Skip to content

Commit a03b013

Browse files
JamesW1-NHSmfjarvis
JamesW1-NHS
and
mfjarvis
authored
VED-501: Forward API Gateway logs to CSOC Sentinel (#774)
* steps 2-5 * steps 2-5 II * steps 2-5 III * log-group name * retooled for existing log group * retooled for existing log group II * retooled for existing log group III * added subscription policy permissions * variables * variables II * there is no '$context.identity.apiKey' * parameterization --------- Co-authored-by: Matt Jarvis <[email protected]>
1 parent ea949b9 commit a03b013

File tree

9 files changed

+65
-1
lines changed

9 files changed

+65
-1
lines changed

‎terraform/endpoints.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,9 @@ module "api_gateway" {
115115
environment = var.environment
116116
sub_environment = var.sub_environment
117117
oas = local.oas
118+
aws_region = var.aws_region
119+
immunisation_account_id = var.immunisation_account_id
120+
csoc_account_id = var.csoc_account_id
118121
}
119122

120123
resource "aws_lambda_permission" "api_gw" {

‎terraform/environments/dev/int/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
environment = "dev"
22
immunisation_account_id = "345594581768"
33
dspp_core_account_id = "603871901111"
4+
csoc_account_id = "693466633220"
45
pds_environment = "int"
56
batch_error_notifications_enabled = true
67
pds_check_enabled = false

‎terraform/environments/dev/internal-dev/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
environment = "dev"
22
immunisation_account_id = "345594581768"
33
dspp_core_account_id = "603871901111"
4+
csoc_account_id = "693466633220"
45
pds_environment = "int"
56
batch_error_notifications_enabled = true
67
pds_check_enabled = true

‎terraform/environments/dev/pr/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
environment = "dev"
22
immunisation_account_id = "345594581768"
33
dspp_core_account_id = "603871901111"
4+
csoc_account_id = "693466633220"
45
pds_environment = "int"
56
batch_error_notifications_enabled = false
67
pds_check_enabled = true

‎terraform/environments/dev/ref/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
environment = "dev"
22
immunisation_account_id = "345594581768"
33
dspp_core_account_id = "603871901111"
4+
csoc_account_id = "693466633220"
45
pds_environment = "ref"
56
batch_error_notifications_enabled = true
67
pds_check_enabled = true

‎terraform/modules/api_gateway/api.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ resource "aws_apigatewayv2_stage" "default" {
2121
}
2222
access_log_settings {
2323
destination_arn = aws_cloudwatch_log_group.api_access_log.arn
24-
format = "{ \"requestId\":\"$context.requestId\", \"extendedRequestId\":\"$context.extendedRequestId\", \"ip\": \"$context.identity.sourceIp\", \"caller\":\"$context.identity.caller\", \"user\":\"$context.identity.user\", \"requestTime\":\"$context.requestTime\", \"httpMethod\":\"$context.httpMethod\", \"resourcePath\":\"$context.resourcePath\", \"status\":\"$context.status\", \"protocol\":\"$context.protocol\", \"responseLength\":\"$context.responseLength\", \"authorizerError\":\"$context.authorizer.error\", \"authorizerStatus\":\"$context.authorizer.status\", \"requestIsValid\":\"$context.authorizer.is_valid\"\"environment\":\"$context.authorizer.environment\" }"
24+
format = "{ \"requestId\":\"$context.requestId\", \"extendedRequestId\":\"$context.extendedRequestId\", \"ip\":\"$context.identity.sourceIp\", \"caller\":\"$context.identity.caller\", \"user\":\"$context.identity.user\", \"requestTime\":\"$context.requestTime\", \"httpMethod\":\"$context.httpMethod\", \"resourcePath\":\"$context.resourcePath\", \"status\":\"$context.status\", \"protocol\":\"$context.protocol\", \"responseLength\":\"$context.responseLength\", \"accountId\":\"$context.accountId\", \"apiId\":\"$context.apiId\", \"stage\":\"$context.stage\", \"authorizerError\":\"$context.authorizer.error\", \"authorizerStatus\":\"$context.authorizer.status\", \"requestIsValid\":\"$context.authorizer.is_valid\", \"environment\":\"$context.authorizer.environment\" }"
2525
}
2626

2727
# Bug in terraform-aws-provider with perpetual diff

‎terraform/modules/api_gateway/logs.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,56 @@ resource "aws_iam_role_policy" "cloudwatch" {
5353
}
5454
EOF
5555
}
56+
57+
resource "aws_iam_role_policy_attachment" "api_logs_apigateway_policy" {
58+
role = aws_iam_role.api_cloudwatch.name
59+
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
60+
}
61+
62+
resource "aws_iam_policy" "api_logs_subscription_policy" {
63+
name = "${var.short_prefix}-api-logs-subscription-policy"
64+
policy = jsonencode({
65+
Version = "2012-10-17",
66+
Statement = [
67+
{
68+
Sid = "AllowPutAPIGSubFilter"
69+
Effect = "Allow"
70+
Action = [
71+
"logs:PutSubscriptionFilter"
72+
]
73+
Resource = [
74+
"arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/vendedlogs/${aws_apigatewayv2_api.service_api.id}/${var.sub_environment}:*",
75+
"arn:aws:logs:${var.aws_region}:${var.csoc_account_id}:destination:api_gateway_log_destination"
76+
]
77+
}
78+
]
79+
})
80+
}
81+
82+
resource "aws_iam_role_policy_attachment" "api_logs_subscription_policy" {
83+
role = aws_iam_role.api_cloudwatch.name
84+
policy_arn = aws_iam_policy.api_logs_subscription_policy.arn
85+
}
86+
87+
resource "aws_iam_role" "api_logs_subscription_role" {
88+
name = "${var.short_prefix}-api-logs-subscription-role"
89+
assume_role_policy = jsonencode({
90+
Version = "2012-10-17",
91+
Statement = [{
92+
Effect = "Allow",
93+
Sid = "",
94+
Principal = {
95+
Service = "logs.${var.aws_region}.amazonaws.com"
96+
},
97+
Action = "sts:AssumeRole"
98+
}]
99+
})
100+
}
101+
102+
resource "aws_cloudwatch_log_subscription_filter" "api_logs_subscription_logfilter" {
103+
name = "${var.short_prefix}-api-logs-subscription-logfilter"
104+
log_group_name = aws_cloudwatch_log_group.api_access_log.name
105+
filter_pattern = ""
106+
destination_arn = "arn:aws:logs:${var.aws_region}:${var.csoc_account_id}:destination:api_gateway_log_destination"
107+
role_arn = aws_iam_role.api_logs_subscription_role.arn
108+
}

‎terraform/modules/api_gateway/variables.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,6 @@ variable "api_domain_name" {}
55
variable "environment" {}
66
variable "sub_environment" {}
77
variable "oas" {}
8+
variable "aws_region" {}
9+
variable "immunisation_account_id" {}
10+
variable "csoc_account_id" {}

‎terraform/variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ variable "sub_environment" {
66

77
variable "immunisation_account_id" {}
88
variable "dspp_core_account_id" {}
9+
variable "csoc_account_id" {}
910

1011
variable "create_mesh_processor" {
1112
default = false

0 commit comments

Comments
 (0)