Skip to content

Commit 0faf9db

Browse files
abbas-khan10abbas-khan10
committed
enable access logging
1 parent 06717f3 commit 0faf9db

File tree

5 files changed

+139
-29
lines changed

5 files changed

+139
-29
lines changed

‎infrastructure/README.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
| Name | Version |
1010
|------|---------|
11-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.78.0 |
11+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.86.1 |
1212

1313
## Modules
1414

@@ -164,15 +164,13 @@
164164
| [aws_api_gateway_gateway_response.unauthorised_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_gateway_response) | resource |
165165
| [aws_api_gateway_integration.get_document_reference_mock](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration) | resource |
166166
| [aws_api_gateway_integration_response.get_document_reference_mock_200_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
167-
| [aws_api_gateway_integration_response.get_document_reference_mock_400_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
168167
| [aws_api_gateway_integration_response.get_document_reference_mock_401_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
169168
| [aws_api_gateway_integration_response.get_document_reference_mock_403_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
170169
| [aws_api_gateway_integration_response.get_document_reference_mock_404_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
171170
| [aws_api_gateway_method.get_document_reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
172171
| [aws_api_gateway_method.login_proxy_method](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
173172
| [aws_api_gateway_method.sandbox_get_document_reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
174173
| [aws_api_gateway_method_response.response_200](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource |
175-
| [aws_api_gateway_method_response.response_400](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource |
176174
| [aws_api_gateway_method_response.response_401](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource |
177175
| [aws_api_gateway_method_response.response_403](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource |
178176
| [aws_api_gateway_method_response.response_404](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource |
@@ -288,12 +286,16 @@
288286
| [aws_lambda_permission.bulk_upload_report_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
289287
| [aws_lambda_permission.data_collection_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
290288
| [aws_lambda_permission.statistical_report_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
289+
| [aws_s3_bucket.access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
291290
| [aws_s3_bucket.logs_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
292291
| [aws_s3_bucket_lifecycle_configuration.doc-store-lifecycle-rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
293292
| [aws_s3_bucket_lifecycle_configuration.lg-lifecycle-rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
294293
| [aws_s3_bucket_lifecycle_configuration.staging-store-lifecycle-rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
294+
| [aws_s3_bucket_policy.access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
295295
| [aws_s3_bucket_policy.logs_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
296296
| [aws_s3_bucket_public_access_block.logs_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
297+
| [aws_s3_bucket_versioning.access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
298+
| [aws_s3_bucket_versioning.logs_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
297299
| [aws_scheduler_schedule.ods_weekly_update_ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/scheduler_schedule) | resource |
298300
| [aws_security_group.ndr_mesh_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
299301
| [aws_sns_topic.alarm_notifications_topic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
@@ -311,6 +313,7 @@
311313
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
312314
| [aws_ecr_repository.mesh_s3_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_repository) | data source |
313315
| [aws_elb_service_account.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
316+
| [aws_iam_policy_document.access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
314317
| [aws_iam_policy_document.assume_role_policy_for_create_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
315318
| [aws_iam_policy_document.assume_role_policy_for_get_doc_ref_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
316319
| [aws_iam_policy_document.assume_role_policy_for_manifest_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

‎infrastructure/buckets.tf‎

Lines changed: 111 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
1-
# Document Store Bucket
1+
locals {
2+
access_logs_bucket_id = !local.is_production ? aws_s3_bucket.access_logs[0].id : null
3+
access_logs_count = !local.is_production ? 1 : 0
4+
}
5+
6+
# Bucket Modules
27
module "ndr-document-store" {
38
source = "./modules/s3/"
9+
access_logs_enabled = true
10+
access_logs_bucket_id = local.access_logs_bucket_id
411
bucket_name = var.docstore_bucket_name
512
enable_cors_configuration = true
613
enable_bucket_versioning = true
@@ -22,9 +29,10 @@ module "ndr-document-store" {
2229
]
2330
}
2431

25-
# Zip Request Store Bucket
2632
module "ndr-zip-request-store" {
2733
source = "./modules/s3/"
34+
access_logs_enabled = true
35+
access_logs_bucket_id = local.access_logs_bucket_id
2836
bucket_name = var.zip_store_bucket_name
2937
enable_cors_configuration = true
3038
environment = var.environment
@@ -37,9 +45,11 @@ module "ndr-zip-request-store" {
3745
}
3846
]
3947
}
40-
# Lloyd George Store Bucket
48+
4149
module "ndr-lloyd-george-store" {
4250
source = "./modules/s3/"
51+
access_logs_enabled = true
52+
access_logs_bucket_id = local.access_logs_bucket_id
4353
cloudfront_enabled = true
4454
cloudfront_arn = module.cloudfront-distribution-lg.cloudfront_arn
4555
bucket_name = var.lloyd_george_bucket_name
@@ -63,9 +73,10 @@ module "ndr-lloyd-george-store" {
6373
]
6474
}
6575

66-
6776
module "statistical-reports-store" {
6877
source = "./modules/s3/"
78+
access_logs_enabled = true
79+
access_logs_bucket_id = local.access_logs_bucket_id
6980
bucket_name = var.statistical_reports_bucket_name
7081
enable_cors_configuration = true
7182
enable_bucket_versioning = true
@@ -80,6 +91,30 @@ module "statistical-reports-store" {
8091
]
8192
}
8293

94+
module "ndr-bulk-staging-store" {
95+
source = "./modules/s3/"
96+
access_logs_enabled = true
97+
access_logs_bucket_id = local.access_logs_bucket_id
98+
bucket_name = var.staging_store_bucket_name
99+
enable_cors_configuration = true
100+
enable_bucket_versioning = true
101+
environment = var.environment
102+
owner = var.owner
103+
force_destroy = local.is_force_destroy
104+
cors_rules = [
105+
{
106+
allowed_headers = ["*"]
107+
allowed_methods = ["POST", "PUT", "DELETE"]
108+
allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
109+
expose_headers = ["ETag"]
110+
max_age_seconds = 3000
111+
},
112+
{
113+
allowed_methods = ["GET"]
114+
allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
115+
}
116+
]
117+
}
83118

84119
# Lifecycle Rules
85120
resource "aws_s3_bucket_lifecycle_configuration" "lg-lifecycle-rules" {
@@ -135,28 +170,79 @@ resource "aws_s3_bucket_lifecycle_configuration" "staging-store-lifecycle-rules"
135170
}
136171
}
137172

138-
# Staging Bucket for bulk uploads
139-
module "ndr-bulk-staging-store" {
140-
source = "./modules/s3/"
141-
bucket_name = var.staging_store_bucket_name
142-
enable_cors_configuration = true
143-
enable_bucket_versioning = true
144-
environment = var.environment
145-
owner = var.owner
146-
force_destroy = local.is_force_destroy
147-
cors_rules = [
148-
{
149-
allowed_headers = ["*"]
150-
allowed_methods = ["POST", "PUT", "DELETE"]
151-
allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
152-
expose_headers = ["ETag"]
153-
max_age_seconds = 3000
154-
},
155-
{
156-
allowed_methods = ["GET"]
157-
allowed_origins = ["https://${terraform.workspace}.${var.domain}"]
173+
# Logging Buckets
174+
resource "aws_s3_bucket" "access_logs" {
175+
count = local.access_logs_count
176+
bucket = "${terraform.workspace}-ndr-access-logs"
177+
force_destroy = local.is_force_destroy
178+
179+
tags = {
180+
Name = "${terraform.workspace}-ndr-access-logs"
181+
Owner = var.owner
182+
Environment = var.environment
183+
Workspace = terraform.workspace
184+
}
185+
}
186+
187+
data "aws_iam_policy_document" "access_logs" {
188+
count = local.access_logs_count
189+
statement {
190+
sid = "AllowS3AccessLogsPolicy"
191+
effect = "Allow"
192+
actions = ["s3:PutObject"]
193+
resources = [
194+
"${aws_s3_bucket.access_logs[0].arn}/*",
195+
]
196+
197+
principals {
198+
type = "Service"
199+
identifiers = ["logging.s3.amazonaws.com"]
158200
}
159-
]
201+
202+
condition {
203+
test = "StringEquals"
204+
variable = "aws:SourceAccount"
205+
values = [data.aws_caller_identity.current.account_id]
206+
}
207+
}
208+
statement {
209+
sid = "DenyS3AccessLogsPolicy"
210+
effect = "Deny"
211+
212+
principals {
213+
type = "*"
214+
identifiers = ["*"]
215+
}
216+
217+
actions = [
218+
"s3:*",
219+
]
220+
221+
resources = [
222+
"${aws_s3_bucket.access_logs[0].arn}/*",
223+
]
224+
225+
condition {
226+
test = "Bool"
227+
variable = "aws:SecureTransport"
228+
values = ["false"]
229+
}
230+
}
231+
}
232+
233+
resource "aws_s3_bucket_policy" "access_logs" {
234+
count = local.access_logs_count
235+
bucket = aws_s3_bucket.access_logs[0].id
236+
policy = data.aws_iam_policy_document.access_logs[0].json
237+
}
238+
239+
resource "aws_s3_bucket_versioning" "access_logs" {
240+
count = local.access_logs_count
241+
bucket = aws_s3_bucket.access_logs[0].id
242+
243+
versioning_configuration {
244+
status = "Enabled"
245+
}
160246
}
161247

162248
resource "aws_s3_bucket" "logs_bucket" {

‎infrastructure/modules/s3/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,22 @@ No modules.
2222
| [aws_s3_bucket.bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
2323
| [aws_s3_bucket_acl.bucket_acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
2424
| [aws_s3_bucket_cors_configuration.document_store_bucket_cors_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
25+
| [aws_s3_bucket_logging.bucket_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
2526
| [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
2627
| [aws_s3_bucket_policy.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
2728
| [aws_s3_bucket_public_access_block.bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
2829
| [aws_s3_bucket_versioning.bucket_versioning](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
2930
| [aws_iam_policy_document.s3_cloudfront_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
30-
| [aws_iam_policy_document.s3_defaut_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
31+
| [aws_iam_policy_document.s3_default_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3132
| [aws_iam_policy_document.s3_read_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3233
| [aws_iam_policy_document.s3_write_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3334

3435
## Inputs
3536

3637
| Name | Description | Type | Default | Required |
3738
|------|-------------|------|---------|:--------:|
39+
| <a name="input_access_logs_bucket_id"></a> [access\_logs\_bucket\_id](#input\_access\_logs\_bucket\_id) | Enables access logs on the module's bucket | `string` | `null` | no |
40+
| <a name="input_access_logs_enabled"></a> [access\_logs\_enabled](#input\_access\_logs\_enabled) | n/a | `bool` | `false` | no |
3841
| <a name="input_bucket_name"></a> [bucket\_name](#input\_bucket\_name) | the name of the bucket | `string` | n/a | yes |
3942
| <a name="input_cloudfront_arn"></a> [cloudfront\_arn](#input\_cloudfront\_arn) | CloudFront Distribution ARN association and policy toggles | `string` | `"null"` | no |
4043
| <a name="input_cloudfront_enabled"></a> [cloudfront\_enabled](#input\_cloudfront\_enabled) | Enables the correct policy config for CloudFront associated S3 bucket | `bool` | `false` | no |

‎infrastructure/modules/s3/main.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,13 @@ resource "aws_s3_bucket_versioning" "bucket_versioning" {
138138
depends_on = [aws_s3_bucket.bucket]
139139
}
140140

141+
resource "aws_s3_bucket_logging" "bucket_logging" {
142+
count = var.access_logs_enabled ? 0 : 1
143+
bucket = aws_s3_bucket.bucket.id
144+
target_bucket = var.access_logs_bucket_id
145+
target_prefix = "${aws_s3_bucket.bucket.id}/"
146+
}
147+
141148
data "aws_iam_policy_document" "s3_read_policy" {
142149
statement {
143150
actions = ["s3:Get*", "s3:List*"]

‎infrastructure/modules/s3/variable.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,15 @@ variable "cloudfront_enabled" {
4141
type = bool
4242
default = false
4343
description = "Enables the correct policy config for CloudFront associated S3 bucket"
44+
}
45+
46+
variable "access_logs_enabled" {
47+
type = bool
48+
default = false
49+
}
50+
51+
variable "access_logs_bucket_id" {
52+
type = string
53+
default = null
54+
description = "Enables access logs on the module's bucket"
4455
}

0 commit comments

Comments
 (0)