-
Notifications
You must be signed in to change notification settings - Fork 30
/
logs_monitoring_elb.tf
84 lines (73 loc) · 1.97 KB
/
logs_monitoring_elb.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# Make lambda function accept invokes from S3
resource "aws_lambda_permission" "allow-elblog-trigger" {
count = var.create_elb_logs_bucket ? 1 : 0
statement_id = "AllowExecutionFromELBLogBucket"
action = "lambda:InvokeFunction"
function_name = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
principal = "s3.amazonaws.com"
source_arn = aws_s3_bucket.elb_logs[0].arn
}
# Tell S3 bucket to invoke DD lambda once an object is created/modified
resource "aws_s3_bucket_notification" "elblog-notification-dd-log" {
count = var.create_elb_logs_bucket ? 1 : 0
bucket = aws_s3_bucket.elb_logs[0].id
lambda_function {
lambda_function_arn = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn
events = ["s3:ObjectCreated:*"]
}
}
data "aws_elb_service_account" "main" {}
locals {
elb_logs_s3_bucket = "${var.elb_logs_bucket_prefix}-${var.namespace}-${var.env}-elb-logs"
}
resource "aws_s3_bucket" "elb_logs" {
count = var.create_elb_logs_bucket ? 1 : 0
bucket = local.elb_logs_s3_bucket
acl = "private"
policy = <<POLICY
{
"Id": "Policy",
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:PutObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::${local.elb_logs_s3_bucket}/*",
"Principal": {
"AWS": [
"${data.aws_elb_service_account.main.arn}"
]
}
}
]
}
POLICY
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}
lifecycle_rule {
id = "log"
enabled = true
tags = {
"rule" = "log"
"autoclean" = "true"
}
transition {
days = 30
storage_class = "STANDARD_IA" # or "ONEZONE_IA"
}
transition {
days = 60
storage_class = "GLACIER"
}
expiration {
days = 365 # store logs for one year
}
}
}