[PRMP-1588] Implementation of additional Session Attributes (#269)

* Enabled logging for cloudwatch_rum

* Added specified log_group and policy/role to handle logging

* Removed un-needed logging group

* Attempt to add permissions to vended log group

* Added DeleteResourcePolicy to test with permission on AWSRUMLoggingPolicy

* try setting prevent_destroy to false

* reformatted

* Added dependency on app_monitor

* additional permissions

* made region and acc id vars for logging

* changed rum_log_policy to rum_log

* updated dependency

---------

Co-authored-by: robg-nhs <[email protected]>

Author: oliverbeumkes-nhs

infrastructure/cloudwatch_rum.tf

@@ -1,5 +1,6 @@
 locals {
   cognito_role_name = "${terraform.workspace}-cognito-unauth-role"
+  cw_log_group      = "/aws/rum/my-rum-monitor/${terraform.workspace}-app-monitor"
 }
 
 resource "aws_iam_role" "cognito_unauthenticated" {
@@ -46,6 +47,33 @@ resource "aws_iam_policy" "cloudwatch_rum_cognito_access" {
   })
 }
 
+resource "aws_cloudwatch_log_resource_policy" "rum_log" {
+  policy_name = "AWSRUMLoggingPolicy"
+
+  policy_document = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          Service = "rum.amazonaws.com"
+        },
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+          "logs:DeleteResourcePolicy",
+          "logs:DeleteLogGroup",
+          "logs:DescribeLogGroups"
+        ],
+        Resource = "arn:aws:logs:${local.current_region}:${local.current_account_id}:log-group:/aws/vendedlogs/RUMService-*"
+      }
+    ]
+  })
+  lifecycle {
+    prevent_destroy = false
+  }
+}
+
 resource "aws_iam_role_policy_attachment" "cloudwatch_rum_cognito_unauth" {
   count      = local.is_production ? 0 : 1
   role       = aws_iam_role.cognito_unauthenticated[0].name
@@ -71,7 +99,7 @@ resource "aws_rum_app_monitor" "ndr" {
   count          = local.is_production ? 0 : 1
   name           = "${terraform.workspace}-app-monitor"
   domain         = "*.${var.domain}"
-  cw_log_enabled = false
+  cw_log_enabled = true
 
   app_monitor_configuration {
     identity_pool_id    = aws_cognito_identity_pool.cloudwatch_rum[0].id
@@ -80,4 +108,6 @@ resource "aws_rum_app_monitor" "ndr" {
     session_sample_rate = 1.0
     telemetries         = ["errors", "performance", "http"]
   }
+
+  depends_on = [aws_cloudwatch_log_resource_policy.rum_log]
 }