NRL-1188 Add reporting bucket to firehose policy

Author: jackleary

terraform/infrastructure/modules/firehose/cloudwatch.tf

@@ -7,3 +7,13 @@ resource "aws_cloudwatch_log_stream" "firehose" {
   name           = "${var.prefix}-firehose"
   log_group_name = aws_cloudwatch_log_group.firehose.name
 }
+
+resource "aws_cloudwatch_log_group" "firehose_reporting" {
+  name              = "/aws/kinesisfirehose/${var.prefix}-firehose-reporting"
+  retention_in_days = local.cloudwatch.retention.days
+}
+
+resource "aws_cloudwatch_log_stream" "firehose_reporting" {
+  name           = "${var.prefix}-firehose-reporting"
+  log_group_name = aws_cloudwatch_log_group.firehose_reporting.name
+}

terraform/infrastructure/modules/firehose/iam_firehose.tf

@@ -30,6 +30,8 @@ data "aws_iam_policy_document" "firehose" {
     resources = [
       aws_s3_bucket.firehose.arn,
       "${aws_s3_bucket.firehose.arn}/*",
+      var.reporting_bucket_arn,
+      "${var.reporting_bucket_arn}/*",
     ]
     effect = "Allow"
   }

terraform/infrastructure/modules/firehose/kinesis.tf

@@ -66,22 +66,13 @@ resource "aws_kinesis_firehose_delivery_stream" "reporting_stream" {
     bucket_arn = var.reporting_bucket_arn
 
     processing_configuration {
-      enabled = "true"
-
-      processors {
-        type = "CloudWatchLogProcessing"
-
-        parameters {
-          parameter_name  = "DataMessageExtraction"
-          parameter_value = "true"
-        }
-      }
+      enabled = "false"
     }
 
     cloudwatch_logging_options {
       enabled         = true
-      log_group_name  = aws_cloudwatch_log_group.firehose.name
-      log_stream_name = aws_cloudwatch_log_stream.firehose.name
+      log_group_name  = aws_cloudwatch_log_group.firehose_reporting.name
+      log_stream_name = aws_cloudwatch_log_stream.firehose_reporting.name
     }
   }
 }