy = data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json
tags = merge(local.common_tags, tomap({
"Name" : "${local.project_name_prefix}-vpc-flow-log"
}))
}
data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
count = var.flow_log_destination_type == "cloud-watch-logs" && var.enable_flow_log ? 1 : 0
statement {
sid = "AWSVPCFlowLogsPushToCloudWatch"
effect = "Allow"
actions = [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
]
resources = ["*"]
}
}