Implement module for VPC flow logs #1

SweetOps · 2017-10-30T14:51:09Z

What

Enable VPC logs collection via CloudWatch

Why

We need an option to collect ACCEPT,REJECT, ALL network logs

osterman · 2017-10-30T23:53:54Z

iam.tf

@@ -0,0 +1,43 @@
+resource "aws_iam_role" "default" {


Always use the policy document instead of heredoc. https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html

osterman · 2017-10-30T23:54:13Z

iam.tf

+  name = "${module.vpc_label.id}"
+  role = "${aws_iam_role.default.id}"
+
+  policy = <<EOF


use policy document

osterman · 2017-10-30T23:54:54Z

main.tf

+module "subnet_label" {
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.2.2"
+  namespace  = "${var.namespace}"
+  name       = "subnet"


This should be an attribute

SweetOps · 2017-10-31T10:40:03Z

@osterman , I think repo should be renamed, because terraform-aws-cloudwatch-logs is very common. What you think about terraform-aws-cloudwatch-flow-logs?

SweetOps · 2017-10-31T11:14:11Z

const-bon · 2017-11-13T14:47:49Z

kinesis.tf

+module "kinesis_label" {
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.2.2"
+  namespace  = "${var.namespace}"
+  name       = "kinesis"


We shouldn't hardcode module names.

const-bon · 2017-11-13T14:48:04Z

main.tf

@@ -0,0 +1,58 @@
+data "aws_region" "default" {
+  current = true


const-bon · 2017-11-13T14:51:17Z

README.md

+```terraform
+module "flow_logs" {
+  source    = "git::https://github.com/cloudposse/terraform-aws-cloudwatch-flow-logs.git?ref=master"
+  vpc_id    = "vpc-d309abab"


Use variables for vpc_id, namespace and stage.
name may be required too.

that's just example =\ and name isn't required input

const-bon · 2017-11-14T15:06:42Z

@SweetOps @osterman
Should we rename module to terraform-aws-cloudwatch-vpc-flow-logs for consistence?

SweetOps · 2017-11-16T12:59:28Z

@comeanother , I'm prefer the current name

const-bon · 2017-11-21T08:42:13Z

kinesis.tf

+  retention_period    = "${var.retention_period}"
+  shard_level_metrics = "${var.shard_level_metrics}"
+  encryption_type     = "${var.encryption_type}"
+  kms_key_id          = "${var.encryption_type}"


Is it a copy and paste error?

const-bon · 2017-11-21T09:08:32Z

kinesis.tf

+}
+
+resource "aws_cloudwatch_log_subscription_filter" "default" {
+  name            = "${aws_cloudwatch_log_group.default.name}"


aws_cloudwatch_log_group name (/aws/lambda/example_lambda_name) may be improper for resource name.
https://www.terraform.io/docs/providers/aws/r/cloudwatch_log_subscription_filter.html

We should use terraform-null-label for resource names.

aws_cloudwatch_log_group name (/aws/lambda/example_lambda_name) may be improper for resource name.

it doesn't matter

const-bon · 2017-11-21T09:12:22Z

main.tf

+  count          = "${length(compact(var.subnet_ids))}"
+  log_group_name = "${aws_cloudwatch_log_group.default.name}"
+  iam_role_arn   = "${aws_iam_role.log.arn}"
+  subnet_id      = "${element(var.subnet_ids, count.index)}"


We should use compact here too for consistence.
Otherwise, empty elements will be enumerated.

const-bon · 2017-11-21T09:12:27Z

main.tf

+  count          = "${length(compact(var.eni_ids))}"
+  log_group_name = "${aws_cloudwatch_log_group.default.name}"
+  iam_role_arn   = "${aws_iam_role.log.arn}"
+  subnet_id      = "${element(var.eni_ids, count.index)}"


We should use compact here too for consistence.
Otherwise, empty elements will be enumerated.

const-bon · 2017-11-21T09:14:27Z

main.tf

+}
+
+module "log_group_label" {
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.2.2"


Use 0.3.1 label module.

const-bon · 2017-11-21T09:14:31Z

main.tf

+}
+
+module "vpc_label" {
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.2.2"


Use 0.3.1 label module.

const-bon · 2017-11-21T09:14:58Z

main.tf

+}
+
+module "subnet_label" {
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.2.2"


Use 0.3.1 label module.

SweetOps · 2017-11-21T10:13:10Z

SweetOps · 2017-11-21T13:21:28Z

const-bon · 2017-11-21T13:37:07Z

variables.tf

+variable "stage" {
+  description = "Stage (e.g. `prod`, `dev`, `staging`)"
+  type        = "string"
+  default     = "dev"


Drop default value.

const-bon · 2017-11-21T13:37:10Z

variables.tf

+variable "namespace" {
+  description = "Namespace (e.g. `cp` or `cloudposse`)"
+  type        = "string"
+  default     = "cp"


Drop default value.

const-bon · 2017-11-21T13:37:25Z

variables.tf

+}
+
+variable "vpc_id" {
+  default     = "vpc-aceb27ca"


Drop default value.

const-bon · 2017-11-21T13:39:31Z

variables.tf

+
+variable "enabled" {
+  default     = "true"
+  description = "Set to false to prevent the module from creating anything	"


Drop trailing whitespaces.

SweetOps added 2 commits October 30, 2017 14:20

init code

1b9d1d9

remove kms

c641bb4

SweetOps requested review from osterman and const-bon October 30, 2017 14:51

SweetOps self-assigned this Oct 30, 2017

SweetOps added 2 commits October 30, 2017 16:56

fix readme

9cc3054

added kinesis

99f23bb

osterman reviewed Oct 30, 2017

View reviewed changes

iam.tf Outdated

name = "${module.vpc_label.id}"

role = "${aws_iam_role.default.id}"

policy = <<EOF

Copy link

Member

osterman Oct 30, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use policy document

osterman reviewed Oct 30, 2017

View reviewed changes

SweetOps added 2 commits October 31, 2017 12:21

added kinesis stream

326afed

reworked attributes

d1a4b49

SweetOps added 4 commits November 1, 2017 10:40

update README

e7e34f3

fix readme

ab91f41

travis

2b31b37

add travis

3be609f

const-bon reviewed Nov 13, 2017

View reviewed changes

conventions =\

d5aa2e1

eni, fix race condition

52cb988

const-bon approved these changes Nov 20, 2017

View reviewed changes

const-bon force-pushed the add_code branch from dccf6d4 to 52cb988 Compare November 20, 2017 17:58

const-bon reviewed Nov 21, 2017

View reviewed changes

SweetOps added 2 commits November 21, 2017 11:35

cosmetic

148c04b

cosmetic #1

e110410

fix var kms_key_id

1677043

fix kinesis

b17fb33

const-bon reviewed Nov 21, 2017

View reviewed changes

cosmetic

0653690

const-bon changed the title ~~Implement module for flow logs~~ Implement module for VPC flow logs Nov 21, 2017

const-bon merged commit 52929aa into master Nov 21, 2017

const-bon deleted the add_code branch November 21, 2017 14:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement module for VPC flow logs #1

Implement module for VPC flow logs #1

SweetOps commented Oct 30, 2017 •

edited by const-bon

Loading

osterman Oct 30, 2017

osterman Oct 30, 2017

osterman Oct 30, 2017

SweetOps commented Oct 31, 2017

SweetOps commented Oct 31, 2017

const-bon Nov 13, 2017

const-bon Nov 13, 2017

const-bon Nov 13, 2017

SweetOps Nov 14, 2017

const-bon commented Nov 14, 2017

SweetOps commented Nov 16, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

SweetOps Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

SweetOps commented Nov 21, 2017

SweetOps commented Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

const-bon Nov 21, 2017

Implement module for VPC flow logs #1

Implement module for VPC flow logs #1

Conversation

SweetOps commented Oct 30, 2017 • edited by const-bon Loading

What

Why

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SweetOps commented Oct 31, 2017

SweetOps commented Oct 31, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

const-bon commented Nov 14, 2017

SweetOps commented Nov 16, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SweetOps commented Nov 21, 2017

SweetOps commented Nov 21, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SweetOps commented Oct 30, 2017 •

edited by const-bon

Loading