enable aws-cloudtrail on tarballs.nixos.org (#463)
Jörg Thalheim committed
Aug 19, 2024 at 14:52 UTC
edce4ec106de69dab9e4e2fbe21229c824d6e815
1 file changed
+70
terraform/nixpkgs-tarballs.tf
+70
@@ -286,3 +286,73 @@ resource "fastly_tls_subscription" "nixpkgs-tarballs" {
286
output "nixpkgs-tarballs-managed_dns_challenge" {
287
value = fastly_tls_subscription.nixpkgs-tarballs.managed_dns_challenge
288
}
289
+
290
+# Create an S3 bucket for CloudTrail logs
291
+resource "aws_s3_bucket" "nixpkgs-tarballs-cloudtrail-logs" {
292
+ bucket = "nixpkgs-tarballs-cloudtrail-logs"
293
+ # We can potentially make this public for transparency?
294
+ # But first I want to see what the logs look like.
295
+ acl = "private"
296
+
297
+ versioning {
298
+ enabled = true
299
+ }
300
+}
301
+
302
+# Create a CloudTrail
303
+resource "aws_cloudtrail" "nixpkgs-tarballs" {
304
+ name = "nixpkgs-tarballs"
305
+ s3_bucket_name = aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs.bucket
306
+ enable_log_file_validation = true
307
+ cloud_watch_logs_role_arn = aws_iam_role.nixpkgs-tarballs-cloudtrail.arn
308
+ depends_on = [aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs]
309
+
310
+ event_selector {
311
+ read_write_type = "WriteOnly"
312
+ include_management_events = false
313
+
314
+ data_resource {
315
+ type = "AWS::S3::Object"
316
+ values = ["arn:aws:s3:::${aws_s3_bucket.nixpkgs-tarballs.bucket}/"]
317
+ }
318
+ }
319
+}
320
+
321
+# Create an IAM role for CloudTrail to write logs to CloudWatch
322
+resource "aws_iam_role" "nixpkgs-tarballs-cloudtrail" {
323
+ name = "nixpkgs-tarballs-cloudtrail"
324
+
325
+ assume_role_policy = jsonencode({
326
+ Version = "2012-10-17"
327
+ Statement = [
328
+ {
329
+ Action = "sts:AssumeRole"
330
+ Effect = "Allow"
331
+ Principal = {
332
+ Service = "cloudtrail.amazonaws.com"
333
+ }
334
+ },
335
+ ]
336
+ })
337
+}
338
+
339
+# Attach the policy to allow CloudTrail to publish to CloudWatch Logs
340
+resource "aws_iam_role_policy" "nixpkgs-tarballs-cloudtrail" {
341
+ name = "cloudtrail-nixpkgs-policy"
342
+ role = aws_iam_role.nixpkgs-tarballs-cloudtrail.id
343
+
344
+ policy = jsonencode({
345
+ Version = "2012-10-17"
346
+ Statement = [
347
+ {
348
+ Action = [
349
+ "logs:CreateLogGroup",
350
+ "logs:CreateLogStream",
351
+ "logs:PutLogEvents",
352
+ ]
353
+ Effect = "Allow"
354
+ Resource = "*"
355
+ },
356
+ ]
357
+ })
358
+}