Feature flow logs

CHANGELOG.md

@@ -10,3 +10,7 @@
 
 * v1.2 -- 20210223
   - module: access-logging
+
+* v1.3 -- 20210223
+  - module: rename access-logging to s3-access-logs
+  - module: add s3-flow-logs

README.md

@@ -13,11 +13,13 @@ structure so they are not really needed. The bucket is `inf-tfstate-{account_id}
 
 This has no other dependencies, since it has to be created first.  Only one is needed per account.
 
-### [access-logging](access-logging)
+### [s3-access-logs](s3-access-logs)
 
 This sets up the S3 bucket used for access logs.  One is needed per region, and the region and account are included
 in the bucket names: `inf-logs-{account_id}-{region}`. 
 
+### [s3-flow-logs](s3-flow-logs)
+
 ### splunk-user
 ### object-logging
 ### cloudtrail

common/version.tf

@@ -1,3 +1,3 @@
 locals {
-  _module_version = "1.2"
+  _module_version = "1.3"
 }

access-logging/README.md → s3-access-logs/README.md

@@ -1,4 +1,4 @@
-# aws-inf-setup :: access-logging
+# aws-inf-setup :: s3-access-logs
 
 This set up the needed components for S3 access log bucket.  An access log must exist in each region  
 where there are components wishing to use access logs (S3, ALB, etc.).
@@ -12,7 +12,7 @@ Here is a simple example, the one most commonly expected to be used.
 
 ```hcl
 module "logs" {
-  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//access-logging"
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-access-logs"
 }
 ```
 
@@ -22,7 +22,7 @@ variable file generation.
 
 ```hcl
 module "logs_full" {
-  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//terraform-state"
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-access-logs"
 
   # optional
   account_alias         = "do2-govcloud"

access-logging/main.tf → s3-access-logs/main.tf

@@ -1,5 +1,5 @@
 /*
-* # aws-inf-setup :: access-logging
+* # aws-inf-setup :: s3-access-logs
 * 
 * This set up the needed components for S3 access log bucket.  An access log must exist in each region
 * where there are components wishing to use access logs (S3, ALB, etc.).
@@ -13,7 +13,7 @@
 *
 * ```hcl
 * module "logs" {
-*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//access-logging"
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-access-logs"
 * }
 * ```
 *
@@ -23,7 +23,7 @@
 *
 * ```hcl
 * module "logs_full" {
-*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//terraform-state"
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-access-logs"
 * 
 *   # optional
 *   account_alias         = "do2-govcloud"

s3-flow-logs/README.md

@@ -0,0 +1,83 @@
+# aws-inf-setup :: s3-flow-logs
+
+This set up the needed components for S3 VPC flow log bucket.  Only one flow log bucket is  
+needed
+
+* S3 bucket
+* S3 bucket objects (key prefixes, aka "directories")
+* S3 bucket policy
+
+# Usage  
+Here is a simple example, the one most commonly expected to be used.
+
+```hcl
+module "flowlogs" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-flow-flowlogs"
+}
+```
+
+This one can be used if you need to customize stuff, though really, the defaults are all built  
+for a reason, and deployment code (i.e., Ansible) will expect these defaults to be used in  
+variable file generation.
+
+```hcl
+module "flowlogs_full" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-flow-flowlogs"
+
+  # optional
+  account_alias         = "do2-govcloud"
+  bucket_name           = "inf-flowlogs-123456789012"
+
+  # flowlogs is generally not needed and not recommended
+  component_tags        = {
+    "s3" = {
+      "SpecialTag1" = "something"
+      "SpecialTag2" = "somethingElse"
+    }
+  }
+}
+```
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | n/a |
+
+## Modules
+
+No Modules.
+
+## Resources
+
+| Name |
+|------|
+| [aws_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) |
+| [aws_caller_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) |
+| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) |
+| [aws_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) |
+| [aws_s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) |
+| [aws_s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) |
+| [aws_s3_bucket_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| account\_alias | AWS Account Alias (required) | `string` | `""` | no |
+| account\_id | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| bucket\_name | VPC Flow Logs S3 bucket name | `string` | `""` | no |
+| bucket\_name\_prefix | VPC Flow Logs S3 bucket prefix, prepended to the AWS account ID to make the bucket name. | `string` | `"inf-flowlogs"` | no |
+| component\_tags | Additional tags for Components (s3, kms, ddb) | `map(map(string))` | <pre>{<br>  "ddb": {},<br>  "kms": {},<br>  "s3": {}<br>}</pre> | no |
+| override\_prefixes | Override built-in prefixes by component (efs, s3, ebs, kms, role, policy, security-group). This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| tags | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| flowlogs\_bucket\_arn | VPC Flow Logs S3 bucket ARN |

s3-flow-logs/data.tf

@@ -0,0 +1 @@
+../common/data.tf

s3-flow-logs/defaults.tf

@@ -0,0 +1 @@
+../common/defaults.tf

s3-flow-logs/main.tf

@@ -0,0 +1,110 @@
+/*
+* # aws-inf-setup :: s3-flow-logs
+* 
+* This set up the needed components for S3 VPC flow log bucket.  Only one flow log bucket is
+* needed
+* 
+* * S3 bucket
+* * S3 bucket objects (key prefixes, aka "directories")
+* * S3 bucket policy
+* 
+* # Usage
+* Here is a simple example, the one most commonly expected to be used.
+*
+* ```hcl
+* module "flowlogs" {
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-flow-flowlogs"
+* }
+* ```
+*
+* This one can be used if you need to customize stuff, though really, the defaults are all built 
+* for a reason, and deployment code (i.e., Ansible) will expect these defaults to be used in
+* variable file generation.
+*
+* ```hcl
+* module "flowlogs_full" {
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//s3-flow-flowlogs"
+* 
+*   # optional
+*   account_alias         = "do2-govcloud"
+*   bucket_name           = "inf-flowlogs-123456789012"
+*
+*   # flowlogs is generally not needed and not recommended
+*   component_tags        = {
+*     "s3" = {
+*       "SpecialTag1" = "something"
+*       "SpecialTag2" = "somethingElse"
+*     }
+*   }
+* }
+* ```
+*/
+
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  flowlogs_region     = data.aws_region.current.name
+  account_environment = data.aws_arn.current.partiion == "aws-us-gov" ? "gov" : "ew"
+
+  bucket_name = var.bucket_name != "" ? var.bucket_name : format("%v-%v-%v", var.bucket_name_prefix, local.account_id, local.flowlogs_region)
+
+  base_tags = {
+    "Organization"          = "census:aditcio:csvd"
+    "boc:tf_module_version" = local._module_version
+    "boc:created_by"        = "terraform"
+  }
+}
+
+#---
+# s3
+#---
+resource "aws_s3_bucket" "flowlogs" {
+  bucket = local.bucket_name
+  acl    = "log-delivery-write"
+
+  # need to create the inf_ key used for infrastucture things like
+  # vpc flow, cloudtrail, config, sns, sqs
+
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        #        kms_master_key_id = local.inf_key_arn
+        sse_algorithm = "aws:kms"
+      }
+    }
+  }
+
+  versioning {
+    enabled = false
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  # probably want some migration of old data to some other location
+  # like glacier
+
+  tags = merge(
+    var.tags,
+    local.base_tags,
+    lookup(var.component_tags, "s3", {}),
+    map("Name", local.bucket_name),
+  )
+
+  provisioner "local-exec" {
+    command = "sleep 30"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "flowlogs" {
+  bucket                  = aws_s3_bucket.flowlogs.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_policy" "flowlogs" {
+  bucket = aws_s3_bucket.flowlogs.id
+  policy = data.aws_iam_policy_document.flowlogs_s3.json
+}

s3-flow-logs/outputs.tf

@@ -0,0 +1,9 @@
+output "flowlogs_bucket_id" {
+  description = "VPC Flow Logs S3 bucket ID"
+  value       = aws_s3_bucket.flowlogs.id
+}
+
+output "flowlogs_bucket_arn" {
+  description = "VPC Flow Logs S3 bucket ARN"
+  value       = aws_s3_bucket.flowlogs.arn
+}

s3-flow-logs/policy_data.tf

@@ -0,0 +1,27 @@
+data "aws_iam_policy_document" "flowlog_s3" {
+  statement {
+    sid     = "AWSLogDeliveryWrite"
+    effect  = "Allow"
+    actions = ["s3:PutObject"]
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+    resources = ["${aws_s3_bucket.flowlog.arn}/*"]
+    condition {
+      test     = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+  statement {
+    sid     = "AWSLogDeliveryAclCheck"
+    effect  = "Allow"
+    actions = ["s3:GetBucketAcl"]
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+    resources = [aws_s3_bucket.flowlog.arn]
+  }
+}

s3-flow-logs/prefixes.tf

@@ -0,0 +1 @@
+../common/prefixes.tf

s3-flow-logs/variables.common.tf

@@ -0,0 +1 @@
+../common/variables.common.tf

s3-flow-logs/variables.tf

@@ -0,0 +1,20 @@
+variable "bucket_name" {
+  description = "VPC Flow Logs S3 bucket name"
+  type        = string
+  #  default     = "inf-flowlogs-{{ tf_account }}-{{ region }}"
+  #  default     = "inf-flowlogs-{{ tf_account }}"
+  default = ""
+}
+
+variable "bucket_name_prefix" {
+  #  description = "VPC Flow Logs S3 bucket prefix, prepended to the AWS account ID and region to make the bucket name."
+  description = "VPC Flow Logs S3 bucket prefix, prepended to the AWS account ID to make the bucket name."
+  type        = string
+  default     = "inf-flowlogs"
+}
+
+variable "component_tags" {
+  description = "Additional tags for Components (s3, kms, ddb)"
+  type        = map(map(string))
+  default     = { "s3" = {}, "kms" = {}, "ddb" = {} }
+}

s3-flow-logs/version.tf

@@ -0,0 +1 @@
+../common/version.tf