moved cloudwatch into its respective modules

infrastructure/modules/api_gateway/cloudwatch.tf

@@ -4,6 +4,11 @@ resource "aws_cloudwatch_log_group" "api_gateway" {
   tags              = var.tags
   kms_key_id        = aws_kms_key.api_gateway.arn
 
+  depends_on = [
+    aws_kms_key.api_gateway,
+    aws_kms_key_policy.api_gateway
+  ]
+
   lifecycle {
     prevent_destroy = false
   }

infrastructure/modules/kinesis_firehose/cloudwatch.tf

@@ -0,0 +1,26 @@
+# CloudWatch Log Group for Kinesis
+
+resource "aws_cloudwatch_log_group" "firehose_audit" {
+  name              = "/aws/kinesisfirehose/${var.project_name}-${var.environment}-audit"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.firehose_cmk.arn
+
+  tags = {
+    Name  = "kinesis-firehose-logs"
+    Stack = var.stack_name
+  }
+
+  depends_on = [
+    aws_kms_key.firehose_cmk,
+    aws_kms_key_policy.firehose_key_policy
+  ]
+}
+
+resource "aws_cloudwatch_log_stream" "firehose_audit_stream" {
+  name           = "audit_stream_log"
+  log_group_name = aws_cloudwatch_log_group.firehose_audit.name
+
+  depends_on = [
+    aws_cloudwatch_log_group.firehose_audit
+  ]
+}

infrastructure/modules/kinesis_firehose/kinesis_firehose_delivery_stream.tf

@@ -14,8 +14,8 @@ resource "aws_kinesis_firehose_delivery_stream" "eligibility_audit_firehose_deli
 
     cloudwatch_logging_options {
       enabled         = true
-      log_group_name  = var.kinesis_cloud_watch_log_group_name
-      log_stream_name = var.kinesis_cloud_watch_log_stream
+      log_group_name  = aws_cloudwatch_log_group.firehose_audit.name
+      log_stream_name = aws_cloudwatch_log_stream.firehose_audit_stream.name
     }
   }
 

infrastructure/modules/kinesis_firehose/variables.tf

@@ -13,16 +13,6 @@ variable "s3_audit_bucket_arn" {
   type        = string
 }
 
-variable "kinesis_cloud_watch_log_group_name" {
-  description = "kinesis cloud watch log group name"
-  type        = string
-}
-
-variable "kinesis_cloud_watch_log_stream" {
-  description = "kinesis cloud watch log stream"
-  type        = string
-}
-
 variable "eligibility_lambda_role_arn" {
   description = "iam role of eligibility lambda"
   type        = any

infrastructure/modules/lambda/cloudwatch.tf

@@ -0,0 +1,11 @@
+# CloudWatch Log Group for lambda Flow Logs
+resource "aws_cloudwatch_log_group" "lambda_logs" {
+  name              = "/aws/lambda/${aws_lambda_function.eligibility_signposting_lambda.id}"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.lambda_cmk.arn
+
+  tags = {
+    Name  = "lambda-execution-logs"
+    Stack = var.stack_name
+  }
+}

infrastructure/stacks/api-layer/kinesis_firehose.tf

@@ -7,7 +7,5 @@ module "eligibility_audit_firehose_delivery_stream" {
   stack_name                          = local.stack_name
   workspace                           = local.workspace
   tags                                = local.tags
-  kinesis_cloud_watch_log_group_name  = aws_cloudwatch_log_group.firehose_audit.name
-  kinesis_cloud_watch_log_stream      = aws_cloudwatch_log_stream.firehose_audit_stream.name
   eligibility_lambda_role_arn            = aws_iam_role.eligibility_lambda_role.arn
 }

infrastructure/stacks/api-layer/truststore_s3_bucket.tf

@@ -56,10 +56,17 @@ resource "aws_s3_object" "pem_file" {
 
   acl = "private"
 
+  override_provider {
+    default_tags {
+      tags = {}
+    }
+  }
+
   # Explicitly set empty tags to override default_tags due to S3 object 10-tag limit
   tags = {}
 
   lifecycle {
     ignore_changes = [tags_all]
   }
+
 }