88 lines
1.7 KiB
HCL
88 lines
1.7 KiB
HCL
# S3 bucket for logs
|
|
resource "aws_s3_bucket" "logs" {
|
|
bucket = "${var.cluster_name}-logs"
|
|
}
|
|
|
|
resource "aws_s3_bucket_lifecycle_configuration" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
|
|
rule {
|
|
id = "expire-old-logs"
|
|
status = "Enabled"
|
|
|
|
filter {
|
|
prefix = ""
|
|
}
|
|
|
|
transition {
|
|
days = 30
|
|
storage_class = "INTELLIGENT_TIERING"
|
|
}
|
|
|
|
expiration {
|
|
days = 365
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "AES256"
|
|
}
|
|
}
|
|
}
|
|
|
|
# Athena database + workgroup
|
|
resource "aws_athena_database" "logs" {
|
|
name = "${replace(var.cluster_name, "-", "_")}_logs"
|
|
bucket = aws_s3_bucket.athena_results.bucket
|
|
}
|
|
|
|
resource "aws_s3_bucket" "athena_results" {
|
|
bucket = "${var.cluster_name}-athena-results"
|
|
}
|
|
|
|
resource "aws_athena_workgroup" "logs" {
|
|
name = "${var.cluster_name}-logs"
|
|
|
|
configuration {
|
|
result_configuration {
|
|
output_location = "s3://${aws_s3_bucket.athena_results.bucket}/results/"
|
|
|
|
encryption_configuration {
|
|
encryption_option = "SSE_S3"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# IAM user for fluent-bit to write to S3
|
|
resource "aws_iam_user" "fluentbit" {
|
|
name = "${var.cluster_name}-fluentbit"
|
|
}
|
|
|
|
resource "aws_iam_access_key" "fluentbit" {
|
|
user = aws_iam_user.fluentbit.name
|
|
}
|
|
|
|
resource "aws_iam_user_policy" "fluentbit" {
|
|
name = "fluentbit-s3-write"
|
|
user = aws_iam_user.fluentbit.name
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:PutObject"]
|
|
Resource = "${aws_s3_bucket.logs.arn}/*"
|
|
}
|
|
]
|
|
})
|
|
}
|
|
|
|
output "logs_bucket" {
|
|
value = aws_s3_bucket.logs.bucket
|
|
}
|