Merge pull request #35 from SumoLogic/awso-v2.11

Awso v2.11

Author: himsharma01

aws/cloudwatchlogsforwarder/README.md

@@ -196,6 +196,7 @@ resource "aws_serverlessapplicationrepository_cloudformation_stack" "auto_enable
     DestinationArnType  = "Lambda"
     DestinationArnValue = aws_lambda_function.logs_lambda_function.arn
     LogGroupPattern     = var.auto_enable_logs_subscription_options.filter
+    LogGroupTags        = var.auto_enable_logs_subscription_options.tags_filter
     UseExistingLogs     = local.auto_enable_existing
   }
 }

aws/cloudwatchlogsforwarder/cloudwatchlogsforwarder.tf

@@ -21,9 +21,10 @@ module "cloudwatch_logs_lambda_log_forwarder_module" {
   }
 
   auto_enable_logs_subscription = "Both"
-  app_semantic_version = "1.0.11"
+  app_semantic_version = "1.0.14"
   auto_enable_logs_subscription_options = {
     filter = "lambda|rds"
+    tags_filter = ""
   }
 }
 

aws/cloudwatchlogsforwarder/examples/default/main.tf

@@ -78,7 +78,7 @@ variable "source_details" {
 variable "app_semantic_version" {
   type        = string
   description = "Provide the latest version of Serverless Application Repository 'sumologic-loggroup-connector'."
-  default = "1.0.11"
+  default = "1.0.14"
 }
 
 variable "auto_enable_logs_subscription" {
@@ -103,14 +103,17 @@ variable "auto_enable_logs_subscription" {
 variable "auto_enable_logs_subscription_options" {
   type = object({
     filter = string
+    tags_filter = string
   })
 
   description = <<EOT
-		filter - Enter regex for matching logGroups. Regex will check for the name. Visit https://help.sumologic.com/03Send-Data/Collect-from-Other-Data-Sources/Auto-Subscribe_AWS_Log_Groups_to_a_Lambda_Function#Configuring_parameters
+		filter - Enter regex for matching logGroups. Regex will check for the name.
+        tags_filter - Enter comma separated key value pairs for filtering logGroups using tags. Ex KeyName1=string,KeyName2=string. This is optional leave it blank if tag based filtering is not needed.
+        Visit https://help.sumologic.com/docs/send-data/collect-from-other-data-sources/autosubscribe-arn-destination/#configuringparameters
 	EOT
 
   default = {
     filter = "lambda"
+    tags_filter = ""
   }
 }
-

aws/cloudwatchlogsforwarder/variables.tf

@@ -19,8 +19,6 @@ resource "aws_iam_role" "source_iam_role" {
     ENVIRONMENT           = data.sumologic_caller_identity.current.environment,
     SUMO_LOGIC_ORG_ID     = var.sumologic_organization_id
   })
-
-  managed_policy_arns = [aws_iam_policy.iam_policy["iam_policy"].arn]
 }
 
 resource "aws_iam_policy" "iam_policy" {
@@ -30,6 +28,14 @@ resource "aws_iam_policy" "iam_policy" {
   policy = templatefile("${path.module}/templates/sumologic_source_policy.tmpl", {})
 }
 
+resource "aws_iam_role_policy_attachment" "policy_attachment" {
+  depends_on = [aws_iam_policy.iam_policy]
+  for_each = toset(var.source_details.iam_details.create_iam_role ? ["source_iam_role"] : [])
+
+  role       = aws_iam_role.source_iam_role[each.key].name
+  policy_arn = aws_iam_policy.iam_policy["iam_policy"].arn
+}
+
 resource "sumologic_collector" "collector" {
   for_each    = toset(var.create_collector ? ["collector"] : [])
   name        = local.collector_name
@@ -64,6 +70,14 @@ resource "sumologic_cloudwatch_source" "cloudwatch_metrics_sources" {
     type                = "CloudWatchPath"
     limit_to_regions    = var.source_details.limit_to_regions
     limit_to_namespaces = var.source_details.limit_to_namespaces
+
+    dynamic "tag_filters" {
+    for_each = var.source_details.tag_filters
+    content {
+      type = tag_filters.value.type
+      namespace = tag_filters.value.namespace
+      tags = tag_filters.value.tags
+    }
+   }
   }
 }
-

aws/cloudwatchmetrics/cloudwatchmetrics.tf

@@ -12,7 +12,20 @@ module "cloudwatch_metrics" {
             "create_iam_role": true,
             "iam_role_arn": null
         },
-        "limit_to_namespaces": ["aws/ec2"],
+        "limit_to_namespaces": ["AWS/EC2", "AWS/ApiGateway", "AWS/ApplicationELB"],
+        "tag_filters": [{
+          "type" = "TagFilters"
+          "namespace" = "AWS/EC2"
+          "tags" = ["env=prod;dev"]
+        },{
+          "type" = "TagFilters"
+          "namespace" = "AWS/ApiGateway"
+          "tags" = ["env=prod;dev"]
+        },{
+          "type" = "TagFilters"
+          "namespace" = "AWS/ApplicationELB"
+          "tags" = ["env=dev"]
+        }],
         "limit_to_regions": ["eu-central-1"],
         "paused": false,
         "scan_interval": 300000,

aws/cloudwatchmetrics/examples/default/main.tf

@@ -25,6 +25,11 @@ variable "source_details" {
     description         = string
     limit_to_regions    = list(string)
     limit_to_namespaces = list(string)
+    tag_filters = list(object({
+      type      = string
+      namespace = string
+      tags      = list(string)
+    }))
     paused              = bool
     scan_interval       = number
     sumo_account_id     = number
@@ -42,6 +47,7 @@ variable "source_details" {
     collector_id        = ""
     limit_to_regions    = ["us-east-1"]
     limit_to_namespaces = ["AWS/ApplicationELB","AWS/ApiGateway","AWS/DynamoDB","AWS/Lambda","AWS/RDS","AWS/ECS","AWS/ElastiCache","AWS/ELB","AWS/NetworkELB","AWS/SQS","AWS/SNS"]
+    tag_filters         = []
     scan_interval       = 300000
     paused              = false
     sumo_account_id     = 926226587429

aws/cloudwatchmetrics/variables.tf

@@ -24,8 +24,9 @@ module "kinesis_firehose_for_logs_module" {
   }
 
   auto_enable_logs_subscription = "Both"
-  app_semantic_version = "1.0.11"
+  app_semantic_version = "1.0.14"
   auto_enable_logs_subscription_options = {
     filter = "lambda|rds"
+    tags_filter = ""
   }
 }

aws/kinesisfirehoseforlogs/README.md

@@ -178,6 +178,7 @@ resource "aws_serverlessapplicationrepository_cloudformation_stack" "auto_enable
     DestinationArnType  = "Kinesis"
     DestinationArnValue = aws_kinesis_firehose_delivery_stream.logs_delivery_stream.arn
     LogGroupPattern     = var.auto_enable_logs_subscription_options.filter
+    LogGroupTags        = var.auto_enable_logs_subscription_options.tags_filter
     UseExistingLogs     = local.auto_enable_existing
     RoleArn             = aws_iam_role.logs_role.arn
   }