-
Notifications
You must be signed in to change notification settings - Fork 1
/
cloudwatch_to_firehose_role.tf
73 lines (61 loc) · 2.63 KB
/
cloudwatch_to_firehose_role.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# ------------------------------------------------------------------------------
# Provision the IAM resources that will allow CloudWatch to send log events to a
# Firehose delivery stream.
# ------------------------------------------------------------------------------
# Create an IAM policy document that allows CloudWatch to assume the role that
# this policy is attached to.
data "aws_iam_policy_document" "cloudwatch_assume_role" {
statement {
actions = [
"sts:AssumeRole",
"sts:TagSession",
]
effect = "Allow"
principals {
identifiers = ["logs.amazonaws.com"]
type = "Service"
}
}
}
# Create the IAM role that CloudWatch will assume to deliver log events to the
# Firehose delivery stream.
resource "aws_iam_role" "cloudwatch_to_firehose" {
provider = aws.sharedservicesprovisionaccount
assume_role_policy = data.aws_iam_policy_document.cloudwatch_assume_role.json
description = var.cloudwatch_to_firehose_role_description
name = var.cloudwatch_to_firehose_role_name
}
# Create an IAM policy document that allows CloudWatch to write to the Firehose
# delivery stream.
data "aws_iam_policy_document" "cloudwatch_to_firehose" {
statement {
actions = [
"firehose:PutRecord",
"firehose:PutRecordBatch",
]
effect = "Allow"
# This policy is a dependency of the role used by CloudWatch to deliver log
# events to the Firehose stream and that role is an input to the Firehose
# stream resource. Therefore, this policy must be created before the
# Firehose stream resource is created, which is why the Firehose stream ARN
# below must be constructed manually.
resources = [
"arn:aws:firehose:${var.aws_region}:${local.sharedservices_account_id}:deliverystream/${var.firehose_delivery_stream_name}",
]
}
}
# Create the policy that allows CloudWatch to write to the Firehose delivery
# stream to the role that CloudWatch will assume in order to accomplish that.
resource "aws_iam_policy" "cloudwatch_to_firehose" {
provider = aws.sharedservicesprovisionaccount
description = var.cloudwatch_to_firehose_role_description
name = var.cloudwatch_to_firehose_role_name
policy = data.aws_iam_policy_document.cloudwatch_to_firehose.json
}
# Attach the policy that allows CloudWatch to write to the Firehose delivery
# stream to the role that CloudWatch will assume in order to accomplish that.
resource "aws_iam_role_policy_attachment" "cloudwatch_to_firehose" {
provider = aws.sharedservicesprovisionaccount
policy_arn = aws_iam_policy.cloudwatch_to_firehose.arn
role = aws_iam_role.cloudwatch_to_firehose.name
}