bugfix: Add policies for logging (#389)

* Add policies for logging

* Add policies for logging

Author: npalm

modules/runners/logging.tf

@@ -18,3 +18,14 @@ resource "aws_cloudwatch_log_group" "runners" {
   retention_in_days = var.logging_retention_in_days
   tags              = local.tags
 }
+
+resource "aws_iam_role_policy" "cloudwatch" {
+  count = var.enable_ssm_on_runners ? 1 : 0
+  name  = "CloudWatchLogginAndMetrics"
+  role  = aws_iam_role.runner.name
+  policy = templatefile("${path.module}/policies/instance-cloudwatch-policy.json",
+    {
+      ssm_parameter_arn = aws_ssm_parameter.cloudwatch_agent_config_runner[0].arn
+    }
+  )
+}

modules/runners/policies-runner.tf

@@ -45,3 +45,5 @@ resource "aws_iam_role_policy_attachment" "managed_policies" {
   role       = aws_iam_role.runner.name
   policy_arn = element(var.runner_iam_role_managed_policy_arns, count.index)
 }
+
+// see also logging.tf for logging and metrics policies

modules/runners/policies/instance-cloudwatch-policy.json

@@ -0,0 +1,25 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "cloudwatch:PutMetricData",
+                "ec2:DescribeVolumes",
+                "ec2:DescribeTags",
+                "logs:PutLogEvents",
+                "logs:DescribeLogStreams",
+                "logs:DescribeLogGroups",
+                "logs:CreateLogStream"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "ssm:GetParameter"
+            ],
+            "Resource": "${ssm_parameter_arn}/*"
+        }
+    ]
+}