trussworks/terraform-aws-logs — 75 Stars

Topics

#aws #aws-cloudtrail #aws-s3 #logging #terraform #terraform-modules

Language breakdown

HCL 100.0%

▸ Files click to expand

README

Supports two main uses cases:

Creates and configures a single private S3 bucket for storing logs from various AWS services, which are nested as bucket prefixes. Logs will expire after a default of 90 days, with option to configure retention value.
Creates and configures a single private S3 bucket for a single AWS service. Logs will expire after a default of 90 days, with option to configure retention value.

Logging from the following services is supported for both cases as well as in AWS GovCloud:

Usage for a single log bucket storing logs from all services

# Allows all services to log to bucket
module "aws_logs" {
  source         = "trussworks/logs/aws"
  s3bucketname = "my-company-aws-logs"
}

Usage for a single log bucket storing logs from a single service (ELB in this case)

module "aws_logs" {
  source         = "trussworks/logs/aws"
  s3bucketname = "my-company-aws-logs-elb"
  default_allow  = false
  allow_elb      = true
}

Usage for a single log bucket storing logs from multiple specified services (ALB and ELB in this case)

module "aws_logs" {
  source         = "trussworks/logs/aws"
  s3bucketname = "my-company-aws-logs-lb"
  default_allow  = false
  allow_alb      = true
  allow_elb      = true
}

Usage for a single log bucket storing CloudTrail logs from multiple accounts

module "aws_logs" {
  source              = "trussworks/logs/aws"
  s3bucketname      = "my-company-aws-logs-cloudtrail"
  default_allow       = false
  allow_cloudtrail    = true
  cloudtrailaccounts = [data.awscalleridentity.current.accountid, awsorganizationsaccount.example.id]
}

Usage for a single log bucket storing logs from multiple application load balancers (ALB) and network load balancers (NLB)

module "aws_logs" {
  source            = "trussworks/logs/aws"
  s3bucketname    = "my-company-aws-logs-lb"
      default_allow     = false
      allow_alb         = true
      allow_nlb         = true
      alblogsprefixes = [
       "alb/hello-world-prod",
       "alb/hello-world-staging",
       "alb/hello-world-experimental",
      ]
      nlblogsprefixes = [
       "nlb/hello-world-prod",
       "nlb/hello-world-staging",
       "nlb/hello-world-experimental",
      ]
    }

Requirements

| Name | Version | |------|---------| | terraform | >= 1.0 | | aws | >= 3.75.0 |

Providers

| Name | Version | |------|---------| | aws | >= 3.75.0 |

Resources

Inputs

| Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | s3bucketname | S3 bucket to store AWS logs in. | string | n/a | yes | | alb_account | Account for ALB logs. By default limits to the current account. | string | "" | no | | alblogsprefixes | S3 key prefixes for ALB logs. | list(string) |

[ "alb" ]

[ "elb" ]

[ "nlb" ]

| no | | noncurrentversionretention | Number of days to retain non-current versions of objects if versioning is enabled. | string | 30 | no | | object_ownership | Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. | string | "BucketOwnerEnforced" | no | | redshiftlogsprefix | S3 prefix for RedShift logs. | string | "redshift" | no | | s3bucketacl | Set bucket ACL per AWS S3 Canned ACL list. | string | null | no | | s3logbucket_retention | Number of days to keep AWS logs around. | string | 90 | no | | s3logsprefix | S3 prefix for S3 access logs. | string | "s3" | no | | tags | A mapping of tags to assign to the logs bucket. Please note that tags with a conflicting key will not override the original tag. | map(string) | {} | no | | versioning_status | A string that indicates the versioning status for the log bucket. | string | "Disabled" | no |

Outputs

| Name | Description | |------|-------------| | awslogsbucket | ID of the S3 bucket containing AWS logs. | | bucket_arn | ARN of the S3 logs bucket | | configslogspath | S3 path for Config logs. | | elblogspath | S3 path for ELB logs. | | redshiftlogspath | S3 path for RedShift logs. | | s3bucketpolicy | S3 bucket policy |

Upgrade Paths

Upgrading from 14.x.x to 15.x.x

Version 15.x.x updates the module to account for changes made by AWS in April 2023 to the default security settings of new S3 buckets.

Version 15.x.x of this module adds the following resource and variables. How to use the new variables will depend on your use case.

New resource:

awss3bucketownershipcontrols.aws_logs

New variables:

allow_s3
controlobjectownership
object_ownership
s3bucketacl
s3logsprefix

Steps for updating existing buckets managed by this module:

Option 1: Disable ACLs. This module's default values for

controlobjectownership, objectownership, and s3bucket_acl follow the new AWS recommended best practice. For a new S3 bucket, using those settings will disable S3 access control lists for the bucket and set object ownership to BucketOwnerEnforced. For an existing bucket that is used to store s3 server access logs, the bucket ACL permissions for the S3 log delivery group must be migrated to the bucket policy. The changes must be applied in multiple steps.

Step 1: Update the log bucket policy to grant s3:PutObject permission to the logging service principal (logging.s3.amazonaws.com).

Example:

statement {
    sid    = "s3-logs-put-object"
    effect = "Allow"
    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
    actions   = ["s3:PutObject"]
    resources = ["BUCKETARNPLACEHOLDER/LOGGINGPREFIXPLACEHOLDER/*"]
  }

Step 2: Change s3bucketacl to private.

Step 3: Change object_ownership to BucketOwnerEnforced.