cloudposse / terraform-aws-cloudwatch-logs Goto Github PK

The policy is created simply by ARN without the ":" construct, which is necessary to create the correct policy for the role.
Without this ":" construct, the policy is created, but it does not work correctly.
This error was discovered when I tried to create a cloudwatch group in the cloudtrail module.
I got the response "Error: Error updating CloudTrail: InvalidCloudWatchLogsLogGroupArnException: Access denied. Verify in IAM that the role has adequate permissions."
After studying the code, I realized that I need to add the construction ":*" in a couple of lines.
My solution looks like this, I need to replace the lines in file :

This line:
join("", aws_cloudwatch_log_group.default.*.arn),
replaced by
"${join("", aws_cloudwatch_log_group.default.*.arn)}:*"
You need to do this in both identical lines.

Perhaps you can suggest a better solution, I'm new to terraforming.

Found a bug? Maybe our Slack Community can help.

Describe the Bug

A clear and concise description of what the bug is.

When we began using the repo, we found that one of the resource is yet to be tag enabled. Hence when our internal projects were calling this repo, our custom tags were not being added in AWS. Please can you enable tags for the below.

Resource (In the main.tf file): "aws_cloudwatch_log_group"
Resource name: "default"

Description : Request you to implement a map(string) variable called tags and ensure this is implemented for:
The ''aws_cloudwatch_log_group" resource with 'default' resource name

Expected Behavior

A clear and concise description of what you expected to happen.

Steps to Reproduce

Steps to reproduce the behavior:

1. Go to '...'
2. Run '....'
3. Enter '....'
4. See error

Screenshots

If applicable, add screenshots or logs to help explain your problem.

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

• OS: [e.g. Linux, OSX, WSL, etc]
• Version [e.g. 10.15]

Additional Context

Add any other context about the problem here.

Found a bug? Maybe our Slack Community can help.

Describe the Bug

the "list" function was deprecated in Terraform v0.12 and is no longer available.
this is a bug that happens when i use Terraform v1.0.0.

Expected Behavior

on .terraform/modules/elasticsearch.cloudwatch-firehose-logs/iam.tf line 5, in module "role":
attributes = compact(concat(module.this.attributes, list("log"), list("group")))
should be like: tolist(["log"])
list function is deprecated on terraform v0.12 as stated:
https://www.terraform.io/docs/language/functions/list.html

Steps to Reproduce

Screenshots

If applicable, add screenshots or logs to help explain your problem.

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

• OS: ubuntu 18.04 WSL
• Version: Terraform v1.0.0

Describe the Bug

The generated policy of terraform version 0.6.7 is absent of c17b4b6 which leads me to conclude that the Terraform registry version 0.6.7 is somehow actually 0.6.6?

Expected Behavior

Terraform registry version 0.6.7 matches GitHub tag 0.6.7

Steps to Reproduce

terraform init with:

module "cloudwatch-logs" {
  source  = "cloudposse/cloudwatch-logs/aws"
  version = "0.6.7"
}

Then view data "aws_iam_policy_document" "log_agent" block in .infrastructure/.terraform/modules/cloudwatch_logs/iam.tf

Screenshots

No response

Environment

0.6.7 with:
Terraform v1.5.2
on linux_amd64

Additional Context

No response

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

In cloudposse/elasticsearch/aws we have following variables

log_publishing_application_cloudwatch_log_group_arn
log_publishing_audit_cloudwatch_log_group_arn
log_publishing_index_cloudwatch_log_group_arn
log_publishing_search_cloudwatch_log_group_arn

That module also have the variable create_iam_service_linked_role; if it is set to true, it will create AWSServiceRoleForAmazonElasticsearchService with the attached AWS managed policy for ES

If it is set to false it will use existing AWSServiceRoleForAmazonElasticsearchService role and attach it to the created Domain

This module creates its own role that lacks ES-required capabilities.
And also creates a policy attached to the cloud watch log stream without principal,
so permissions should be set in the assumed role.
So terraform fails with an error.

ValidationException: The Resource Access Policy specified for the CloudWatch Logs log group dev-testnet-opensearch-cloudwatch does not grant sufficient permissions for Amazon OpenSearch Service to create a log stream. Please check the Resource Access Policy.

Expected Behavior

I want to be able to create a policy attached to the log stream like follow, (with the principal):

data "aws_iam_policy_document" "example" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }

    actions = [
      "logs:PutLogEvents",
      "logs:PutLogEventsBatch",
      "logs:CreateLogStream",
    ]

    resources = ["arn:aws:logs:*"]
  }
}

So that gives a possibility to use the original ES role from another module.
A working example in plain teraform https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticsearch_domain#log-publishing-to-cloudwatch-logs

Use Case

Should be possible to use these two modules together, without hacks.

Describe the Ideal Solution

Possibility to define own aws_iam_policy_document to attach to log stream

or add parametric values to an existing policy with the possibility to set principal

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository.

• WARN: Base branch does not exist - skipping

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

• Update Terraform cloudposse/iam-role/aws to v0.18.0 (main)

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

I'm confused by an error I get from Terraform, and not sure how to proceed.

Releasing state lock. This may take a few moments...

Error: Error applying plan:

1 error(s) occurred:

* module.cloudtrail_cloudwatch_logs.aws_iam_role.default: 1 error(s) occurred:                                           

* aws_iam_role.default: Error creating IAM Role abra-dev-cloudtrail-log-group: MalformedPolicyDocument: Invalid principal in policy: com.amazon.balsa.error.InvalidPolicyException: The passed in policy has a statement with no principals!       
        status code: 400, request id: 811c7a79-5188-11e9-b106-f5be55899e5d      

Results from this code:

module "cloudtrail_cloudwatch_logs" {
  source = "cloudposse/cloudwatch-logs/aws"
  version = "0.2.2"

  name = "cloudtrail"
  namespace = "Abra"
  stage = "${var.env_name}"
  #stream_names = [ "cloudtrail" ]
}

$ terraform --version
Terraform v0.11.13
+ provider.aws v2.3.0
+ provider.null v2.1.0

I'm happy to give more environment information as you need it. Thanks in advance! Cheers!

Describe the Bug

When using terraform-aws-lambda-function to create a lambda and associated log group, the resulting log groups can in some cases not match the function name, which results in no logs being sent to the created group.

Expected Behavior

I create a lambda using the terraform-aws-lambda-function module, and the name of this lambda contains an underscore

module "lambda" {
  source  = "cloudposse/lambda-function/aws"
  version = "0.5.3"

  function_name      = "my_function_name"
  ...

  context = module.this.context
}

The resultant log group created by this module should be called /aws/lambda/my_function_name.

Instead the log group created is called /aws/lambda/myfunctionname, as the label for the log group contains a regex_replace_chars rule that does not allow for underscores.

This means the AWS creates its own log group (with default config like no expiration) for the lambda, and the log group created by this module is orphaned.

https://github.com/cloudposse/terraform-aws-cloudwatch-logs/blob/f622326cce042d0e49b2613cc994ab710355ac7f/main.tf#L5C1-L13C2

Steps to Reproduce

Invoke the lambda module with var.function_name set to a value that includes an underscore.

Screenshots

Environment

v0.6.6 -- version of the module used in the lambda module -- IS AFFECTED
v0.6.8 -- current version of the module -- IS AFFECTED

Additional Context

This fix requires a bump to the version of the cloudwatch logs module used in the lambda module (and/or anywhere else in the CloudPosse module/component libraries that support the creation of resources with underscores in their names.

what

• Add example invocation

why

• We need this so we can soon enable automated continuous integration testing of module