feat: add support to set ICL as targets in logs routing

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "go.sum|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2024-08-22T14:14:55Z",
+  "generated_at": "2024-09-06T17:41:41Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -90,7 +90,7 @@
         "hashed_secret": "3bd02b996f65f3548c1a0b5d93b00bfa7c88341a",
         "is_secret": true,
         "is_verified": false,
-        "line_number": 249,
+        "line_number": 250,
         "type": "Secret Keyword",
         "verified_result": null
       }

README.md

@@ -192,7 +192,7 @@ To attach access management tags to resources in this module, you need the follo
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.67.1, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.69.0, < 2.0.0 |
 | <a name="requirement_logdna"></a> [logdna](#requirement\_logdna) | >= 1.14.2, < 2.0.0 |
 
 ### Modules
@@ -244,6 +244,7 @@ No resources.
 | <a name="input_cloud_monitoring_service_endpoints"></a> [cloud\_monitoring\_service\_endpoints](#input\_cloud\_monitoring\_service\_endpoints) | The type of the service endpoint that will be set for the IBM cloud monitoring instance. | `string` | `"public-and-private"` | no |
 | <a name="input_cloud_monitoring_tags"></a> [cloud\_monitoring\_tags](#input\_cloud\_monitoring\_tags) | Tags associated with the IBM Cloud Monitoring instance (Optional, array of strings). | `list(string)` | `[]` | no |
 | <a name="input_cos_targets"></a> [cos\_targets](#input\_cos\_targets) | List of cos target to be created | <pre>list(object({<br>    endpoint                          = string<br>    bucket_name                       = string<br>    instance_id                       = string<br>    api_key                           = optional(string)<br>    service_to_service_enabled        = optional(bool, true)<br>    target_region                     = optional(string)<br>    target_name                       = string<br>    skip_atracker_cos_iam_auth_policy = optional(bool, false)<br>  }))</pre> | `[]` | no |
+| <a name="input_enable_cloud_logs_as_target"></a> [enable\_cloud\_logs\_as\_target](#input\_enable\_cloud\_logs\_as\_target) | Whether to set IBM Cloud Logs be designated as a target for logs routing in a specific region. | `bool` | `false` | no |
 | <a name="input_enable_platform_logs"></a> [enable\_platform\_logs](#input\_enable\_platform\_logs) | Receive platform logs in the provisioned IBM Cloud Logging instance. | `bool` | `true` | no |
 | <a name="input_enable_platform_metrics"></a> [enable\_platform\_metrics](#input\_enable\_platform\_metrics) | Receive platform metrics in the provisioned IBM Cloud Monitoring instance. | `bool` | `true` | no |
 | <a name="input_eventstreams_targets"></a> [eventstreams\_targets](#input\_eventstreams\_targets) | List of event streams target to be created | <pre>list(object({<br>    instance_id   = string<br>    brokers       = list(string)<br>    topic         = string<br>    api_key       = string<br>    target_region = optional(string)<br>    target_name   = string<br>  }))</pre> | `[]` | no |
@@ -263,8 +264,10 @@ No resources.
 | <a name="input_log_analysis_service_endpoints"></a> [log\_analysis\_service\_endpoints](#input\_log\_analysis\_service\_endpoints) | The type of the service endpoint that will be set for the Log Analysis instance. | `string` | `"public-and-private"` | no |
 | <a name="input_log_analysis_tags"></a> [log\_analysis\_tags](#input\_log\_analysis\_tags) | Tags associated with the IBM Cloud Logging instance (Optional, array of strings). | `list(string)` | `[]` | no |
 | <a name="input_log_analysis_targets"></a> [log\_analysis\_targets](#input\_log\_analysis\_targets) | List of log analysis target to be created | <pre>list(object({<br>    instance_id   = string<br>    ingestion_key = string<br>    target_region = optional(string)<br>    target_name   = string<br>  }))</pre> | `[]` | no |
+| <a name="input_logs_routing_tenant_name"></a> [logs\_routing\_tenant\_name](#input\_logs\_routing\_tenant\_name) | The name for this tenant. The name is regionally unique across all tenants in the account. | `string` | `null` | no |
 | <a name="input_region"></a> [region](#input\_region) | The IBM Cloud region where instances will be created. | `string` | `"us-south"` | no |
 | <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The id of the IBM Cloud resource group where the instance(s) will be created. | `string` | n/a | yes |
+| <a name="input_skip_logs_routing_auth_policy"></a> [skip\_logs\_routing\_auth\_policy](#input\_skip\_logs\_routing\_auth\_policy) | Whether to create an IAM authorization policy that permits Logs Routing Sender access to the IBM Cloud Logs. | `bool` | `false` | no |
 
 ### Outputs
 

examples/advanced/main.tf

@@ -245,7 +245,6 @@ module "observability_instance_creation" {
   }
 
   cloud_logs_retention_period = 14
-  cloud_logs_region           = "eu-es"
   cloud_logs_data_storage = {
     logs_data = {
       enabled         = true
@@ -262,4 +261,5 @@ module "observability_instance_creation" {
     en_instance_id = module.event_notification.guid
     en_region      = var.en_region
   }]
+  enable_cloud_logs_as_target = true
 }

examples/advanced/providers.tf

@@ -1,5 +1,6 @@
 provider "ibm" {
   ibmcloud_api_key = var.ibmcloud_api_key
+  region           = var.region
 }
 
 locals {

examples/advanced/version.tf

@@ -5,7 +5,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.67.1"
+      version = ">= 1.69.0"
     }
     logdna = {
       source  = "logdna/logdna"

examples/basic/main.tf

@@ -39,5 +39,4 @@ module "test_observability_instance_creation" {
   cloud_monitoring_access_tags      = var.access_tags
   activity_tracker_access_tags      = var.access_tags
   cloud_logs_access_tags            = var.access_tags
-  cloud_logs_region                 = "eu-es"
 }

examples/basic/providers.tf

@@ -1,5 +1,6 @@
 provider "ibm" {
   ibmcloud_api_key = var.ibmcloud_api_key
+  region           = var.region
 }
 
 locals {

examples/basic/version.tf

@@ -5,7 +5,7 @@ terraform {
     # module's version.tf (basic), and 1 example that will always use the latest provider version.
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = "1.67.1"
+      version = "1.69.0"
     }
     logdna = {
       source  = "logdna/logdna"

main.tf

@@ -75,16 +75,19 @@ module "cloud_monitoring" {
 
 # IBM Cloud Logs
 module "cloud_logs" {
-  count                 = var.cloud_logs_provision ? 1 : 0
-  source                = "./modules/cloud_logs"
-  region                = var.cloud_logs_region != null ? var.cloud_logs_region : var.region
-  resource_group_id     = var.resource_group_id
-  instance_name         = var.cloud_logs_instance_name
-  plan                  = var.cloud_logs_plan
-  resource_tags         = var.cloud_logs_tags
-  access_tags           = var.cloud_logs_access_tags
-  retention_period      = var.cloud_logs_retention_period
-  data_storage          = var.cloud_logs_data_storage
-  service_endpoints     = var.cloud_logs_service_endpoints
-  existing_en_instances = var.cloud_logs_existing_en_instances
+  count                         = var.cloud_logs_provision ? 1 : 0
+  source                        = "./modules/cloud_logs"
+  region                        = var.cloud_logs_region != null ? var.cloud_logs_region : var.region
+  resource_group_id             = var.resource_group_id
+  instance_name                 = var.cloud_logs_instance_name
+  plan                          = var.cloud_logs_plan
+  resource_tags                 = var.cloud_logs_tags
+  access_tags                   = var.cloud_logs_access_tags
+  retention_period              = var.cloud_logs_retention_period
+  data_storage                  = var.cloud_logs_data_storage
+  service_endpoints             = var.cloud_logs_service_endpoints
+  existing_en_instances         = var.cloud_logs_existing_en_instances
+  enable_cloud_logs_as_target   = var.enable_cloud_logs_as_target
+  skip_logs_routing_auth_policy = var.skip_logs_routing_auth_policy
+  logs_routing_tenant_name      = var.logs_routing_tenant_name
 }

modules/activity_tracker/README.md

@@ -45,7 +45,7 @@ module "activity_tracker" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.67.1, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.69.0, < 2.0.0 |
 | <a name="requirement_logdna"></a> [logdna](#requirement\_logdna) | >= 1.14.2, < 2.0.0 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1, < 1.0.0 |
 

modules/activity_tracker/version.tf

@@ -4,7 +4,7 @@ terraform {
     # Use "greater than or equal to" range in modules
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.67.1, < 2.0.0"
+      version = ">= 1.69.0, < 2.0.0"
     }
     logdna = {
       source                = "logdna/logdna"

modules/cloud_logs/README.md

@@ -32,7 +32,8 @@ module "cloud_logs" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.67.1, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.69.0, < 2.0.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.5.1, < 4.0.0 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1, < 1.0.0 |
 
 ### Modules
@@ -45,9 +46,12 @@ No modules.
 |------|------|
 | [ibm_iam_authorization_policy.cos_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
 | [ibm_iam_authorization_policy.en_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
+| [ibm_iam_authorization_policy.logs_routing_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
 | [ibm_logs_outgoing_webhook.en_integration](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/logs_outgoing_webhook) | resource |
+| [ibm_logs_router_tenant.logs_router_tenant_instance](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/logs_router_tenant) | resource |
 | [ibm_resource_instance.cloud_logs](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_instance) | resource |
 | [ibm_resource_tag.cloud_logs_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_tag) | resource |
+| [random_string.random_tenant_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
 | [time_sleep.wait_for_en_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 | [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/iam_account_settings) | data source |
 
@@ -57,14 +61,17 @@ No modules.
 |------|-------------|------|---------|:--------:|
 | <a name="input_access_tags"></a> [access\_tags](#input\_access\_tags) | A list of access tags to apply to the IBM Cloud Logs instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no |
 | <a name="input_data_storage"></a> [data\_storage](#input\_data\_storage) | A logs data bucket and a metrics bucket in IBM Cloud Object Storage to store your IBM Cloud Logs data for long term storage, search, analysis and alerting. | <pre>object({<br>    logs_data = optional(object({<br>      enabled              = optional(bool, false)<br>      bucket_crn           = optional(string)<br>      bucket_endpoint      = optional(string)<br>      skip_cos_auth_policy = optional(bool, false)<br>    }), {})<br>    metrics_data = optional(object({<br>      enabled              = optional(bool, false)<br>      bucket_crn           = optional(string)<br>      bucket_endpoint      = optional(string)<br>      skip_cos_auth_policy = optional(bool, false)<br>    }), {})<br>    }<br>  )</pre> | <pre>{<br>  "logs_data": null,<br>  "metrics_data": null<br>}</pre> | no |
+| <a name="input_enable_cloud_logs_as_target"></a> [enable\_cloud\_logs\_as\_target](#input\_enable\_cloud\_logs\_as\_target) | Whether to set IBM Cloud Logs be designated as a target for logs routing in a specific region. | `bool` | `false` | no |
 | <a name="input_existing_en_instances"></a> [existing\_en\_instances](#input\_existing\_en\_instances) | List of Event Notifications instance details for routing critical events that occur in your IBM Cloud Logs | <pre>list(object({<br>    en_instance_id      = string<br>    en_region           = string<br>    en_integration_name = optional(string)<br>    skip_en_auth_policy = optional(bool, false)<br>  }))</pre> | `[]` | no |
 | <a name="input_instance_name"></a> [instance\_name](#input\_instance\_name) | The name of the IBM Cloud Logs instance to create. Defaults to 'cloud-logs-<region>' | `string` | `null` | no |
+| <a name="input_logs_routing_tenant_name"></a> [logs\_routing\_tenant\_name](#input\_logs\_routing\_tenant\_name) | The name for this tenant. The name is regionally unique across all tenants in the account. | `string` | `null` | no |
 | <a name="input_plan"></a> [plan](#input\_plan) | The IBM Cloud Logs plan to provision. Available: standard | `string` | `"standard"` | no |
 | <a name="input_region"></a> [region](#input\_region) | The region where observability resources are created. | `string` | `"eu-es"` | no |
 | <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The id of the IBM Cloud resource group where the instance(s) will be created. | `string` | `null` | no |
 | <a name="input_resource_tags"></a> [resource\_tags](#input\_resource\_tags) | Tags associated with the IBM Cloud Logs instance (Optional, array of strings). | `list(string)` | `[]` | no |
 | <a name="input_retention_period"></a> [retention\_period](#input\_retention\_period) | The number of days IBM Cloud Logs will retain the logs data in Priority insights. | `number` | `7` | no |
 | <a name="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints) | The type of the service endpoint that will be set for the IBM Cloud Logs instance. | `string` | `"public-and-private"` | no |
+| <a name="input_skip_logs_routing_auth_policy"></a> [skip\_logs\_routing\_auth\_policy](#input\_skip\_logs\_routing\_auth\_policy) | Whether to create an IAM authorization policy that permits Logs Routing Sender access to the IBM Cloud Logs. | `bool` | `false` | no |
 
 ### Outputs
 

modules/cloud_logs/main.tf

@@ -1,5 +1,6 @@
 locals {
-  instance_name = var.instance_name != null ? var.instance_name : "cloud-logs-${var.region}"
+  instance_name                     = var.instance_name != null ? var.instance_name : "cloud-logs-${var.region}"
+  create_access_policy_logs_routing = var.enable_cloud_logs_as_target && !var.skip_logs_routing_auth_policy
 }
 
 
@@ -106,3 +107,55 @@ resource "ibm_logs_outgoing_webhook" "en_integration" {
     region_id                       = each.value.en_region
   }
 }
+
+##############################################################################
+# Logs Routing
+##############################################################################
+resource "ibm_iam_authorization_policy" "logs_routing_policy" {
+  count               = local.create_access_policy_logs_routing ? 1 : 0
+  source_service_name = "logs-router"
+  roles               = ["Sender"]
+  description         = "Allow Logs Routing `Sender` access to the IBM Cloud Logs with ID ${ibm_resource_instance.cloud_logs.guid}."
+
+  resource_attributes {
+    name     = "serviceName"
+    operator = "stringEquals"
+    value    = "logs"
+  }
+
+  resource_attributes {
+    name     = "accountId"
+    operator = "stringEquals"
+    value    = data.ibm_iam_account_settings.iam_account_settings.account_id
+  }
+
+  resource_attributes {
+    name     = "serviceInstance"
+    operator = "stringEquals"
+    value    = ibm_resource_instance.cloud_logs.guid
+  }
+}
+
+##############################################################################
+# Random Suffix
+##############################################################################
+
+resource "random_string" "random_tenant_suffix" {
+  length  = 13
+  numeric = true
+  upper   = false
+  lower   = false
+  special = false
+}
+
+resource "ibm_logs_router_tenant" "logs_router_tenant_instance" {
+  name = var.logs_routing_tenant_name != null ? var.logs_routing_tenant_name : "${var.region}-${random_string.random_tenant_suffix.result}"
+  targets {
+    log_sink_crn = ibm_resource_instance.cloud_logs.crn
+    name         = local.instance_name
+    parameters {
+      host = "${ibm_resource_instance.cloud_logs.guid}.ingress.${var.region}.logs.cloud.ibm.com"
+      port = 443
+    }
+  }
+}

modules/cloud_logs/variables.tf

@@ -122,3 +122,29 @@ variable "existing_en_instances" {
   default     = []
   description = "List of Event Notifications instance details for routing critical events that occur in your IBM Cloud Logs"
 }
+
+##############################################################################
+# Logs Routing
+##############################################################################
+
+variable "enable_cloud_logs_as_target" {
+  description = "Whether to set IBM Cloud Logs be designated as a target for logs routing in a specific region."
+  type        = bool
+  default     = false
+}
+
+variable "skip_logs_routing_auth_policy" {
+  description = "Whether to create an IAM authorization policy that permits Logs Routing Sender access to the IBM Cloud Logs."
+  type        = bool
+  default     = false
+}
+
+variable "logs_routing_tenant_name" {
+  description = "The name for this tenant. The name is regionally unique across all tenants in the account."
+  type        = string
+  default     = null
+  validation {
+    condition     = var.logs_routing_tenant_name != null ? length(var.logs_routing_tenant_name) < 35 : true
+    error_message = "The maximum length is 35 characters."
+  }
+}

modules/cloud_logs/version.tf

@@ -4,11 +4,15 @@ terraform {
     # Use "greater than or equal to" range in modules
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.67.1, < 2.0.0"
+      version = ">= 1.69.0, < 2.0.0"
     }
     time = {
       source  = "hashicorp/time"
       version = ">= 0.9.1, < 1.0.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5.1, < 4.0.0"
+    }
   }
 }

modules/cloud_monitoring/README.md

@@ -26,7 +26,7 @@ module "cloud_monitoring" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.67.1, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.69.0, < 2.0.0 |
 
 ### Modules
 

modules/cloud_monitoring/version.tf

@@ -4,7 +4,7 @@ terraform {
     # Use "greater than or equal to" range in modules
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.67.1, < 2.0.0"
+      version = ">= 1.69.0, < 2.0.0"
     }
   }
 }

modules/log_analysis/README.md

@@ -45,7 +45,7 @@ module "log_analysis" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.67.1, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.69.0, < 2.0.0 |
 | <a name="requirement_logdna"></a> [logdna](#requirement\_logdna) | >= 1.14.2, < 2.0.0 |
 
 ### Modules

modules/log_analysis/version.tf

@@ -4,7 +4,7 @@ terraform {
     # Use "greater than or equal to" range in modules
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.67.1, < 2.0.0"
+      version = ">= 1.69.0, < 2.0.0"
     }
     logdna = {
       source                = "logdna/logdna"