add logging for more lbs

Author: araman-m

terraform/instances-template/instance-ds.tf

@@ -429,16 +429,22 @@ resource "aws_lb" "ds" {
   #subnets            = [local.subnet_pub_1_id, local.subnet_pub_2_id, local.subnet_pub_3_id]
   subnets            = (local.use-elb-private-ds == "false" ? [local.subnet_pub_1_id, local.subnet_pub_2_id, local.subnet_pub_3_id] : [local.subnet_priv_1_id, local.subnet_priv_2_id, local.subnet_priv_3_id])
   internal = local.use-elb-private-ds
+  # Tracks HTTP Requests
   access_logs {
     bucket  = aws_s3_bucket.s3_data.bucket
     prefix  = "log/lbds"
     enabled = true
   }
-  #connection_logs {
-  #  bucket  = aws_s3_bucket.s3_data.bucket
-  #  prefix  = "log/lbdscon"
-  #  enabled = true
-  #}
+  # Tracks TCP/TLS Connections (ALB only)
+  connection_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbdscon"
+    enabled = true
+  }
+  # Critical: Ensure the policy is attached before the LB tries to verify access
+  depends_on = [
+    aws_s3_bucket_policy.allow_access_for_lb_logs
+  ]
 }
 
 # This create a alias which point on ELB when available so we can use a pretty name

terraform/instances-template/instance-idx.tf

@@ -523,6 +523,22 @@ resource "aws_lb" "idxhec-noack" {
   drop_invalid_header_fields = true
   security_groups    = [aws_security_group.splunk-lb-hecidx-outbound.id, aws_security_group.splunk-lbhecidx.id]
   subnets            = (local.use-elb-private == "false" ? [local.subnet_pub_1_id, local.subnet_pub_2_id, local.subnet_pub_3_id] : [local.subnet_priv_1_id, local.subnet_priv_2_id, local.subnet_priv_3_id])
+  # Tracks HTTP Requests
+  access_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbidxnoack"
+    enabled = true
+  }
+  # Tracks TCP/TLS Connections (ALB only)
+  connection_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbidxnoack"
+    enabled = true
+  }
+  # Critical: Ensure the policy is attached before the LB tries to verify access
+  depends_on = [
+    aws_s3_bucket_policy.allow_access_for_lb_logs
+  ]
 }
 
 
@@ -534,6 +550,22 @@ resource "aws_lb" "idxhec-ack" {
   drop_invalid_header_fields = true
   security_groups    = [aws_security_group.splunk-lb-hecidx-outbound.id, aws_security_group.splunk-lbhecidx.id]
   subnets            = (local.use-elb-private == "false" ? [local.subnet_pub_1_id, local.subnet_pub_2_id, local.subnet_pub_3_id] : [local.subnet_priv_1_id, local.subnet_priv_2_id, local.subnet_priv_3_id])
+  # Tracks HTTP Requests
+  access_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbidxack"
+    enabled = true
+  }
+  # Tracks TCP/TLS Connections (ALB only)
+  connection_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbidxack"
+    enabled = true
+  }
+  # Critical: Ensure the policy is attached before the LB tries to verify access
+  depends_on = [
+    aws_s3_bucket_policy.allow_access_for_lb_logs
+  ]
 }
 
 

terraform/instances-template/instance-ihf.tf

@@ -381,6 +381,23 @@ resource "aws_lb" "ihfhec-noack" {
   security_groups    = [aws_security_group.splunk-lb-hecihf-outbound.id, aws_security_group.splunk-lbhecihf.id]
   subnets            = (local.use-elb-private == "false" ? [local.subnet_pub_1_id, local.subnet_pub_2_id, local.subnet_pub_3_id] : [local.subnet_priv_1_id, local.subnet_priv_2_id, local.subnet_priv_3_id])
   drop_invalid_header_fields = true
+  # Tracks HTTP Requests
+  access_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbhecnoack"
+    enabled = true
+  }
+  # Tracks TCP/TLS Connections (ALB only)
+  connection_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbhecnoack"
+    enabled = true
+  }
+  # Critical: Ensure the policy is attached before the LB tries to verify access
+  depends_on = [
+    aws_s3_bucket_policy.allow_access_for_lb_logs
+  ]
+
 }
 
 

terraform/instances-template/instance-shc.tf

@@ -638,6 +638,22 @@ resource "aws_lb" "shc-users" {
   tags = {
     Type = "Splunk"
   }
+  # Tracks HTTP Requests
+  access_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbshcusers"
+    enabled = true
+  }
+  # Tracks TCP/TLS Connections (ALB only)
+  connection_logs {
+    bucket  = aws_s3_bucket.s3_data.bucket
+    prefix  = "log/lbshcusers"
+    enabled = true
+  }
+  # Critical: Ensure the policy is attached before the LB tries to verify access
+  depends_on = [
+    aws_s3_bucket_policy.allow_access_for_lb_logs
+  ]
 }
 
 resource "aws_alb_listener" "shc-users" {

terraform/s3buckets.tf

@@ -254,8 +254,6 @@ resource "aws_s3_bucket_lifecycle_configuration" "s3_data_lifecycle" {
 
 resource "aws_s3_bucket_policy" "allow_access_for_lb_logs" {
   bucket = aws_s3_bucket.s3_data.id
-  #policy = data.template_file.pol-splunk-s3iafs.rendered 
-  #policy = local.pol-splunk-s3iafs
   policy = data.aws_iam_policy_document.s3_bucket_lb_write.json
 }