Terraform Aws Cloudwatch Logs Versions Save

what

This is just a continuation of the fix https://github.com/cloudposse/terraform-aws-cloudwatch-logs/pull/38. Prod environment tested. That's how it works correctly.

what

Fix mistake in policy

why

The policy is created simply by ARN without the ":" construct, which is necessary to create the correct policy for the role. Without this ":" construct, the policy is created, but it does not work correctly. This error was discovered when I tried to create a cloudwatch group in the cloudtrail module. I got the response "Error: Error updating CloudTrail: InvalidCloudWatchLogsLogGroupArnException: Access denied. Verify in IAM that the role has adequate permissions." After studying the code, I realized that I need to add the construction ":*" in a couple of lines. My solution looks like this, I need to replace the lines in file :

This line: join("", aws_cloudwatch_log_group.default..arn), replaced by "${join("", aws_cloudwatch_log_group.default..arn)}:*" You need to do this in both identical lines.

Perhaps you can suggest a better solution, I'm new to terraforming.

references

https://github.com/cloudposse/terraform-aws-cloudwatch-logs/issues/37 https://github.com/cloudposse/terraform-aws-cloudwatch-logs/blob/master/iam.tf#L55

This PR contains the following updates:

what

• Add policy boundary to cloudwatch IAM resources
• Updating to new tags_enabled variable from I am role module

why

• to pass policy_boundary and to add the ability to disable tags for IAM resources

references

• https://github.com/cloudposse/terraform-aws-iam-role/pull/44

This PR contains the following updates:

Release Notes

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

This PR contains the following updates:

Release Notes

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

This PR contains the following updates:

Release Notes

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

what

• Fix usage snippet (missing source attribute)
• Fix module block name in usage snippet (does not match module name)

why

• The usage snippet is incorrect (missing source attribute and does not match module name)

references

• N/A

what

• Custom label for cloudwatch log group name

why

• Allow slash in log group names

references

• https://sweetops.slack.com/archives/CB6GHNLG0/p1636985722167300

test

provider "aws" {
  region = "us-east-2"
}

module "cloudwatch_logs" {
  source = "github.com/cloudposse/terraform-aws-cloudwatch-logs?ref=allow-slash-log-group-names"

  name = "/aws/kinesisfirehose/aws-waf-logs-dev-app"
}

results in

  # module.cloudwatch_logs.aws_cloudwatch_log_group.default[0] will be created
  + resource "aws_cloudwatch_log_group" "default" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + name              = "/aws/kinesisfirehose/aws-waf-logs-dev-app"
      + retention_in_days = 30
      + tags              = {
          + "Name" = "/aws/kinesisfirehose/aws-waf-logs-dev-app"
        }
      + tags_all          = {
          + "Name" = "/aws/kinesisfirehose/aws-waf-logs-dev-app"
        }
    }

what

• Make IAM role conditional on feature flag.
• Run make github/init.
• Fix unintentional nested array in stream_arns output.
• Fix usage snippet such that it conforms with other modules.

why

• Not all CloudWatch Logs log group use cases require an IAM role meant for assumption by an EC2 instance. The IAM role should be conditional.
• Running make github/init updates GHA workflow-related files.
• Running make github/init updates context.tf to the latest distribution from null-label, which now has new features such as the tenant label.

references

• https://github.com/cloudposse/terraform-null-label/releases/tag/0.25.0

what

• Add permissions_boundary as a parameter
• Upgrade cloudposse/iam-role/aws module to version 0.13.0

why

• This parameter is missing in the module as an option.

references

• PR cloudposse/iam-role/aws in module

Signed-off-by: Manuel Morejon [email protected]