terraform-aws-firehose/main.tf at master · comtravo/terraform-aws-firehose · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
/**
* # Terraform AWS module for AWS Kinesis Firehose
*
* ## Introduction
*
* This module creates a Kinesis Firehose and all the resources related to it to log to S3.
*
* ## Usage
* Checkout [test.tf](./tests/test.tf) for how to use this module
*
* ## Authors
*
* Module managed by [Comtravo](https://github.com/comtravo).
*
* ## License
*
* MIT Licensed. See [LICENSE](LICENSE) for full details.
*/

###############################################################################
#                                    VARIABLES                                #
###############################################################################

variable "name" {
  type        = string
  description = "Name of the firehose"
}

variable "account_id" {
  type        = string
  description = "AWS account ID"
}

variable "region" {
  default     = "eu-west-1"
  type        = string
  description = "AWS region"
}

variable "destination" {
  default     = "s3"
  type        = string
  description = "Kinesis Firehose Destination"
}

variable "s3_configuration" {
  type = object({
    bucket_arn      = string,
    buffer_interval = number,
    buffer_size     = number,
    prefix          = string
  })
  description = "AWS S3 configuration"
}

variable "enable" {
  type        = bool
  description = "Enable firehose"
  default     = true
}

locals {
  enable_count = var.enable ? 1 : 0
}

###############################################################################
#                                    MAIN                                     #
###############################################################################

resource "aws_iam_role" "firehose_role" {
  count                 = local.enable_count
  name                  = var.name
  path                  = "/environment/${terraform.workspace}/"
  force_detach_policies = true

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "firehose.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF

}

data "aws_iam_policy_document" "firehose_role" {
  statement {
    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    resources = [
      lookup(var.s3_configuration, "bucket_arn"),
      "${lookup(var.s3_configuration, "bucket_arn")}/*"
    ]
  }

  statement {
    actions = [
      "logs:*",
    ]

    resources = [
      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/kinesisfirehose/${var.name}:log-stream:*",
    ]
  }
}

resource "aws_iam_role_policy" "firehose_role" {
  count = local.enable_count
  name  = var.name
  role  = aws_iam_role.firehose_role[0].id

  policy = data.aws_iam_policy_document.firehose_role.json
}

resource "aws_kinesis_firehose_delivery_stream" "stream" {
  count       = local.enable_count
  name        = var.name
  destination = var.destination

  s3_configuration {
    role_arn        = aws_iam_role.firehose_role[0].arn
    bucket_arn      = lookup(var.s3_configuration, "bucket_arn")
    buffer_interval = lookup(var.s3_configuration, "buffer_interval")
    buffer_size     = lookup(var.s3_configuration, "buffer_size")
    prefix          = lookup(var.s3_configuration, "prefix")

    cloudwatch_logging_options {
      enabled         = true
      log_group_name  = "/aws/kinesisfirehose/${var.name}"
      log_stream_name = "S3Delivery"
    }
  }
}

output "arn" {
  value       = var.enable ? aws_kinesis_firehose_delivery_stream.stream[0].arn : ""
  description = "ARN of the Kinesis Firehose"
}