Fix: [AEA-5895] - forward vpc logs to CSOC (#606)

## Summary

- Routine Change

### Details

- forward vpc logs to CSOC

Author: anthony-nhs

.github/scripts/fix_cdk_json.sh

@@ -47,3 +47,4 @@ fix_string_key versionNumber "${VERSION_NUMBER}"
 fix_string_key commitId "${COMMIT_ID}"
 fix_string_key cfnDriftDetectionGroup "${CFN_DRIFT_DETECTION_GROUP}"
 fix_boolean_number_key logRetentionInDays "${LOG_RETENTION_IN_DAYS}"
+fix_boolean_number_key forwardCsocLogs "${FORWARD_CSOC_LOGS}"

.github/workflows/cdk_release_code.yml

@@ -18,6 +18,9 @@ on:
       DEPLOY_CHANGE:
         type: boolean
         default: true
+      FORWARD_CSOC_LOGS:
+        type: boolean
+        default: false
     secrets:
       CLOUD_FORMATION_DEPLOY_ROLE:
         required: true
@@ -89,6 +92,7 @@ jobs:
           VERSION_NUMBER: "${{ inputs.VERSION_NUMBER }}"
           COMMIT_ID: "${{ inputs.COMMIT_ID }}"
           LOG_RETENTION_IN_DAYS: "${{ inputs.LOG_RETENTION_IN_DAYS }}"
+          FORWARD_CSOC_LOGS: "${{ inputs.FORWARD_CSOC_LOGS }}"
 
       - name: Show diff
         run: |

.github/workflows/ci.yml

@@ -68,6 +68,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -96,6 +97,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}

.github/workflows/pull_request.yml

@@ -97,6 +97,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: false
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}

.github/workflows/release.yml

@@ -67,6 +67,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -95,6 +96,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.REF_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.REF_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -108,6 +110,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -143,6 +146,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.INT_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.INT_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -179,6 +183,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: true
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.PROD_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_DEPLOY_ROLE }}

packages/cdk/stacks/VpcResourcesStack.ts

@@ -10,6 +10,9 @@ import {
 import {
   CfnSubnet,
   FlowLogDestination,
+  FlowLogMaxAggregationInterval,
+  FlowLogOptions,
+  FlowLogTrafficType,
   GatewayVpcEndpoint,
   InterfaceVpcEndpoint,
   InterfaceVpcEndpointAwsService,
@@ -19,6 +22,7 @@ import {
   Vpc
 } from "aws-cdk-lib/aws-ec2"
 import {Role, ServicePrincipal} from "aws-cdk-lib/aws-iam"
+import {Bucket} from "aws-cdk-lib/aws-s3"
 import {Key} from "aws-cdk-lib/aws-kms"
 import {LogGroup} from "aws-cdk-lib/aws-logs"
 import {AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId} from "aws-cdk-lib/custom-resources"
@@ -43,6 +47,7 @@ export class VpcResourcesStack extends Stack {
     // Context
     /* context values passed as --context cli arguments are passed as strings so coerce them to expected types*/
     const logRetentionInDays: number = Number(this.node.tryGetContext("logRetentionInDays"))
+    const forwardCsocLogs: boolean = Boolean(this.node.tryGetContext("forwardCsocLogs"))
 
     // Imports
     const cloudwatchKmsKey = Key.fromKeyArn(
@@ -60,16 +65,34 @@ export class VpcResourcesStack extends Stack {
       removalPolicy: RemovalPolicy.DESTROY
     })
 
+    // Build flow logs configuration
+    const flowLogsConfig: Record<string, FlowLogOptions> = {
+      "FlowLogCloudwatch": {
+        destination: FlowLogDestination.toCloudWatchLogs(flowLogsLogGroup, flowLogsRole)
+      }
+    }
+
+    // Conditionally add S3 flow logs if forwardCsocLogs is true
+    if (forwardCsocLogs) {
+      const vpcFlowLogsBucket = Bucket.fromBucketArn(
+        this,
+        "VpcFlowLogsBucket",
+        "arn:aws:s3:::nhsd-audit-vpcflowlogs"
+      )
+
+      flowLogsConfig["FlowLogS3"] = {
+        destination: FlowLogDestination.toS3(vpcFlowLogsBucket),
+        trafficType: FlowLogTrafficType.ALL,
+        maxAggregationInterval: FlowLogMaxAggregationInterval.TEN_MINUTES
+      }
+    }
+
     const vpc = new Vpc(this, "vpc", {
       ipAddresses: IpAddresses.cidr("10.190.0.0/16"),
       enableDnsSupport: true,
       enableDnsHostnames: true,
       availabilityZones: props.availabilityZones,
-      flowLogs: {
-        "FlowLogCloudwatch": {
-          destination: FlowLogDestination.toCloudWatchLogs(flowLogsLogGroup, flowLogsRole)
-        }
-      }
+      flowLogs: flowLogsConfig
     })
 
     // Add cfn-guard suppressions