diff --git a/demo.ts b/demo.ts index be05a75..fa35aa8 100644 --- a/demo.ts +++ b/demo.ts @@ -8,7 +8,8 @@ async function runDemo() { console.log('Starting demo...') process.env.ENVIRONMENT = 'demo-1' - process.env.ACCOUNT = 'demo' + process.env.AWS_ACCOUNT_NAME = 'demo' + process.env.AWS_ACCOUNT_ID = '987654321' const event = anApplicationLogCloudWatchEvent.input event.records = [ diff --git a/spec/fixtures/cloudtrail_fixtures.ts b/spec/fixtures/cloudtrail_fixtures.ts index 12f92f4..f87ef1d 100644 --- a/spec/fixtures/cloudtrail_fixtures.ts +++ b/spec/fixtures/cloudtrail_fixtures.ts @@ -35,7 +35,7 @@ export const aCloudTrailLogCloudWatchEvent: Fixture = { recordId: 'LogEvent-1', data: Buffer.from([ { - host: 'test', + host: '223851549868', source: 'cloudtrail', sourcetype: 'aws:cloudtrail', index: 'pay_platform', @@ -46,7 +46,7 @@ export const aCloudTrailLogCloudWatchEvent: Fixture = { time: 1739979788.000 }, { - host: 'test', + host: '223851549868', source: 'cloudtrail', sourcetype: 'aws:cloudtrail', index: 'pay_platform', diff --git a/spec/index.test.ts b/spec/index.test.ts index 6ae30e7..6dafd1b 100644 --- a/spec/index.test.ts +++ b/spec/index.test.ts @@ -57,7 +57,8 @@ import { import { SplunkRecord } from '../src/types' process.env.ENVIRONMENT = 'test-12' -process.env.ACCOUNT = 'test' +process.env.AWS_ACCOUNT_NAME = 'test' +process.env.AWS_ACCOUNT_ID = '223851549868' describe('Processing CloudWatchLogEvents', () => { describe('From Applications', () => { @@ -457,14 +458,23 @@ describe('General processing', () => { }) test('should error if ENVIRONMENT env var is not set', async () => { - process.env.ACCOUNT = 'test' + process.env.AWS_ACCOUNT_NAME = 'test' + process.env.AWS_ACCOUNT_ID = '223851549868' process.env.ENVIRONMENT = '' await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"ENVIRONMENT" env var is not set') }) - test('should error if ACCOUNT env var is not set', async () => { + test('should error if AWS_ACCOUNT_NAME env var is not set', async () => { process.env.ENVIRONMENT = 'test-12' - process.env.ACCOUNT = '' - await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"ACCOUNT" env var is not set') + process.env.AWS_ACCOUNT_ID = '223851549868' + process.env.AWS_ACCOUNT_NAME = '' + await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"AWS_ACCOUNT_NAME" env var is not set') + }) + + test('should error if AWS_ACCOUNT_ID env var is not set', async () => { + process.env.ENVIRONMENT = 'test-12' + process.env.AWS_ACCOUNT_NAME = 'test' + process.env.AWS_ACCOUNT_ID = '' + await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"AWS_ACCOUNT_ID" env var is not set') }) }) diff --git a/src/index.ts b/src/index.ts index 6486b56..131de8d 100644 --- a/src/index.ts +++ b/src/index.ts @@ -18,7 +18,8 @@ function getMandatoryEnvVar(varName: string): string { function getEnvVars(): EnvVars { return { environment: getMandatoryEnvVar('ENVIRONMENT'), - account: getMandatoryEnvVar('ACCOUNT') + aws_account_name: getMandatoryEnvVar('AWS_ACCOUNT_NAME'), + aws_account_id: getMandatoryEnvVar('AWS_ACCOUNT_ID') } } diff --git a/src/transformData.ts b/src/transformData.ts index e9f95d5..75764f4 100644 --- a/src/transformData.ts +++ b/src/transformData.ts @@ -28,7 +28,7 @@ function transformALBLog(data: S3LogRecord, envVars: EnvVars, approximateArrival index: 'pay_ingress', event: log, fields: { - account: envVars.account, + account: envVars.aws_account_name, environment: envVars.environment, service: getAlbService(data.ALB as string, envVars.environment) }, @@ -65,7 +65,7 @@ function transformS3AccessLog(data: S3LogRecord, envVars: EnvVars, approximateAr index: 'pay_storage', event: log, fields: { - account: envVars.account, + account: envVars.aws_account_name, environment: envVars.environment }, time @@ -89,10 +89,10 @@ function transformCloudWatchData(data: CloudWatchLogsDecodedData, envVars: EnvVa validateLogGroup(data.logGroup) const logType: CloudWatchLogTypes = getLogTypeFromLogGroup(data.logGroup) - const host = logType === CloudWatchLogTypes['cloudtrail'] ? envVars.account : data.logStream + const host = logType === CloudWatchLogTypes['cloudtrail'] ? envVars.aws_account_id : data.logStream const source = CloudWatchLogTypes[logType] const index = indexFromLogType(logType) - const account = envVars.account + const account = envVars.aws_account_name const fields: SplunkFields = { account } diff --git a/src/types.ts b/src/types.ts index 6046e7b..7820f57 100644 --- a/src/types.ts +++ b/src/types.ts @@ -32,7 +32,8 @@ export type S3LogRecord = { export type EnvVars = { environment: string - account: string + aws_account_name: string + aws_account_id: string } export enum CloudWatchLogTypes {