Skip to content

Commit e219f12

Browse files
rudransh-shrivastavarudransh-shrivastava
authored
Add logging in Infrastructure (#2743)
* refactor s3 buckets into a module * add vpc flow logs, cache logs, and update ecs logs * update code
1 parent 932c4a4 commit e219f12

File tree

12 files changed

+242
-130
lines changed

12 files changed

+242
-130
lines changed

‎infrastructure/modules/cache/main.tf‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,18 @@ locals {
1919
redis_major_version = split(".", var.redis_engine_version)[0]
2020
}
2121

22+
resource "aws_cloudwatch_log_group" "engine_log" {
23+
name = "/aws/elasticache/${var.project_name}-${var.environment}-cache-engine-log"
24+
retention_in_days = var.log_retention_in_days
25+
tags = var.common_tags
26+
}
27+
28+
resource "aws_cloudwatch_log_group" "slow_log" {
29+
name = "/aws/elasticache/${var.project_name}-${var.environment}-cache-slow-log"
30+
retention_in_days = var.log_retention_in_days
31+
tags = var.common_tags
32+
}
33+
2234
resource "aws_elasticache_subnet_group" "main" {
2335
name = "${var.project_name}-${var.environment}-cache-subnet-group"
2436
subnet_ids = var.subnet_ids
@@ -53,8 +65,20 @@ resource "aws_elasticache_replication_group" "main" {
5365
snapshot_retention_limit = var.snapshot_retention_limit
5466
snapshot_window = var.snapshot_window
5567
subnet_group_name = aws_elasticache_subnet_group.main.name
68+
transit_encryption_enabled = true
69+
log_delivery_configuration {
70+
destination = aws_cloudwatch_log_group.engine_log.name
71+
destination_type = "cloudwatch-logs"
72+
log_format = "json"
73+
log_type = "engine-log"
74+
}
75+
log_delivery_configuration {
76+
destination = aws_cloudwatch_log_group.slow_log.name
77+
destination_type = "cloudwatch-logs"
78+
log_format = "json"
79+
log_type = "slow-log"
80+
}
5681
tags = merge(var.common_tags, {
5782
Name = "${var.project_name}-${var.environment}-redis"
5883
})
59-
transit_encryption_enabled = true
6084
}

‎infrastructure/modules/cache/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ variable "environment" {
1515
type = string
1616
}
1717

18+
variable "log_retention_in_days" {
19+
description = "The number of days to retain log events."
20+
type = number
21+
default = 90
22+
}
23+
1824
variable "maintenance_window" {
1925
description = "The weekly time range for when maintenance on the cache cluster is performed."
2026
type = string

‎infrastructure/modules/ecs/modules/task/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ terraform {
1010
}
1111

1212
resource "aws_cloudwatch_log_group" "task" {
13-
name = "/ecs/${var.project_name}-${var.environment}-${var.task_name}"
13+
name = "/aws/ecs/${var.project_name}-${var.environment}-${var.task_name}"
1414
retention_in_days = var.log_retention_in_days
1515
tags = merge(var.common_tags, {
1616
Name = "${var.project_name}-${var.environment}-${var.task_name}-logs"

‎infrastructure/modules/ecs/modules/task/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ variable "image_url" {
5454
variable "log_retention_in_days" {
5555
description = "The number of days to retain log events."
5656
type = number
57-
default = 30
57+
default = 90
5858
}
5959

6060
variable "memory" {

‎infrastructure/modules/networking/main.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,27 @@ terraform {
1313
}
1414
}
1515

16+
data "aws_iam_policy_document" "flow_logs_assume_role" {
17+
statement {
18+
actions = ["sts:AssumeRole"]
19+
principals {
20+
type = "Service"
21+
identifiers = ["vpc-flow-logs.amazonaws.com"]
22+
}
23+
}
24+
}
25+
26+
data "aws_iam_policy_document" "flow_logs_policy" {
27+
statement {
28+
actions = [
29+
"logs:CreateLogStream",
30+
"logs:PutLogEvents",
31+
"logs:DescribeLogStreams",
32+
]
33+
resources = ["${aws_cloudwatch_log_group.flow_logs.arn}:*"]
34+
}
35+
}
36+
1637
resource "aws_vpc" "main" {
1738
cidr_block = var.vpc_cidr
1839
enable_dns_hostnames = true
@@ -22,6 +43,39 @@ resource "aws_vpc" "main" {
2243
})
2344
}
2445

46+
resource "aws_cloudwatch_log_group" "flow_logs" {
47+
name = "/aws/vpc-flow-logs/${var.project_name}-${var.environment}"
48+
retention_in_days = var.log_retention_in_days
49+
tags = var.common_tags
50+
}
51+
52+
resource "aws_flow_log" "main" {
53+
iam_role_arn = aws_iam_role.flow_logs.arn
54+
log_destination = aws_cloudwatch_log_group.flow_logs.arn
55+
traffic_type = "ALL"
56+
vpc_id = aws_vpc.main.id
57+
tags = merge(var.common_tags, {
58+
Name = "${var.project_name}-${var.environment}-vpc-flow-log"
59+
})
60+
}
61+
62+
resource "aws_iam_policy" "flow_logs" {
63+
name = "${var.project_name}-${var.environment}-flow-logs-policy"
64+
policy = data.aws_iam_policy_document.flow_logs_policy.json
65+
tags = var.common_tags
66+
}
67+
68+
resource "aws_iam_role" "flow_logs" {
69+
name = "${var.project_name}-${var.environment}-flow-logs-role"
70+
assume_role_policy = data.aws_iam_policy_document.flow_logs_assume_role.json
71+
tags = var.common_tags
72+
}
73+
74+
resource "aws_iam_role_policy_attachment" "flow_logs" {
75+
role = aws_iam_role.flow_logs.name
76+
policy_arn = aws_iam_policy.flow_logs.arn
77+
}
78+
2579
resource "aws_internet_gateway" "main" {
2680
tags = merge(var.common_tags, {
2781
Name = "${var.project_name}-${var.environment}-igw"

‎infrastructure/modules/networking/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ variable "environment" {
1414
type = string
1515
}
1616

17+
variable "log_retention_in_days" {
18+
description = "The number of days to retain log events."
19+
type = number
20+
default = 90
21+
}
22+
1723
variable "private_subnet_cidrs" {
1824
description = "A list of CIDR blocks for the private subnets"
1925
type = list(string)

‎infrastructure/modules/storage/main.tf‎

Lines changed: 21 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -1,138 +1,47 @@
11
terraform {
2-
required_version = ">= 1.0"
3-
2+
required_version = "1.14.0"
43
required_providers {
54
aws = {
65
source = "hashicorp/aws"
7-
version = "~> 6.0"
8-
}
9-
random = {
10-
source = "hashicorp/random"
11-
version = "~> 3.0"
6+
version = "6.22.0"
127
}
138
}
149
}
1510

16-
data "aws_iam_policy_document" "zappa" {
11+
data "aws_iam_policy_document" "fixtures_read_only" {
1712
statement {
18-
actions = ["s3:*"]
19-
condition {
20-
test = "Bool"
21-
variable = "aws:SecureTransport"
22-
values = ["false"]
23-
}
24-
effect = "Deny"
25-
principals {
26-
type = "*"
27-
identifiers = ["*"]
28-
}
13+
actions = [
14+
"s3:GetObject"
15+
]
16+
effect = "Allow"
2917
resources = [
30-
aws_s3_bucket.zappa.arn,
31-
"${aws_s3_bucket.zappa.arn}/*",
18+
"arn:aws:s3:::${var.fixtures_s3_bucket}/*"
3219
]
33-
sid = "EnforceTls"
3420
}
3521
}
3622

37-
resource "aws_iam_policy" "fixtures_read_only" {
38-
name = "${var.project_name}-${var.environment}-fixtures-read-only"
39-
description = "Allows read-only access to the fixtures S3 bucket"
23+
module "fixtures_bucket" {
24+
source = "./modules/s3-bucket"
4025

41-
policy = jsonencode({
42-
Version = "2012-10-17"
43-
Statement = [
44-
{
45-
Action = [
46-
"s3:GetObject"
47-
]
48-
Effect = "Allow"
49-
Resource = "arn:aws:s3:::${var.fixtures_s3_bucket}/*"
50-
}
51-
]
26+
bucket_name = var.fixtures_s3_bucket
27+
force_destroy = var.force_destroy_bucket
28+
tags = merge(var.common_tags, {
29+
Name = "${var.project_name}-${var.environment}-fixtures"
5230
})
5331
}
5432

55-
resource "aws_s3_bucket" "fixtures" { # NOSONAR
56-
bucket = var.fixtures_s3_bucket
57-
tags = var.common_tags
58-
}
59-
60-
resource "aws_s3_bucket_lifecycle_configuration" "zappa" {
61-
bucket = aws_s3_bucket.zappa.id
33+
module "zappa_bucket" {
34+
source = "./modules/s3-bucket"
6235

63-
rule {
64-
abort_incomplete_multipart_upload {
65-
days_after_initiation = var.abort_incomplete_multipart_upload_days
66-
}
67-
id = "delete-old-versions"
68-
noncurrent_version_expiration {
69-
noncurrent_days = var.noncurrent_version_expiration_days
70-
}
71-
status = "Enabled"
72-
}
73-
}
74-
75-
resource "aws_s3_bucket" "zappa" { # NOSONAR
76-
bucket = var.zappa_s3_bucket
36+
bucket_name = var.zappa_s3_bucket
7737
force_destroy = var.force_destroy_bucket
7838
tags = merge(var.common_tags, {
7939
Name = "${var.project_name}-${var.environment}-zappa-deployments"
8040
})
8141
}
8242

83-
resource "aws_s3_bucket_policy" "zappa" {
84-
bucket = aws_s3_bucket.zappa.id
85-
policy = data.aws_iam_policy_document.zappa.json
86-
}
87-
88-
resource "aws_s3_bucket_public_access_block" "fixtures" {
89-
block_public_acls = true
90-
block_public_policy = true
91-
bucket = aws_s3_bucket.fixtures.id
92-
ignore_public_acls = true
93-
restrict_public_buckets = true
94-
}
95-
96-
resource "aws_s3_bucket_public_access_block" "zappa" {
97-
block_public_acls = true
98-
block_public_policy = true
99-
bucket = aws_s3_bucket.zappa.id
100-
ignore_public_acls = true
101-
restrict_public_buckets = true
102-
}
103-
104-
resource "aws_s3_bucket_server_side_encryption_configuration" "fixtures" {
105-
bucket = aws_s3_bucket.fixtures.id
106-
107-
rule {
108-
apply_server_side_encryption_by_default {
109-
sse_algorithm = "AES256"
110-
}
111-
}
112-
}
113-
114-
resource "aws_s3_bucket_server_side_encryption_configuration" "zappa" {
115-
bucket = aws_s3_bucket.zappa.id
116-
117-
rule {
118-
apply_server_side_encryption_by_default {
119-
sse_algorithm = "AES256"
120-
}
121-
}
122-
}
123-
124-
resource "aws_s3_bucket_versioning" "fixtures" {
125-
bucket = aws_s3_bucket.fixtures.id
126-
127-
versioning_configuration {
128-
status = "Enabled"
129-
}
130-
}
131-
132-
resource "aws_s3_bucket_versioning" "zappa" {
133-
bucket = aws_s3_bucket.zappa.id
134-
135-
versioning_configuration {
136-
status = "Enabled"
137-
}
43+
resource "aws_iam_policy" "fixtures_read_only" {
44+
name = "${var.project_name}-${var.environment}-fixtures-read-only"
45+
description = "Allows read-only access to the fixtures S3 bucket"
46+
policy = data.aws_iam_policy_document.fixtures_read_only.json
13847
}

0 commit comments

Comments
 (0)