forward csoc logs

Author: anthony-nhs

.github/scripts/fix_cdk_json.sh

@@ -47,3 +47,4 @@ fix_string_key versionNumber "${VERSION_NUMBER}"
 fix_string_key commitId "${COMMIT_ID}"
 fix_string_key cfnDriftDetectionGroup "${CFN_DRIFT_DETECTION_GROUP}"
 fix_boolean_number_key logRetentionInDays "${LOG_RETENTION_IN_DAYS}"
+fix_boolean_number_key forwardCsocLogs "${FORWARD_CSOC_LOGS}"

.github/workflows/cdk_release_code.yml

@@ -18,6 +18,9 @@ on:
       DEPLOY_CHANGE:
         type: boolean
         default: true
+      FORWARD_CSOC_LOGS:
+        type: boolean
+        default: false
     secrets:
       CLOUD_FORMATION_DEPLOY_ROLE:
         required: true
@@ -89,6 +92,7 @@ jobs:
           VERSION_NUMBER: "${{ inputs.VERSION_NUMBER }}"
           COMMIT_ID: "${{ inputs.COMMIT_ID }}"
           LOG_RETENTION_IN_DAYS: "${{ inputs.LOG_RETENTION_IN_DAYS }}"
+          FORWARD_CSOC_LOGS: "${{ inputs.FORWARD_CSOC_LOGS }}"
 
       - name: Show diff
         run: |

.github/workflows/ci.yml

@@ -103,6 +103,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -132,6 +133,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}

.github/workflows/pull_request.yml

@@ -51,7 +51,7 @@ jobs:
         id: commit_id
         run: |
           echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
-    
+
   package_code:
     needs: [quality_checks, get_issue_number, get_commit_id]
     uses: ./.github/workflows/cdk_package_code.yml
@@ -68,6 +68,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: false
+      FORWARD_CSOC_LOGS: true
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
         uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
         with:
           asdf_branch: v0.14.1
-  
+
       - name: Cache asdf
         uses: actions/cache@v4
         with:
@@ -59,7 +59,7 @@ jobs:
       - name: Install dependencies
         run: |
           make install
-  
+
       - name: Set VERSION_TAG to be next tag varsion
         id: output_version_tag
         run: |
@@ -122,10 +122,11 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
-  
+
   create_release_notes:
     needs: [tag_release, package_code, get_commit_id, release_dev]
     uses: ./.github/workflows/create_release_notes.yml
@@ -150,6 +151,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.REF_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.REF_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -163,6 +165,7 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -183,20 +186,36 @@ jobs:
       PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
 
   release_int:
-    needs: [tag_release, package_code, get_commit_id, release_qa, create_rc_release_notes]
+    needs:
+      [
+        tag_release,
+        package_code,
+        get_commit_id,
+        release_qa,
+        create_rc_release_notes,
+      ]
     uses: ./.github/workflows/cdk_release_code.yml
     with:
       TARGET_ENVIRONMENT: int
       VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: false
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.INT_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.INT_CLOUD_FORMATION_DEPLOY_ROLE }}
 
   create_release_notes_post_int:
-    needs: [tag_release, package_code, get_commit_id, release_dev, release_qa, release_int]
+    needs:
+      [
+        tag_release,
+        package_code,
+        get_commit_id,
+        release_dev,
+        release_qa,
+        release_int,
+      ]
     uses: ./.github/workflows/create_release_notes.yml
     with:
       VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
@@ -219,12 +238,22 @@ jobs:
       COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
       LOG_RETENTION_IN_DAYS: 30
       DEPLOY_CHANGE: true
+      FORWARD_CSOC_LOGS: true
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.PROD_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_DEPLOY_ROLE }}
 
   create_release_notes_post_prod:
-    needs: [tag_release, package_code, get_commit_id, release_dev, release_qa, release_int, release_prod]
+    needs:
+      [
+        tag_release,
+        package_code,
+        get_commit_id,
+        release_dev,
+        release_qa,
+        release_int,
+        release_prod,
+      ]
     uses: ./.github/workflows/create_release_notes.yml
     with:
       VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}

packages/cdk/stacks/VpcResourcesStack.ts

@@ -10,6 +10,9 @@ import {
 import {
   CfnSubnet,
   FlowLogDestination,
+  FlowLogMaxAggregationInterval,
+  FlowLogOptions,
+  FlowLogTrafficType,
   GatewayVpcEndpoint,
   InterfaceVpcEndpoint,
   InterfaceVpcEndpointAwsService,
@@ -19,6 +22,7 @@ import {
   Vpc
 } from "aws-cdk-lib/aws-ec2"
 import {Role, ServicePrincipal} from "aws-cdk-lib/aws-iam"
+import {Bucket} from "aws-cdk-lib/aws-s3"
 import {Key} from "aws-cdk-lib/aws-kms"
 import {LogGroup} from "aws-cdk-lib/aws-logs"
 import {AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId} from "aws-cdk-lib/custom-resources"
@@ -43,6 +47,7 @@ export class VpcResourcesStack extends Stack {
     // Context
     /* context values passed as --context cli arguments are passed as strings so coerce them to expected types*/
     const logRetentionInDays: number = Number(this.node.tryGetContext("logRetentionInDays"))
+    const forwardCsocLogs: boolean = this.node.tryGetContext("forwardCsocLogs") === "true"
 
     // Imports
     const cloudwatchKmsKey = Key.fromKeyArn(
@@ -60,16 +65,34 @@ export class VpcResourcesStack extends Stack {
       removalPolicy: RemovalPolicy.DESTROY
     })
 
+    // Build flow logs configuration
+    const flowLogsConfig: Record<string, FlowLogOptions> = {
+      "FlowLogCloudwatch": {
+        destination: FlowLogDestination.toCloudWatchLogs(flowLogsLogGroup, flowLogsRole)
+      }
+    }
+
+    // Conditionally add S3 flow logs if forwardCsocLogs is true
+    if (forwardCsocLogs) {
+      const vpcFlowLogsBucket = Bucket.fromBucketArn(
+        this,
+        "VpcFlowLogsBucket",
+        "arn:aws:s3:::nhsd-audit-vpcflowlogs"
+      )
+
+      flowLogsConfig["FlowLogS3"] = {
+        destination: FlowLogDestination.toS3(vpcFlowLogsBucket),
+        trafficType: FlowLogTrafficType.ALL,
+        maxAggregationInterval: FlowLogMaxAggregationInterval.TEN_MINUTES
+      }
+    }
+
     const vpc = new Vpc(this, "vpc", {
       ipAddresses: IpAddresses.cidr("10.190.0.0/16"),
       enableDnsSupport: true,
       enableDnsHostnames: true,
       availabilityZones: props.availabilityZones,
-      flowLogs: {
-        "FlowLogCloudwatch": {
-          destination: FlowLogDestination.toCloudWatchLogs(flowLogsLogGroup, flowLogsRole)
-        }
-      }
+      flowLogs: flowLogsConfig
     })
 
     // Add cfn-guard suppressions