Skip to content

Commit 0f1b596

Browse files
himsharma01himsharma01
committed
Reverting old commit and adding code to new folder
1 parent 8c3b083 commit 0f1b596

File tree

14 files changed

+573
-19
lines changed

14 files changed

+573
-19
lines changed

‎aws/elasticloadbalancing/README.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# SumoLogic-AWS-Elb
2+
3+
This module is used to create AWS and Sumo Logic resource to collect ELB logs from an AWS S3 bucket. Features include
4+
- Create AWS S3 bucket or use an existing AWS S3 bucket.
5+
- Create AWS IAM role or use an existing IAM role.
6+
- Create AWS SNS Topic or use an existing AWS SNS topic.
7+
- Create Sumo Logic hosted collector or use an existing Sumo Logic hosted collector.
8+
- Create Sumo Logic ELB source.
9+
- Auto enable access logs for Existing and New load balancer after installing the module.
10+
11+
## Requirements
12+
13+
| Name | Version |
14+
|------|---------|
15+
| terraform | >= 0.13.0 |
16+
| aws | >= 3.42.0 |
17+
| random | >=3.1.0 |
18+
| sumologic | >= 2.9.0 |
19+
| time | >=0.7.1 |
20+
21+
## Providers
22+
23+
| Name | Version |
24+
|------|---------|
25+
| aws | >= 3.42.0 |
26+
| random | >=3.1.0 |
27+
| sumologic | >= 2.9.0 |
28+
| time | >=0.7.1 |
29+
30+
## Inputs
31+
32+
| Name | Description | Type | Default | Required |
33+
|------|-------------|------|---------|:--------:|
34+
| auto\_enable\_access\_logs | New - Automatically enables access logging for newly created ALB resources to collect logs for ALB resources. This does not affect ALB resources already collecting logs.<br> Existing - Automatically enables access logging for existing ALB resources to collect logs for ALB resources.<br> Both - Automatically enables access logging for new and existing ALB resources.<br> None - Skips Automatic access Logging enable for ALB resources. | `string` | `"Both"` | no |
35+
| auto\_enable\_access\_logs\_options | filter - provide a regex to filter the ELB for which access logs should be enabled. Empty means all resources. For eg :- 'Type': 'application'\|'type': 'application', will enable access logs for Application load balancer only.<br> remove\_on\_delete\_stack - provide true if you would like to disable access logging when you destroy the terraform resources. | <pre>object({<br> filter = string<br> remove_on_delete_stack = bool<br> })</pre> | <pre>{<br> "filter": "",<br> "remove_on_delete_stack": true<br>}</pre> | no |
36+
| collector\_details | Provide details for the Sumo Logic collector. If not provided, then defaults will be used. | <pre>object({<br> collector_name = string<br> description = string<br> fields = map(string)<br> })</pre> | <pre>{<br> "collector_name": "SumoLogic Elb Collector <Random ID>",<br> "description": "This collector is created using Sumo Logic terraform AWS ELB module to collect AWS elb logs.",<br> "fields": {}<br>}</pre> | no |
37+
| create\_collector | Provide "true" if you would like to create the Sumo Logic Collector. | `bool` | n/a | yes |
38+
| source\_details | Provide details for the Sumo Logic ELB source. If not provided, then defaults will be used. | <pre>object({<br> source_name = string<br> source_category = string<br> collector_id = string<br> description = string<br> bucket_details = object({<br> create_bucket = bool<br> bucket_name = string<br> path_expression = string<br> force_destroy_bucket = bool<br> })<br> paused = bool<br> scan_interval = string<br> sumo_account_id = number<br> cutoff_relative_time = string<br> fields = map(string)<br> iam_details = object({<br> create_iam_role = bool<br> iam_role_arn = string<br> })<br> sns_topic_details = object({<br> create_sns_topic = bool<br> sns_topic_arn = string<br> })<br> })</pre> | <pre>{<br> "bucket_details": {<br> "bucket_name": "elb-logs-random-id",<br> "create_bucket": true,<br> "force_destroy_bucket": true,<br> "path_expression": "*AWSLogs/<ACCOUNT-ID>/elasticloadbalancing/<REGION-NAME>/*"<br> },<br> "collector_id": "",<br> "cutoff_relative_time": "-1d",<br> "description": "This source is created using Sumo Logic terraform AWS elb module to collect AWS elb logs.",<br> "fields": {},<br> "iam_details": {<br> "create_iam_role": true,<br> "iam_role_arn": null<br> },<br> "paused": false,<br> "scan_interval": 300000,<br> "sns_topic_details": {<br> "create_sns_topic": true,<br> "sns_topic_arn": null<br> },<br> "source_category": "Labs/aws/elb",<br> "source_name": "Elb Source",<br> "sumo_account_id": 926226587429<br>}</pre> | no |
39+
| sumologic\_organization\_id | Appears on the Account Overview page that displays information about your Sumo Logic organization. Used for IAM Role in Sumo Logic AWS Sources. | `string` | n/a | yes |
40+
| wait\_for\_seconds | wait\_for\_seconds is used to delay sumo logic source creation. This helps persisting IAM role in AWS system.<br> Default value is 180 seconds.<br> If the AWS IAM role is created outside the module, the value can be decreased to 1 second. | `number` | `180` | no |
41+
42+
## Outputs
43+
44+
| Name | Description |
45+
|------|-------------|
46+
| aws\_iam\_role | AWS IAM role with permission to allow Sumo Logic to read logs from S3 Bucket. |
47+
| aws\_s3\_bucket | AWS S3 Bucket name created to Store the ELB logs. |
48+
| aws\_s3\_bucket\_notification | AWS S3 Bucket Notification attached to the AWS S3 Bucket |
49+
| aws\_serverlessapplicationrepository\_cloudformation\_stack | AWS CloudFormation stack for ALB Auto Enable access logs. |
50+
| aws\_sns\_subscription | AWS SNS subscription to Sumo Logic AWS ELB source. |
51+
| aws\_sns\_topic | AWS SNS topic attached to the AWS S3 bucket. |
52+
| random\_string | Random String value created. |
53+
| sumologic\_collector | Sumo Logic hosted collector. |
54+
| sumologic\_source | Sumo Logic AWS ELB source. |

‎aws/elasticloadbalancing/data.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
data "aws_region" "current" {}
2+
3+
data "aws_caller_identity" "current" {}
4+
5+
data "sumologic_caller_identity" "current" {}
6+
7+
data "aws_serverlessapplicationrepository_application" "app" {
8+
application_id = "arn:aws:serverlessrepo:us-east-1:956882708938:applications/sumologic-s3-logging-auto-enable"
9+
semantic_version = "1.0.2"
10+
}

‎aws/elasticloadbalancing/elb.tf‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# *************** Steps are as Below to create Sumo Logic ELB source *************** #
2+
# 1. Create AWS S3 Bucket. If the Bucket is created, create SNS Topic and SNS policy to attach to Bucket.
3+
# 2. Create IAM role in AWS with access to the bucket name provided.
4+
# 3. Create a Collector. If the Collector ID is provided, do not create a Collector.
5+
# 4. Create the source either in the collector created or in the collector id provided.
6+
# 5. Create SNS Subscription to be attached to the source and SNS Topic.
7+
# 6. Add SAM app for auto enable of access logs for ELBs.
8+
9+
resource "random_string" "aws_random" {
10+
length = 10
11+
special = false
12+
upper = false
13+
}
14+
15+
resource "aws_s3_bucket" "s3_bucket" {
16+
for_each = toset(var.source_details.bucket_details.create_bucket ? ["s3_bucket"] : [])
17+
18+
bucket = local.bucket_name
19+
force_destroy = var.source_details.bucket_details.force_destroy_bucket
20+
21+
policy = templatefile("${path.module}/templates/elb_bucket_policy.tmpl", {
22+
BUCKET_NAME = local.bucket_name
23+
ELB_ACCCOUNT_ID = local.region_to_elb_account_id[local.aws_region]
24+
})
25+
}
26+
27+
resource "aws_sns_topic" "sns_topic" {
28+
for_each = toset(var.source_details.sns_topic_details.create_sns_topic ? ["sns_topic"] : [])
29+
30+
name = "SumoLogic-Terraform-Elb-Module-${random_string.aws_random.id}"
31+
policy = templatefile("${path.module}/templates/sns_topic_policy.tmpl", {
32+
BUCKET_NAME = local.bucket_name,
33+
AWS_REGION = local.aws_region,
34+
SNS_TOPIC_NAME = "SumoLogic-Terraform-Elb-Module-${random_string.aws_random.id}",
35+
AWS_ACCOUNT = local.aws_account_id
36+
})
37+
}
38+
39+
resource "aws_s3_bucket_notification" "bucket_notification" {
40+
for_each = toset(var.source_details.sns_topic_details.create_sns_topic && var.source_details.bucket_details.create_bucket ? ["bucket_notification"] : [])
41+
42+
bucket = aws_s3_bucket.s3_bucket["s3_bucket"].id
43+
44+
topic {
45+
topic_arn = aws_sns_topic.sns_topic["sns_topic"].arn
46+
events = ["s3:ObjectCreated:Put"]
47+
}
48+
}
49+
50+
resource "aws_iam_role" "source_iam_role" {
51+
for_each = toset(var.source_details.iam_details.create_iam_role ? ["source_iam_role"] : [])
52+
53+
name = "SumoLogic-Terraform-Elb-Module-${random_string.aws_random.id}"
54+
path = "/"
55+
56+
assume_role_policy = templatefile("${path.module}/templates/sumologic_assume_role.tmpl", {
57+
SUMO_LOGIC_ACCOUNT_ID = var.source_details.sumo_account_id,
58+
ENVIRONMENT = data.sumologic_caller_identity.current.environment,
59+
SUMO_LOGIC_ORG_ID = var.sumologic_organization_id
60+
})
61+
62+
managed_policy_arns = [aws_iam_policy.iam_policy["iam_policy"].arn]
63+
}
64+
65+
resource "aws_iam_policy" "iam_policy" {
66+
for_each = toset(var.source_details.iam_details.create_iam_role ? ["iam_policy"] : [])
67+
68+
name = "SumoLogicElbSource-${random_string.aws_random.id}"
69+
policy = templatefile("${path.module}/templates/sumologic_source_policy.tmpl", {
70+
BUCKET_NAME = local.bucket_name
71+
})
72+
}
73+
74+
resource "sumologic_collector" "collector" {
75+
for_each = toset(var.create_collector ? ["collector"] : [])
76+
name = local.collector_name
77+
description = var.collector_details.description
78+
fields = var.collector_details.fields
79+
timezone = "UTC"
80+
}
81+
82+
resource "time_sleep" "wait_for_seconds" {
83+
create_duration = "${var.wait_for_seconds}s"
84+
}
85+
86+
resource "sumologic_elb_source" "source" {
87+
depends_on = [
88+
time_sleep.wait_for_seconds
89+
]
90+
91+
lifecycle {
92+
ignore_changes = [cutoff_timestamp, cutoff_relative_time]
93+
}
94+
category = var.source_details.source_category
95+
collector_id = var.create_collector ? sumologic_collector.collector["collector"].id : var.source_details.collector_id
96+
content_type = "AwsElbBucket"
97+
cutoff_relative_time = var.source_details.cutoff_relative_time
98+
description = var.source_details.description
99+
fields = var.source_details.fields
100+
name = var.source_details.source_name
101+
paused = var.source_details.paused
102+
scan_interval = var.source_details.scan_interval
103+
authentication {
104+
type = "AWSRoleBasedAuthentication"
105+
role_arn = var.source_details.iam_details.create_iam_role ? aws_iam_role.source_iam_role["source_iam_role"].arn : var.source_details.iam_details.iam_role_arn
106+
}
107+
108+
path {
109+
type = "S3BucketPathExpression"
110+
bucket_name = var.source_details.bucket_details.create_bucket ? aws_s3_bucket.s3_bucket["s3_bucket"].id : local.bucket_name
111+
path_expression = local.logs_path_expression
112+
}
113+
}
114+
115+
resource "aws_sns_topic_subscription" "subscription" {
116+
delivery_policy = jsonencode({
117+
"guaranteed" = false,
118+
"healthyRetryPolicy" = {
119+
"numRetries" = 40,
120+
"minDelayTarget" = 10,
121+
"maxDelayTarget" = 300,
122+
"numMinDelayRetries" = 3,
123+
"numMaxDelayRetries" = 5,
124+
"numNoDelayRetries" = 0,
125+
"backoffFunction" = "exponential"
126+
},
127+
"sicklyRetryPolicy" = null,
128+
"throttlePolicy" = null
129+
})
130+
endpoint = sumologic_elb_source.source.url
131+
endpoint_auto_confirms = true
132+
protocol = "https"
133+
topic_arn = var.source_details.sns_topic_details.create_sns_topic ? aws_sns_topic.sns_topic["sns_topic"].arn : var.source_details.sns_topic_details.sns_topic_arn
134+
}
135+
136+
# Reason to use the SAM app, is to have single source of truth for Auto Enable access logs functionality.
137+
resource "aws_serverlessapplicationrepository_cloudformation_stack" "auto_enable_access_logs" {
138+
for_each = toset(local.auto_enable_access_logs ? ["auto_enable_access_logs"] : [])
139+
140+
name = "Auto-Enable-Access-Logs-${var.auto_enable_access_logs_options.auto_enable_logging}-${random_string.aws_random.id}"
141+
application_id = "arn:aws:serverlessrepo:us-east-1:956882708938:applications/sumologic-s3-logging-auto-enable"
142+
semantic_version = var.app_semantic_version
143+
capabilities = data.aws_serverlessapplicationrepository_application.app.required_capabilities
144+
parameters = {
145+
BucketName = local.bucket_name
146+
BucketPrefix = var.auto_enable_access_logs_options.bucket_prefix
147+
AutoEnableLogging = var.auto_enable_access_logs_options.auto_enable_logging
148+
AutoEnableResourceOptions = var.auto_enable_access_logs
149+
FilterExpression = var.auto_enable_access_logs_options.filter
150+
RemoveOnDeleteStack = var.auto_enable_access_logs_options.remove_on_delete_stack
151+
}
152+
}

‎aws/elasticloadbalancing/locals.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
locals {
2+
3+
aws_account_id = data.aws_caller_identity.current.account_id
4+
5+
aws_region = data.aws_region.current.id
6+
7+
# Get the default collector name if no collector name is provided.
8+
collector_name = var.collector_details.collector_name == "SumoLogic Elb Collector <Random ID>" ? "SumoLogic Elb Collector ${random_string.aws_random.id}" : var.collector_details.collector_name
9+
10+
# Get the default bucket name when no bucket is provided and create_bucket is true.
11+
bucket_name = var.source_details.bucket_details.create_bucket && var.source_details.bucket_details.bucket_name == "elb-logs-random-id" ? "elb-logs-${random_string.aws_random.id}" : var.source_details.bucket_details.bucket_name
12+
13+
# Auto enable should be called if input is anything other than None.
14+
auto_enable_access_logs = var.auto_enable_access_logs != "None" ? true : false
15+
16+
# If we create the bucket, then get the default PATH expression.
17+
logs_path_expression = var.source_details.bucket_details.create_bucket ? "*${var.auto_enable_access_logs_options.bucket_prefix}/AWSLogs/${local.aws_account_id}/elasticloadbalancing/${local.aws_region}/*" : var.source_details.bucket_details.path_expression
18+
19+
region_to_elb_account_id = {
20+
"us-east-1" = "127311923021",
21+
"us-east-2" = "033677994240",
22+
"us-west-1" = "027434742980",
23+
"us-west-2" = "797873946194",
24+
"af-south-1" = "098369216593",
25+
"ca-central-1" = "985666609251",
26+
"eu-central-1" = "054676820928",
27+
"eu-west-1" = "156460612806",
28+
"eu-west-2" = "652711504416",
29+
"eu-south-1" = "635631232127",
30+
"eu-west-3" = "009996457667",
31+
"eu-north-1" = "897822967062",
32+
"ap-east-1" = "754344448648",
33+
"ap-northeast-1" = "582318560864",
34+
"ap-northeast-2" = "600734575887",
35+
"ap-northeast-3" = "383597477331",
36+
"ap-southeast-1" = "114774131450",
37+
"ap-southeast-2" = "783225319266",
38+
"ap-south-1" = "718504428378",
39+
"me-south-1" = "076674570225",
40+
"sa-east-1" = "507241528517",
41+
"us-gov-west-1" = "048591011584",
42+
"us-gov-east-1" = "190560391635",
43+
"cn-north-1" = "638102146993",
44+
"cn-northwest-1" = "037604701340"
45+
}
46+
}

‎aws/elasticloadbalancing/outputs.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
output "random_string" {
2+
value = random_string.aws_random
3+
description = "Random String value created."
4+
}
5+
6+
output "aws_s3_bucket" {
7+
value = var.source_details.bucket_details.create_bucket ? aws_s3_bucket.s3_bucket : {}
8+
description = "AWS S3 Bucket name created to Store the ELB logs."
9+
}
10+
11+
output "aws_sns_topic" {
12+
value = var.source_details.sns_topic_details.create_sns_topic ? aws_sns_topic.sns_topic : {}
13+
description = "AWS SNS topic attached to the AWS S3 bucket."
14+
}
15+
16+
output "aws_s3_bucket_notification" {
17+
value = var.source_details.sns_topic_details.create_sns_topic && var.source_details.bucket_details.create_bucket ? aws_s3_bucket_notification.bucket_notification : {}
18+
description = "AWS S3 Bucket Notification attached to the AWS S3 Bucket"
19+
}
20+
21+
output "aws_iam_role" {
22+
value = var.source_details.iam_details.create_iam_role ? aws_iam_role.source_iam_role : {}
23+
description = "AWS IAM role with permission to allow Sumo Logic to read logs from S3 Bucket."
24+
}
25+
26+
output "sumologic_collector" {
27+
value = var.create_collector ? sumologic_collector.collector : {}
28+
description = "Sumo Logic hosted collector."
29+
}
30+
31+
output "sumologic_source" {
32+
value = sumologic_elb_source.source
33+
description = "Sumo Logic AWS ELB source."
34+
}
35+
36+
output "aws_sns_subscription" {
37+
value = aws_sns_topic_subscription.subscription
38+
description = "AWS SNS subscription to Sumo Logic AWS ELB source."
39+
}
40+
41+
output "aws_serverlessapplicationrepository_cloudformation_stack" {
42+
value = local.auto_enable_access_logs ? aws_serverlessapplicationrepository_cloudformation_stack.auto_enable_access_logs : {}
43+
description = "AWS CloudFormation stack for ALB Auto Enable access logs."
44+
}

‎aws/elasticloadbalancing/templates/elb_bucket_policy.tmpl‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Principal": {
7+
"AWS": "arn:aws:iam::${ELB_ACCCOUNT_ID}:root"
8+
},
9+
"Action": "s3:PutObject",
10+
"Resource": "arn:aws:s3:::${BUCKET_NAME}/*"
11+
},
12+
{
13+
"Effect": "Allow",
14+
"Principal": {
15+
"Service": "delivery.logs.amazonaws.com"
16+
},
17+
"Action": "s3:PutObject",
18+
"Resource": "arn:aws:s3:::${BUCKET_NAME}/*",
19+
"Condition": {
20+
"StringEquals": {
21+
"s3:x-amz-acl": "bucket-owner-full-control"
22+
}
23+
}
24+
},
25+
{
26+
"Effect": "Allow",
27+
"Principal": {
28+
"Service": "delivery.logs.amazonaws.com"
29+
},
30+
"Action": "s3:GetBucketAcl",
31+
"Resource": "arn:aws:s3:::${BUCKET_NAME}"
32+
}
33+
]
34+
}

‎aws/elasticloadbalancing/templates/sns_topic_policy.tmpl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"Statement": [
3+
{
4+
"Action": "sns:Publish",
5+
"Condition": {
6+
"StringEquals": {
7+
"aws:SourceAccount": "${AWS_ACCOUNT}"
8+
},
9+
"ArnLike": {
10+
"aws:SourceArn": "arn:aws:s3:::${BUCKET_NAME}"
11+
}
12+
},
13+
"Effect": "Allow",
14+
"Principal": {
15+
"Service": "s3.amazonaws.com"
16+
},
17+
"Resource": "arn:aws:sns:${AWS_REGION}:${AWS_ACCOUNT}:${SNS_TOPIC_NAME}"
18+
}
19+
],
20+
"Version": "2008-10-17"
21+
}

‎aws/elasticloadbalancing/templates/sumologic_assume_role.tmpl‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": "sts:AssumeRole",
6+
"Principal": {
7+
"AWS": "arn:aws:iam::${SUMO_LOGIC_ACCOUNT_ID}:root"
8+
},
9+
"Effect": "Allow",
10+
"Condition": {
11+
"StringEquals": {
12+
"sts:ExternalId": "${ENVIRONMENT}:${SUMO_LOGIC_ORG_ID}"
13+
}
14+
}
15+
}
16+
]
17+
}

0 commit comments

Comments
 (0)