cloudwatch-logs-exporter.tf

provider "aws" {
  region = "ap-northeast-1"
  # endpoints {
  #   sts = "https://sts.ap-northeast-1.amazonaws.com"
  # }
}

data "archive_file" "log_exporter" {
  type        = "zip"
  source_file = "${path.module}/lambda/cloudwatch-to-s3.py"
  output_path = "${path.module}/lambda/tmp/cloudwatch-to-s3.zip"
}

resource "random_string" "random" {
  length  = 8
  special = false
  upper   = false
  number  = false
}

resource "aws_iam_role" "log_exporter" {
  name = "log-exporter-${random_string.random.result}"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "log_exporter" {
  name = "log-exporter-${random_string.random.result}"
  role = aws_iam_role.log_exporter.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateExportTask",
        "logs:Describe*",
        "logs:ListTagsLogGroup",
        "ssm:DescribeParameters",
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath",
        "ssm:PutParameter",
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*",
      "Effect": "Allow"
    }
  ]
}
EOF
}

resource "aws_lambda_function" "log_exporter" {
  filename         = data.archive_file.log_exporter.output_path
  function_name    = "log-exporter-${random_string.random.result}"
  role             = aws_iam_role.log_exporter.arn
  handler          = "cloudwatch-to-s3.lambda_handler"
  source_code_hash = data.archive_file.log_exporter.output_base64sha256
  timeout          = 300

  runtime = "python3.8"

  environment {
    variables = {
      S3_BUCKET = "${var.cloudwatch_logs_export_bucket}-${random_string.random.result}"
    }
  }
}

resource "aws_cloudwatch_event_rule" "log_exporter" {
  name                = "log-exporter-${random_string.random.result}"
  description         = "Fires periodically to export logs to S3"
  schedule_expression = "rate(4 hours)"
}

resource "aws_cloudwatch_event_target" "log_exporter" {
  rule      = aws_cloudwatch_event_rule.log_exporter.name
  target_id = "log-exporter-${random_string.random.result}"
  arn       = aws_lambda_function.log_exporter.arn
}

resource "aws_lambda_permission" "log_exporter" {
  statement_id  = "AllowExecutionFromCloudWatch"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.log_exporter.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.log_exporter.arn
}

resource "aws_s3_bucket" "procochanLogsReceiver" {
  bucket = "${var.cloudwatch_logs_export_bucket}-${random_string.random.result}"
  acl    = "private"

  versioning {
    enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "procochanLogsReceiver" {
  bucket = aws_s3_bucket.procochanLogsReceiver.id

# Setting the aws_s3_bucket_public_access_block first
  block_public_acls   = true
  block_public_policy = true
  restrict_public_buckets = true
  ignore_public_acls = true
}

resource "aws_s3_bucket_policy" "receiverBucketPolicy" {
  # Then set the aws_s3_bucket_policy
  # Terraform seems to be setting them at once. Only one operation seem to be okay to perform on a S3 bucket at a time.
  depends_on = ["aws_s3_bucket_public_access_block.procochanLogsReceiver"]
  bucket=aws_s3_bucket.procochanLogsReceiver.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = {
          Service = "logs.ap-northeast-1.amazonaws.com"
        }
        Action    = ["s3:GetBucketAcl","s3:PutObject"]
        Resource = [
          aws_s3_bucket.procochanLogsReceiver.arn,
          "${aws_s3_bucket.procochanLogsReceiver.arn}/*",
        ]
      },
    ]
  })
}