terraform/nixpkgs-tarballs: use cloudtrails without cloudwatch
we don't the fancy UI, json logs are enough for our use case. Also this way we don't need to create a role.
Jörg Thalheim committed
Aug 19, 2024 at 15:36 UTC
fa45f2b336da77894ee9ec46587cb43de53158ab
1 file changed
+58
-41
terraform/nixpkgs-tarballs.tf
+58
-41
@@ -299,13 +299,69 @@ resource "aws_s3_bucket" "nixpkgs-tarballs-cloudtrail-logs" {
299
}
300
}
301
302
+# Attach a policy to the CloudTrail logs S3 bucket
303
+data "aws_iam_policy_document" "nixpkgs-tarballs-cloudtrail-logs-policy" {
304
+ statement {
305
+ sid = "AWSCloudTrailAclCheck"
306
+ effect = "Allow"
307
+
308
+ principals {
309
+ type = "Service"
310
+ identifiers = ["cloudtrail.amazonaws.com"]
311
+ }
312
+
313
+ actions = ["s3:GetBucketAcl"]
314
+ resources = [aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs.arn]
315
+ condition {
316
+ test = "StringEquals"
317
+ variable = "aws:SourceArn"
318
+ values = ["arn:${data.aws_partition.current.partition}:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/nixpkgs-tarballs"]
319
+ }
320
+ }
321
+
322
+ statement {
323
+ sid = "AWSCloudTrailWrite"
324
+ effect = "Allow"
325
+
326
+ principals {
327
+ type = "Service"
328
+ identifiers = ["cloudtrail.amazonaws.com"]
329
+ }
330
+
331
+ actions = ["s3:PutObject"]
332
+ resources = ["${aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs.arn}/*"]
333
+
334
+ condition {
335
+ test = "StringEquals"
336
+ variable = "s3:x-amz-acl"
337
+ values = ["bucket-owner-full-control"]
338
+ }
339
+ condition {
340
+ test = "StringEquals"
341
+ variable = "aws:SourceArn"
342
+ values = ["arn:${data.aws_partition.current.partition}:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/nixpkgs-tarballs"]
343
+ }
344
+ }
345
+}
346
+
347
+data "aws_caller_identity" "current" {}
348
+data "aws_partition" "current" {}
349
+data "aws_region" "current" {}
350
+
351
+resource "aws_s3_bucket_policy" "nixpkgs-tarballs-cloudtrail-logs-policy" {
352
+ bucket = aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs.id
353
+ policy = data.aws_iam_policy_document.nixpkgs-tarballs-cloudtrail-logs-policy.json
354
+}
355
+
356
# Create a CloudTrail
357
resource "aws_cloudtrail" "nixpkgs-tarballs" {
358
name = "nixpkgs-tarballs"
359
s3_bucket_name = aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs.bucket
360
enable_log_file_validation = true
307
- cloud_watch_logs_role_arn = aws_iam_role.nixpkgs-tarballs-cloudtrail.arn
308
- depends_on = [aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs]
361
+ depends_on = [
362
+ aws_s3_bucket_policy.nixpkgs-tarballs-cloudtrail-logs-policy
363
+ ]
364
+ # You must specify a log group and a role ARN.
365
366
event_selector {
367
read_write_type = "WriteOnly"
@@ -317,42 +373,3 @@ resource "aws_cloudtrail" "nixpkgs-tarballs" {
373
}
374
}
375
}
320
-
321
-# Create an IAM role for CloudTrail to write logs to CloudWatch
322
-resource "aws_iam_role" "nixpkgs-tarballs-cloudtrail" {
323
- name = "nixpkgs-tarballs-cloudtrail"
324
-
325
- assume_role_policy = jsonencode({
326
- Version = "2012-10-17"
327
- Statement = [
328
- {
329
- Action = "sts:AssumeRole"
330
- Effect = "Allow"
331
- Principal = {
332
- Service = "cloudtrail.amazonaws.com"
333
- }
334
- },
335
- ]
336
- })
337
-}
338
-
339
-# Attach the policy to allow CloudTrail to publish to CloudWatch Logs
340
-resource "aws_iam_role_policy" "nixpkgs-tarballs-cloudtrail" {
341
- name = "cloudtrail-nixpkgs-policy"
342
- role = aws_iam_role.nixpkgs-tarballs-cloudtrail.id
343
-
344
- policy = jsonencode({
345
- Version = "2012-10-17"
346
- Statement = [
347
- {
348
- Action = [
349
- "logs:CreateLogGroup",
350
- "logs:CreateLogStream",
351
- "logs:PutLogEvents",
352
- ]
353
- Effect = "Allow"
354
- Resource = "*"
355
- },
356
- ]
357
- })
358
-}