Skip to content

Commit a8260a8

Browse files
author
Kilian
committed
enha: added advanced logging configuration
1 parent 7085d21 commit a8260a8

File tree

6 files changed

+100
-30
lines changed

6 files changed

+100
-30
lines changed

‎README.md‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,17 @@ This module provides a Lambda function which logs to CloudWatch. If no image URI
2121

2222
## Inputs
2323

24-
| Name | Description | Type | Default | Required |
25-
| ------------- | --------------------------------------------------------------------------- | -------------- | ------- | :------: |
26-
| identifier | Unique identifier to differentiate global resources. | `string` | n/a | yes |
27-
| policies | List of IAM policy ARNs for the Lambda's IAM role. | `list(string)` | [] | no |
28-
| vpc_config | Object to define the subnets and security groups for the Lambda function. | `object` | null | no |
29-
| log | A flag for make the Lambda function submit logs to CloudWatch. | `bool` | false | no |
30-
| image | Object of the image which will be pulled by the Lambda function to execute. | `object` | null | no |
31-
| memory_size | Amount of memory in MB the Lambda function can use at runtime. | `number` | 128 | no |
32-
| timeout | Amount of time the Lambda function has to run in seconds. | `number` | 3 | no |
33-
| env_variables | A map of environment variables for the Lambda function at runtime. | `map(string)` | {} | no |
34-
| tags | A map of tags to add to all resources. | `map(string)` | {} | no |
24+
| Name | Description | Type | Default | Required |
25+
| ------------- | ---------------------------------------------------------------------------- | -------------- | ------- | :------: |
26+
| identifier | Unique identifier to differentiate global resources. | `string` | n/a | yes |
27+
| policies | List of IAM policy ARNs for the Lambda's IAM role. | `list(string)` | [] | no |
28+
| vpc_config | Object to define the subnets and security groups for the Lambda function. | `object` | null | no |
29+
| log_config | Object to define logging configuration of the Lambda function to CloudWatch. | `object` | null | no |
30+
| image | Object of the image which will be pulled by the Lambda function to execute. | `object` | null | no |
31+
| memory_size | Amount of memory in MB the Lambda function can use at runtime. | `number` | 128 | no |
32+
| timeout | Amount of time the Lambda function has to run in seconds. | `number` | 3 | no |
33+
| env_variables | A map of environment variables for the Lambda function at runtime. | `map(string)` | {} | no |
34+
| tags | A map of tags to add to all resources. | `map(string)` | {} | no |
3535

3636
### `vpc_config`
3737

@@ -40,6 +40,12 @@ This module provides a Lambda function which logs to CloudWatch. If no image URI
4040
| subnets | List of subnet IDs in which the Lambda function will run in. | `list(string)` | n/a | yes |
4141
| security_groups | List of security group IDs the Lambda function will hold. | `list(string)` | n/a | yes |
4242

43+
### `log_config`
44+
45+
| Name | Description | Type | Default | Required |
46+
| ----------------- | -------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | :------: |
47+
| retention_in_days | Specifies the number of days the log events shall be retained. Valid values: 1, 3, 5, 7, 14, 30, 365 and 0 (never expire). | `number` | n/a | yes |
48+
4349
### `image`
4450

4551
| Name | Description | Type | Default | Required |
@@ -48,10 +54,11 @@ This module provides a Lambda function which logs to CloudWatch. If no image URI
4854

4955
## Outputs
5056

51-
| Name | Description |
52-
| ---------- | -------------------------------------- |
53-
| arn | The ARN of the Lambda function. |
54-
| invoke_arn | The invoke ARN of the Lambda function. |
57+
| Name | Description |
58+
| -------------- | ------------------------------------------------------------------------------- |
59+
| arn | The ARN of the Lambda function. |
60+
| invoke_arn | The invoke ARN of the Lambda function. |
61+
| log_group_name | The name of the CloudWatch log group created for the Lambda function to log to. |
5562

5663
## Example
5764

‎main.tf‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
################################
2+
# CloudWatch #
3+
################################
4+
5+
resource "aws_cloudwatch_log_group" "main" {
6+
count = var.log_config != null ? 1 : 0
7+
name = "/aws/lambda/${var.identifier}"
8+
retention_in_days = try(var.log_config["retention_in_days"], null)
9+
10+
tags = var.tags
11+
}
12+
113
################################
214
# IAM Role #
315
################################
@@ -58,28 +70,27 @@ resource "aws_iam_role_policy_attachment" "vpc" {
5870

5971
# for lambda that issues logs
6072
data "aws_iam_policy_document" "log" {
61-
count = var.log ? 1 : 0
73+
count = var.log_config != null ? 1 : 0
6274
statement {
6375
actions = [
64-
"logs:CreateLogGroup",
6576
"logs:CreateLogStream",
6677
"logs:PutLogEvents"
6778
]
6879

69-
resources = ["*"]
80+
resources = [aws_cloudwatch_log_group.main[0].arn]
7081
}
7182
}
7283

7384
resource "aws_iam_policy" "log" {
74-
count = var.log ? 1 : 0
85+
count = var.log_config != null ? 1 : 0
7586
name = "${var.identifier}-CloudWatchCreateLog"
7687
policy = data.aws_iam_policy_document.log[0].json
7788

7889
tags = var.tags
7990
}
8091

8192
resource "aws_iam_role_policy_attachment" "log" {
82-
count = var.log ? 1 : 0
93+
count = var.log_config != null ? 1 : 0
8394
role = aws_iam_role.main.name
8495
policy_arn = aws_iam_policy.log[0].arn
8596
}
@@ -121,5 +132,13 @@ resource "aws_lambda_function" "main" {
121132
}
122133
}
123134

135+
dynamic "logging_config" {
136+
for_each = var.log_config != null ? [1] : []
137+
content {
138+
log_group = aws_cloudwatch_log_group.main[0].arn
139+
log_format = "Text"
140+
}
141+
}
142+
124143
tags = var.tags
125144
}

‎outputs.tf‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
output "arn" {
2-
description = "ARN of the Lambda function."
3-
value = aws_lambda_function.main.arn
2+
description = "The ARN of the Lambda function."
3+
value = try(aws_lambda_function.main.arn, null)
44
}
55

66
output "invoke_arn" {
7-
description = "Invoke ARN of the Lambda function."
8-
value = aws_lambda_function.main.invoke_arn
7+
description = "The invoke ARN of the Lambda function."
8+
value = try(aws_lambda_function.main.invoke_arn, null)
9+
}
10+
11+
output "log_group_name" {
12+
description = "The name of the CloudWatch log group created for the Lambda function to log to."
13+
value = try(aws_cloudwatch_log_group.main[0].name, null)
914
}

‎tests/lambda.tftest.hcl‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,27 @@ run "valid_vpc_config" {
6464
}
6565
}
6666
}
67+
68+
run "invalid_retention_in_days" {
69+
command = plan
70+
71+
variables {
72+
identifier = "abc"
73+
log_config = {
74+
retention_in_days = 6
75+
}
76+
}
77+
78+
expect_failures = [var.log_config]
79+
}
80+
81+
run "valid_log_config" {
82+
command = plan
83+
84+
variables {
85+
identifier = "abc"
86+
log_config = {
87+
retention_in_days = 365
88+
}
89+
}
90+
}

‎tests/policies.tftest.hcl‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ run "without_log" {
2929

3030
variables {
3131
identifier = "abc"
32-
log = false
32+
log_config = null
3333
}
3434

3535
assert {
@@ -48,7 +48,9 @@ run "with_log" {
4848

4949
variables {
5050
identifier = "abc"
51-
log = true
51+
log_config = {
52+
retention_in_days = 7
53+
}
5254
}
5355

5456
assert {

‎variables.tf‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,23 @@ variable "vpc_config" {
3030
}
3131
}
3232

33-
variable "log" {
34-
description = "A flag for make the Lambda function submit logs to CloudWatch."
35-
type = bool
36-
default = false
33+
variable "log_config" {
34+
description = "Object to define logging configuration of the Lambda function to CloudWatch."
35+
type = object({
36+
retention_in_days = number
37+
})
38+
default = null
39+
validation {
40+
condition = try(var.log_config["retention_in_days"], 1) == 1 || (
41+
try(var.log_config["retention_in_days"], 3) == 3) || (
42+
try(var.log_config["retention_in_days"], 5) == 5) || (
43+
try(var.log_config["retention_in_days"], 7) == 7) || (
44+
try(var.log_config["retention_in_days"], 14) == 14) || (
45+
try(var.log_config["retention_in_days"], 30) == 30) || (
46+
try(var.log_config["retention_in_days"], 365) == 365) || (
47+
try(var.log_config["retention_in_days"], 0) == 0)
48+
error_message = "Retention in days must be one of these values: 0, 1, 3, 5, 7, 14, 30, 365"
49+
}
3750
}
3851

3952
variable "image" {

0 commit comments

Comments
 (0)