feat: s3 bucket sub module integration into root module

Store ALB access and connection logs into S3 bucket in the root module.

Author: saumitra-dev

examples/complete/.header.md

@@ -3,8 +3,59 @@
 Configuration in this directory creates:
 
 - ECS Service in a pre-configured ECS Cluster and corresponding ECS Capacity Providers
-- Internet-facing Application Load Balancer to access the deployed services, and
-- ACM to generate an Amazon-issued certificate for a base domain, and then create a Route53 A-type record with an endpoint
+- Internet-facing Application Load Balancer to access the deployed services with S3 bucket for storing access and connection logs, and
+- ACM to generate and validate an Amazon-issued certificate for a base domain
+
+## Example `tfvars` Configuration
+
+```tf
+vpc_id                                        = "vpc-0123456789abcdefg"
+service_network_configuration_security_groups = ["sg-0123456789abcdefg"]
+private_subnets                               = ["subnet-0123456789abcdefg", "subnet-0123456789abcdefg"]
+public_subnets                                = ["subnet-0123456789abcdefg", "subnet-0123456789abcdefg"]
+
+cluster_name          = "your-cluster-name"
+container_name        = "your-container-name"
+service_desired_count = 123
+container_image       = "your-container-image:version"
+container_port        = 123
+container_cpu         = 123
+container_memory      = 123
+container_essential   = true
+container_port_mappings = [
+  {
+    name          = "your-port-mapping-name"
+    containerPort = 123
+    hostPort      = 123
+    protocol      = "your-port-mapping-protocol"
+  }
+]
+container_readonly_root_filesystem = false
+
+asg_arn                = "arn:aws:autoscaling:your-region:01234567890:autoScalingGroup:abcdefgh-ijkl-mnop-qrst-uvwxyz012345:autoScalingGroupName/your-autoscaling-group-name"
+capacity_provider_name = "your-capacity-provider-name"
+capacity_provider_managed_scaling = {
+  status                    = "ENABLED"
+  target_capacity           = 123
+  minimum_scaling_step_size = 123
+  maximum_scaling_step_size = 123
+}
+
+alb_name              = "your-alb-name"
+target_group_name     = "your-alb-target-group-name"
+target_group_protocol = "HTTP"
+target_group_health_check = {
+  path = "/path/to/health/check"
+}
+listener_port      = 123
+ssl_policy         = "ELBSecurityPolicy-TLS13-1-2-2021-06"
+security_group_alb = "your-alb-sg-name"
+
+s3_bucket_force_destroy = true
+
+base_domain = "example.com"
+domain_name = "your-service.example.com"
+```
 
 ## Usage
 

examples/complete/main.tf

@@ -1,6 +1,6 @@
-################################################################################
-# Locals
-################################################################################
+provider "aws" {
+  region = "ap-south-1"
+}
 
 locals {
   task_definition_network_mode = "awsvpc"
@@ -12,6 +12,7 @@ locals {
 
   alb_internal = false
 
+  target_group_key_name    = "default-nginx"
   target_group_target_type = "ip"
 
   listener_default_action_type = "forward"
@@ -40,7 +41,7 @@ module "ecs_deployment" {
 
     load_balancer = [
       {
-        target_group   = "target_group"
+        target_group   = local.target_group_key_name
         container_name = var.container_name
         container_port = var.container_port
       }
@@ -70,8 +71,9 @@ module "ecs_deployment" {
   capacity_provider_default_auto_scaling_group_arn = var.asg_arn
   capacity_providers = {
     capacity_provider = {
-      name            = var.capacity_provider_name
-      managed_scaling = var.capacity_provider_managed_scaling
+      name                           = var.capacity_provider_name
+      managed_termination_protection = "DISABLED"
+      managed_scaling                = var.capacity_provider_managed_scaling
     }
   }
   default_capacity_providers_strategies = [
@@ -100,7 +102,7 @@ module "ecs_deployment" {
     subnets_ids         = var.public_subnets
 
     target_groups = {
-      target_group = {
+      (local.target_group_key_name) = {
         name        = var.target_group_name
         port        = var.container_port
         protocol    = var.target_group_protocol
@@ -111,7 +113,7 @@ module "ecs_deployment" {
     }
 
     listeners = {
-      listener = {
+      this = {
         port        = var.listener_port
         protocol    = "HTTPS"
         certificate = "base_domain"
@@ -120,20 +122,23 @@ module "ecs_deployment" {
         default_action = [
           {
             type         = local.listener_default_action_type
-            target_group = var.target_group_name
+            target_group = local.target_group_key_name
           }
         ]
       }
     }
   }
+
+  # S3 Bucket
+  s3_bucket_force_destroy = var.s3_bucket_force_destroy
 }
 
 ################################################################################
 # ACM
 ################################################################################
 
 data "aws_route53_zone" "base_domain" {
-  name = var.domain_name
+  name = var.base_domain
 }
 
 ################################################################################

examples/complete/outputs.tf

@@ -42,12 +42,12 @@ output "alb_arn" {
 
 output "target_group_id" {
   description = "Identifier of the Target Group instances"
-  value       = module.ecs_deployment.alb_target_groups_ids["this"]
+  value       = module.ecs_deployment.alb_target_groups_ids[local.target_group_key_name]
 }
 
 output "target_group_arn" {
   description = "ARN of the Target Group instances"
-  value       = module.ecs_deployment.alb_target_groups_arns["this"]
+  value       = module.ecs_deployment.alb_target_groups_arns[local.target_group_key_name]
 }
 
 output "listener_id" {

examples/complete/variables.tf

@@ -118,6 +118,16 @@ variable "security_group_alb" {
   type        = string
 }
 
+variable "s3_bucket_force_destroy" {
+  description = "(Optional, Default:false) Boolean that indicates all objects (including any locked objects) should be deleted from the bucket when the bucket is destroyed so that the bucket can be destroyed without error."
+  type        = bool
+}
+
+variable "base_domain" {
+  description = "Base domain for ACM"
+  type        = string
+}
+
 variable "domain_name" {
   description = "Domain name for ACM"
   type        = string

main.tf

@@ -1,5 +1,15 @@
 locals {
   # ALB
+  alb_access_logs_default_s3_configuration = var.create_s3_bucket_for_alb_logging ? {
+    bucket  = module.s3_bucket[0].bucket_id
+    enabled = true
+    prefix  = var.s3_bucket_access_logs_prefix
+  } : null
+  alb_connection_logs_default_s3_configuration = var.create_s3_bucket_for_alb_logging ? {
+    bucket  = module.s3_bucket[0].bucket_id
+    enabled = true
+    prefix  = var.s3_bucket_connection_logs_prefix
+  } : null
   alb_target_groups = {
     for k, v in try(var.load_balancer.target_groups, {}) :
     k => merge(
@@ -249,6 +259,9 @@ module "alb" {
   preserve_host_header       = try(var.load_balancer.preserve_host_header, null)
   enable_deletion_protection = try(var.load_balancer.enable_deletion_protection, null)
 
+  access_logs     = var.load_balancer.access_logs != null ? var.load_balancer.access_logs : local.alb_access_logs_default_s3_configuration
+  connection_logs = var.load_balancer.connection_logs != null ? var.load_balancer.connection_logs : local.alb_connection_logs_default_s3_configuration
+
   target_groups = local.alb_target_groups
 
   listeners = local.alb_listeners
@@ -260,6 +273,88 @@ module "alb" {
   depends_on = [module.acm]
 }
 
+################################################################################
+# S3 Bucket Sub-module
+################################################################################
+
+data "aws_elb_service_account" "this" {}
+
+module "s3_bucket" {
+  source = "./modules/s3-bucket"
+
+  count = var.create_s3_bucket_for_alb_logging ? 1 : 0
+
+  bucket               = var.s3_bucket_name
+  bucket_force_destroy = var.s3_bucket_force_destroy
+
+  bucket_policies = {
+    alb-logs = {
+      id = "${var.s3_bucket_policy_id_prefix}-logs"
+
+      statements = [
+        {
+          sid = "AllowAccessToS3Bucket"
+
+          effect = "Allow"
+          resources = [
+            "${module.s3_bucket[0].bucket_arn}/*",
+          ]
+          actions = [
+            "s3:PutObject",
+          ]
+
+          principals = [
+            {
+              identifiers = [
+                data.aws_elb_service_account.this.arn
+              ]
+              type = "AWS"
+            }
+          ]
+        },
+        {
+          sid = "AllowPutObjectToS3Bucket"
+
+          effect = "Allow"
+          resources = [
+            "${module.s3_bucket[0].bucket_arn}/*"
+          ]
+          actions = [
+            "s3:PutObject"
+          ]
+
+          principals = [
+            {
+              identifiers = ["delivery.logs.amazonaws.com"]
+              type        = "Service"
+            }
+          ]
+        },
+        {
+          sid = "AllowGetBucketAclFromS3Bucket"
+
+          effect = "Allow"
+          resources = [
+            module.s3_bucket[0].bucket_arn
+          ]
+          actions = [
+            "s3:GetBucketAcl"
+          ]
+
+          principals = [
+            {
+              identifiers = ["delivery.logs.amazonaws.com"]
+              type        = "Service"
+            }
+          ]
+        }
+      ]
+    }
+  }
+
+  tags = var.s3_bucket_tags
+}
+
 ################################################################################
 # Amazon Certificates Manager Sub-module
 ################################################################################

modules/alb/.header.md

@@ -2,7 +2,7 @@
 
 This sub-module creates:
 
-1. Application Load Balancer in the given subnets
+1. Application Load Balancer in the given subnets with logging configuration
 2. Target Groups with Health Check configuration
 3. Listeners with Default Action configuration, and
 4. Listener Rules with Actions with `forward` and `authenticate-oidc` types, and Conditions involving `host_header`, `path_pattern`, and `http_request_method`.

outputs.tf

@@ -89,6 +89,20 @@ output "alb_listener_rules_arns" {
   value       = try(module.alb[0].listener_rules_arns, null)
 }
 
+################################################################################
+# S3 Bucket
+################################################################################
+
+output "s3_bucket_id" {
+  description = "Name of the bucket."
+  value       = try(module.s3_bucket[0].bucket_id, null)
+}
+
+output "s3_bucket_arn" {
+  description = "ARN of the bucket."
+  value       = try(module.s3_bucket[0].bucket_arn, null)
+}
+
 ################################################################################
 # Capacity Provider
 ################################################################################

variables.tf

@@ -109,6 +109,8 @@ variable "load_balancer" {
     security_groups_ids        = optional(list(string), [])
     preserve_host_header       = optional(bool)
     enable_deletion_protection = optional(bool, false)
+    access_logs                = optional(any, null)
+    connection_logs            = optional(any, null)
     target_groups              = optional(any, {})
     listeners                  = optional(any, {})
     listener_rules             = optional(any, {})
@@ -117,6 +119,58 @@ variable "load_balancer" {
   default = {}
 }
 
+################################################################################
+# S3 Bucket
+################################################################################
+
+variable "create_s3_bucket_for_alb_logging" {
+  description = "(Optional) Creates S3 bucket for storing ALB Access and Connection Logs."
+  type        = bool
+  nullable    = false
+  default     = true
+}
+
+variable "s3_bucket_name" {
+  description = "(Optional, Forces new resource) Name of the bucket."
+  type        = string
+  default     = null
+}
+
+variable "s3_bucket_force_destroy" {
+  description = "(Optional, Default:false) Boolean that indicates all objects (including any locked objects) should be deleted from the bucket when the bucket is destroyed so that the bucket can be destroyed without error."
+  type        = bool
+  nullable    = false
+  default     = false
+}
+
+variable "s3_bucket_policy_id_prefix" {
+  description = "(Optional) - Prefix of the ID for the policy document."
+  type        = string
+  nullable    = false
+  default     = "ecs-deployment-alb-"
+}
+
+variable "s3_bucket_access_logs_prefix" {
+  description = "(Optional) - Prefix for storing ALB access logs in the S3 bucket."
+  type        = string
+  nullable    = false
+  default     = "alb-access-logs"
+}
+
+variable "s3_bucket_connection_logs_prefix" {
+  description = "(Optional) - Prefix for storing ALB connection logs in the S3 bucket."
+  type        = string
+  nullable    = false
+  default     = "alb-connection-logs"
+}
+
+variable "s3_bucket_tags" {
+  description = "(Optional) Map of tags to assign to the bucket."
+  type        = map(string)
+  nullable    = false
+  default     = {}
+}
+
 ################################################################################
 # Amazon Certificates Manager Sub-module
 ################################################################################