Skip to content

Commit daecc8d

Browse files
bryantbiggsbryantbiggs
committed
fix: Update examples to resolve CI errors for outdated modules
1 parent d951ce9 commit daecc8d

File tree

8 files changed

+218
-335
lines changed

8 files changed

+218
-335
lines changed

‎examples/log-account-policy/README.md‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,27 +21,20 @@
2121
| Name | Source | Version |
2222
|------|--------|---------|
2323
| <a name="module_audit_destination_group"></a> [audit\_destination\_group](#module\_audit\_destination\_group) | ../../modules/log-group | n/a |
24-
| <a name="module_cw_logs_to_firehose"></a> [cw\_logs\_to\_firehose](#module\_cw\_logs\_to\_firehose) | terraform-aws-modules/iam/aws//modules/iam-assumable-role | ~> 5.0 |
25-
| <a name="module_cw_logs_to_firehose_policy"></a> [cw\_logs\_to\_firehose\_policy](#module\_cw\_logs\_to\_firehose\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | ~> 5.0 |
24+
| <a name="module_cw_logs_to_firehose_iam_role"></a> [cw\_logs\_to\_firehose\_iam\_role](#module\_cw\_logs\_to\_firehose\_iam\_role) | terraform-aws-modules/iam/aws//modules/iam-role | ~> 6.0 |
2625
| <a name="module_excluded_log_group"></a> [excluded\_log\_group](#module\_excluded\_log\_group) | ../../modules/log-group | n/a |
27-
| <a name="module_firehose_to_s3"></a> [firehose\_to\_s3](#module\_firehose\_to\_s3) | terraform-aws-modules/iam/aws//modules/iam-assumable-role | ~> 5.0 |
28-
| <a name="module_firehose_to_s3_policy"></a> [firehose\_to\_s3\_policy](#module\_firehose\_to\_s3\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | ~> 5.0 |
26+
| <a name="module_firehose_to_s3_iam_role"></a> [firehose\_to\_s3\_iam\_role](#module\_firehose\_to\_s3\_iam\_role) | terraform-aws-modules/iam/aws//modules/iam-role | ~> 6.0 |
2927
| <a name="module_log_account_data_retention_policy"></a> [log\_account\_data\_retention\_policy](#module\_log\_account\_data\_retention\_policy) | ../../modules/log-account-policy | n/a |
3028
| <a name="module_log_account_subscription_filter_policy"></a> [log\_account\_subscription\_filter\_policy](#module\_log\_account\_subscription\_filter\_policy) | ../../modules/log-account-policy | n/a |
3129
| <a name="module_log_group"></a> [log\_group](#module\_log\_group) | ../../modules/log-group | n/a |
32-
| <a name="module_logs_bucket"></a> [logs\_bucket](#module\_logs\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 4.0 |
30+
| <a name="module_logs_bucket"></a> [logs\_bucket](#module\_logs\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 5.0 |
3331

3432
## Resources
3533

3634
| Name | Type |
3735
|------|------|
3836
| [aws_kinesis_firehose_delivery_stream.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream) | resource |
3937
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
40-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
41-
| [aws_iam_policy_document.custom_trust_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
42-
| [aws_iam_policy_document.cw_logs_to_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
43-
| [aws_iam_policy_document.firehose_to_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
44-
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
4538

4639
## Inputs
4740

‎examples/log-account-policy/main.tf‎

Lines changed: 67 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@ provider "aws" {
22
region = "eu-west-1"
33
}
44

5-
data "aws_region" "current" {}
6-
7-
data "aws_caller_identity" "current" {}
8-
95
module "log_group" {
106
source = "../../modules/log-group"
117

@@ -53,15 +49,13 @@ module "log_account_subscription_filter_policy" {
5349
{
5450
DestinationArn = aws_kinesis_firehose_delivery_stream.logs.arn
5551
FilterPattern = "%test%"
56-
RoleArn = module.cw_logs_to_firehose.iam_role_arn
52+
RoleArn = module.cw_logs_to_firehose_iam_role.arn
5753
}
5854
)
5955
log_account_policy_selection_criteria = "LogGroupName NOT IN [\"${module.excluded_log_group.cloudwatch_log_group_name}\"]"
6056

6157
depends_on = [
6258
aws_kinesis_firehose_delivery_stream.logs,
63-
module.cw_logs_to_firehose,
64-
module.cw_logs_to_firehose_policy
6559
]
6660
}
6761

@@ -75,7 +69,7 @@ resource "random_pet" "this" {
7569

7670
module "logs_bucket" {
7771
source = "terraform-aws-modules/s3-bucket/aws"
78-
version = "~> 4.0"
72+
version = "~> 5.0"
7973

8074
bucket_prefix = "${random_pet.this.id}-logs"
8175

@@ -87,116 +81,82 @@ resource "aws_kinesis_firehose_delivery_stream" "logs" {
8781
destination = "extended_s3"
8882

8983
extended_s3_configuration {
90-
role_arn = module.firehose_to_s3.iam_role_arn
84+
role_arn = module.firehose_to_s3_iam_role.arn
9185
bucket_arn = module.logs_bucket.s3_bucket_arn
9286
prefix = "from-firehose-logs/"
9387
}
9488
}
9589

96-
module "firehose_to_s3" {
97-
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
98-
version = "~> 5.0"
99-
100-
trusted_role_services = [
101-
"firehose.amazonaws.com"
102-
]
103-
104-
create_role = true
105-
106-
role_name_prefix = "${random_pet.this.id}-firehose-to-s3-"
107-
role_requires_mfa = false
108-
109-
custom_role_policy_arns = [
110-
module.firehose_to_s3_policy.arn
111-
]
112-
}
113-
114-
module "firehose_to_s3_policy" {
115-
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
116-
version = "~> 5.0"
117-
118-
name = "${random_pet.this.id}-firehose-to-s3"
119-
path = "/"
120-
description = "Pipes logging firehose to s3 policy"
121-
122-
policy = data.aws_iam_policy_document.firehose_to_s3.json
123-
}
124-
125-
data "aws_iam_policy_document" "firehose_to_s3" {
126-
statement {
127-
effect = "Allow"
128-
129-
actions = [
130-
"s3:AbortMultipartUpload",
131-
"s3:GetBucketLocation",
132-
"s3:GetObject",
133-
"s3:ListBucket",
134-
"s3:ListBucketMultipartUploads",
135-
"s3:PutObject",
136-
]
137-
138-
resources = [
139-
module.logs_bucket.s3_bucket_arn,
140-
"${module.logs_bucket.s3_bucket_arn}/*",
141-
]
142-
}
143-
}
144-
145-
module "cw_logs_to_firehose" {
146-
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
147-
version = "~> 5.0"
148-
149-
create_role = true
150-
151-
role_name_prefix = "${random_pet.this.id}-cw-logs-to-firehose-"
152-
role_requires_mfa = false
153-
create_custom_role_trust_policy = true
154-
custom_role_trust_policy = data.aws_iam_policy_document.custom_trust_policy.json
155-
156-
custom_role_policy_arns = [
157-
module.cw_logs_to_firehose_policy.arn
158-
]
159-
}
160-
161-
data "aws_iam_policy_document" "custom_trust_policy" {
162-
statement {
163-
effect = "Allow"
164-
actions = ["sts:AssumeRole"]
165-
166-
condition {
167-
test = "StringLike"
168-
variable = "aws:SourceArn"
169-
values = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:*"]
90+
module "firehose_to_s3_iam_role" {
91+
source = "terraform-aws-modules/iam/aws//modules/iam-role"
92+
version = "~> 6.0"
93+
94+
name = "${random_pet.this.id}-firehose-to-s3-"
95+
96+
trust_policy_permissions = {
97+
TrustRoleAndServiceToAssume = {
98+
actions = [
99+
"sts:AssumeRole",
100+
"sts:TagSession",
101+
]
102+
principals = [{
103+
type = "Service"
104+
identifiers = [
105+
"firehose.amazonaws.com"
106+
]
107+
}]
170108
}
109+
}
171110

172-
principals {
173-
identifiers = ["logs.amazonaws.com"]
174-
type = "Service"
111+
create_inline_policy = true
112+
inline_policy_permissions = {
113+
FirehoseToS3 = {
114+
actions = [
115+
"s3:AbortMultipartUpload",
116+
"s3:GetBucketLocation",
117+
"s3:GetObject",
118+
"s3:ListBucket",
119+
"s3:ListBucketMultipartUploads",
120+
"s3:PutObject",
121+
]
122+
resources = [
123+
module.logs_bucket.s3_bucket_arn,
124+
"${module.logs_bucket.s3_bucket_arn}/*",
125+
]
175126
}
176127
}
177128
}
178129

179-
module "cw_logs_to_firehose_policy" {
180-
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
181-
version = "~> 5.0"
182-
183-
name = "${random_pet.this.id}-cw-logs-to-firehose"
184-
path = "/"
185-
description = "Cloudwatch logs to firehose policy"
186-
187-
policy = data.aws_iam_policy_document.cw_logs_to_firehose.json
188-
}
189-
190-
data "aws_iam_policy_document" "cw_logs_to_firehose" {
191-
statement {
192-
effect = "Allow"
193-
194-
actions = [
195-
"firehose:PutRecord",
196-
]
130+
module "cw_logs_to_firehose_iam_role" {
131+
source = "terraform-aws-modules/iam/aws//modules/iam-role"
132+
version = "~> 6.0"
133+
134+
name = "${random_pet.this.id}-cw-logs-to-firehose-"
135+
136+
trust_policy_permissions = {
137+
TrustRoleAndServiceToAssume = {
138+
actions = [
139+
"sts:AssumeRole",
140+
"sts:TagSession",
141+
]
142+
principals = [{
143+
type = "Service"
144+
identifiers = [
145+
"logs.amazonaws.com"
146+
]
147+
}]
148+
}
149+
}
197150

198-
resources = [
199-
aws_kinesis_firehose_delivery_stream.logs.arn,
200-
]
151+
create_inline_policy = true
152+
inline_policy_permissions = {
153+
CwLogsToFirehose = {
154+
actions = [
155+
"firehose:PutRecord",
156+
]
157+
resources = [
158+
aws_kinesis_firehose_delivery_stream.logs.arn,
159+
]
160+
}
201161
}
202162
}

‎examples/log-anomaly-detector/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
| Name | Source | Version |
2020
|------|--------|---------|
21-
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | ~> 1.0 |
21+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | ~> 4.0 |
2222
| <a name="module_log_anomaly_detector"></a> [log\_anomaly\_detector](#module\_log\_anomaly\_detector) | ../../modules/log-anomaly-detector | n/a |
2323
| <a name="module_log_group"></a> [log\_group](#module\_log\_group) | ../../modules/log-group | n/a |
2424

‎examples/log-anomaly-detector/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,9 @@ data "aws_caller_identity" "current" {}
3434
data "aws_region" "current" {}
3535

3636
module "kms" {
37-
source = "terraform-aws-modules/kms/aws"
38-
version = "~> 1.0"
37+
source = "terraform-aws-modules/kms/aws"
38+
version = "~> 4.0"
39+
3940
description = "KMS key for log anomaly detection"
4041

4142
key_owners = [data.aws_caller_identity.current.arn]

0 commit comments

Comments
 (0)