Skip to content

Commit b11d667

Browse files
miguelaferreiramiguelaferreira
authored
Add VPC Flow Logs capabilities (#316)
1 parent 3b86370 commit b11d667

File tree

12 files changed

+513
-3
lines changed

12 files changed

+513
-3
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: git://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.26.0
3+
rev: v1.27.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_docs

‎README.md

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ These types of resources are supported:
1414
* [Network ACL](https://www.terraform.io/docs/providers/aws/r/network_acl.html)
1515
* [NAT Gateway](https://www.terraform.io/docs/providers/aws/r/nat_gateway.html)
1616
* [VPN Gateway](https://www.terraform.io/docs/providers/aws/r/vpn_gateway.html)
17+
* [VPC Flow Log](https://www.terraform.io/docs/providers/aws/r/flow_log.html)
1718
* [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
1819
* Gateway: S3, DynamoDB
1920
* Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
@@ -152,6 +153,10 @@ Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to
152153

153154
You can add additional tags with `intra_subnet_tags` as with other subnet types.
154155

156+
## VPC Flow Log
157+
158+
VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
159+
155160
## Conditional creation
156161

157162
Sometimes you need to have a way to create VPC resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_vpc`.
@@ -206,6 +211,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
206211
* [Complete VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete-vpc)
207212
* [VPC with IPv6 enabled](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/ipv6)
208213
* [Network ACL](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/network-acls)
214+
* [VPC Flow Logs](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/vpc-flow-logs)
209215
* [Manage Default VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/manage-default-vpc)
210216
* Few tests and edge cases examples: [#46](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-46-no-private-subnets), [#44](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-44-asymmetric-private-subnets), [#108](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-108-route-already-exists)
211217

@@ -214,7 +220,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
214220

215221
| Name | Version |
216222
|------|---------|
217-
| aws | ~> 2.23 |
223+
| aws | ~> 2.34 |
218224

219225
## Inputs
220226

@@ -263,6 +269,8 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
263269
| create\_database\_subnet\_route\_table | Controls if separate route table for database should be created | `bool` | `false` | no |
264270
| create\_elasticache\_subnet\_group | Controls if elasticache subnet group should be created | `bool` | `true` | no |
265271
| create\_elasticache\_subnet\_route\_table | Controls if separate route table for elasticache should be created | `bool` | `false` | no |
272+
| create\_flow\_log\_cloudwatch\_iam\_role | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
273+
| create\_flow\_log\_cloudwatch\_log\_group | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
266274
| create\_redshift\_subnet\_group | Controls if redshift subnet group should be created | `bool` | `true` | no |
267275
| create\_redshift\_subnet\_route\_table | Controls if separate route table for redshift should be created | `bool` | `false` | no |
268276
| create\_vpc | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
@@ -358,6 +366,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
358366
| enable\_efs\_endpoint | Should be true if you want to provision an EFS endpoint to the VPC | `bool` | `false` | no |
359367
| enable\_elasticloadbalancing\_endpoint | Should be true if you want to provision a Elastic Load Balancing endpoint to the VPC | `bool` | `false` | no |
360368
| enable\_events\_endpoint | Should be true if you want to provision a CloudWatch Events endpoint to the VPC | `bool` | `false` | no |
369+
| enable\_flow\_log | Whether or not to enable VPC Flow Logs | `bool` | `false` | no |
361370
| enable\_git\_codecommit\_endpoint | Should be true if you want to provision an Git Codecommit endpoint to the VPC | `bool` | `false` | no |
362371
| enable\_glue\_endpoint | Should be true if you want to provision a Glue endpoint to the VPC | `bool` | `false` | no |
363372
| enable\_ipv6 | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. | `bool` | `false` | no |
@@ -388,6 +397,14 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
388397
| events\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudWatch Events endpoint | `list(string)` | `[]` | no |
389398
| events\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudWatch Events endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
390399
| external\_nat\_ip\_ids | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
400+
| flow\_log\_cloudwatch\_iam\_role\_arn | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided. | `string` | `""` | no |
401+
| flow\_log\_cloudwatch\_log\_group\_kms\_key\_id | The ARN of the KMS Key to use when encrypting log data for VPC flow logs. | `string` | n/a | yes |
402+
| flow\_log\_cloudwatch\_log\_group\_name\_prefix | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/vpc-flow-log/"` | no |
403+
| flow\_log\_cloudwatch\_log\_group\_retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | n/a | yes |
404+
| flow\_log\_destination\_arn | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided. | `string` | `""` | no |
405+
| flow\_log\_destination\_type | Type of flow log destination. Can be s3 or cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no |
406+
| flow\_log\_log\_format | The fields to include in the flow log record, in the order in which they should appear. | `string` | n/a | yes |
407+
| flow\_log\_traffic\_type | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL. | `string` | `"ALL"` | no |
391408
| git\_codecommit\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Git Codecommit endpoint | `bool` | `false` | no |
392409
| git\_codecommit\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Git Codecommit endpoint | `list` | `[]` | no |
393410
| git\_codecommit\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Git Codecommit endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list` | `[]` | no |
@@ -509,6 +526,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
509526
| transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | `list(string)` | `[]` | no |
510527
| transferserver\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
511528
| vpc\_endpoint\_tags | Additional tags for the VPC Endpoints | `map(string)` | `{}` | no |
529+
| vpc\_flow\_log\_tags | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
512530
| vpc\_tags | Additional tags for the VPC | `map(string)` | `{}` | no |
513531
| vpn\_gateway\_id | ID of VPN Gateway to attach to the VPC | `string` | `""` | no |
514532
| vpn\_gateway\_tags | Additional tags for the VPN gateway | `map(string)` | `{}` | no |
@@ -710,6 +728,10 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
710728
| vpc\_endpoint\_transferserver\_dns\_entry | The DNS entries for the VPC Endpoint for transferserver. |
711729
| vpc\_endpoint\_transferserver\_id | The ID of VPC endpoint for transferserver |
712730
| vpc\_endpoint\_transferserver\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for transferserver |
731+
| vpc\_flow\_log\_cloudwatch\_iam\_role\_arn | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
732+
| vpc\_flow\_log\_destination\_arn | The ARN of the destination for VPC Flow Logs |
733+
| vpc\_flow\_log\_destination\_type | The type of the destination for VPC Flow Logs |
734+
| vpc\_flow\_log\_id | The ID of the Flow Log resource |
713735
| vpc\_id | The ID of the VPC |
714736
| vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
715737
| vpc\_ipv6\_association\_id | The association ID for the IPv6 CIDR block |

‎examples/complete-vpc/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,11 @@ module "vpc" {
106106
sqs_endpoint_private_dns_enabled = true
107107
sqs_endpoint_security_group_ids = [data.aws_security_group.default.id]
108108

109+
# VPC Flow Logs (Cloudwatch log group and IAM role will be created)
110+
enable_flow_log = true
111+
create_flow_log_cloudwatch_log_group = true
112+
create_flow_log_cloudwatch_iam_role = true
113+
109114
tags = {
110115
Owner = "user"
111116
Environment = "staging"

‎examples/vpc-flow-logs/README.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# VPC with enabled VPC flow log to S3 and CloudWatch logs
2+
3+
Configuration in this directory creates a set of VPC resources with VPC Flow Logs enabled in different configurations:
4+
5+
1. `cloud-watch-logs.tf` - Push logs to a new AWS CloudWatch Log group.
6+
1. `cloud-watch-logs.tf` - Push logs to an existing AWS CloudWatch Log group using existing IAM role (created outside of this module).
7+
1. `s3.tf` - Push logs to an existing S3 bucket (created outside of this module).
8+
9+
## Usage
10+
11+
To run this example you need to execute:
12+
13+
```bash
14+
$ terraform init
15+
$ terraform plan
16+
$ terraform apply
17+
```
18+
19+
Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources.
20+
21+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
22+
## Providers
23+
24+
| Name | Version |
25+
|------|---------|
26+
| aws | n/a |
27+
| random | n/a |
28+
29+
## Inputs
30+
31+
No input.
32+
33+
## Outputs
34+
35+
| Name | Description |
36+
|------|-------------|
37+
| vpc\_flow\_logs\_s3\_bucket\_vpc\_flow\_log\_destination\_arn | The ARN of the destination for VPC Flow Logs |
38+
| vpc\_flow\_logs\_s3\_bucket\_vpc\_flow\_log\_destination\_type | The type of the destination for VPC Flow Logs |
39+
| vpc\_flow\_logs\_s3\_bucket\_vpc\_flow\_log\_id | The ID of the Flow Log resource |
40+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_default\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
41+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_default\_vpc\_flow\_log\_destination\_arn | The ARN of the destination for VPC Flow Logs |
42+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_default\_vpc\_flow\_log\_destination\_type | The type of the destination for VPC Flow Logs |
43+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_default\_vpc\_flow\_log\_id | The ID of the Flow Log resource |
44+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
45+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_vpc\_flow\_log\_destination\_arn | The ARN of the destination for VPC Flow Logs |
46+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_vpc\_flow\_log\_destination\_type | The type of the destination for VPC Flow Logs |
47+
| vpc\_with\_flow\_logs\_cloudwatch\_logs\_vpc\_flow\_log\_id | The ID of the Flow Log resource |
48+
49+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/vpc-flow-logs/cloud-watch-logs.tf

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
###########################################################
2+
# VPC flow logs => Cloudwatch logs (created automatically)
3+
###########################################################
4+
module "vpc_with_flow_logs_cloudwatch_logs_default" {
5+
source = "../../"
6+
7+
name = "vpc-flow-logs-cloudwatch-logs-default"
8+
9+
cidr = "10.10.0.0/16"
10+
11+
azs = ["eu-west-1a"]
12+
public_subnets = ["10.10.101.0/24"]
13+
14+
# Cloudwatch log group and IAM role will be created
15+
enable_flow_log = true
16+
create_flow_log_cloudwatch_log_group = true
17+
create_flow_log_cloudwatch_iam_role = true
18+
19+
vpc_flow_log_tags = {
20+
Name = "vpc-flow-logs-cloudwatch-logs-default"
21+
}
22+
}
23+
24+
########################################################
25+
# VPC flow logs => Cloudwatch logs (CloudWatch Log Group and IAM role created separately)
26+
########################################################
27+
module "vpc_with_flow_logs_cloudwatch_logs" {
28+
source = "../../"
29+
30+
name = "vpc-flow-logs-cloudwatch-logs"
31+
32+
cidr = "10.20.0.0/16"
33+
34+
azs = ["eu-west-1a"]
35+
public_subnets = ["10.20.101.0/24"]
36+
37+
enable_flow_log = true
38+
flow_log_destination_type = "cloud-watch-logs"
39+
flow_log_destination_arn = aws_cloudwatch_log_group.flow_log.arn
40+
flow_log_cloudwatch_iam_role_arn = aws_iam_role.vpc_flow_log_cloudwatch.arn
41+
42+
vpc_flow_log_tags = {
43+
Name = "vpc-flow-logs-cloudwatch-logs"
44+
}
45+
}
46+
47+
#######################
48+
# CloudWatch Log group
49+
#######################
50+
resource "aws_cloudwatch_log_group" "flow_log" {
51+
name = local.cloudwatch_log_group_name
52+
}
53+
54+
###########
55+
# IAM Role
56+
###########
57+
resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
58+
name_prefix = "vpc-flow-log-role-"
59+
assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role.json
60+
}
61+
62+
data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
63+
statement {
64+
principals {
65+
type = "Service"
66+
identifiers = ["vpc-flow-logs.amazonaws.com"]
67+
}
68+
69+
effect = "Allow"
70+
71+
actions = ["sts:AssumeRole"]
72+
}
73+
}
74+
75+
resource "aws_iam_role_policy_attachment" "vpc_flow_log_cloudwatch" {
76+
role = aws_iam_role.vpc_flow_log_cloudwatch.name
77+
policy_arn = aws_iam_policy.vpc_flow_log_cloudwatch.arn
78+
}
79+
80+
resource "aws_iam_policy" "vpc_flow_log_cloudwatch" {
81+
name_prefix = "vpc-flow-log-cloudwatch-"
82+
policy = data.aws_iam_policy_document.vpc_flow_log_cloudwatch.json
83+
}
84+
85+
data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
86+
statement {
87+
sid = "AWSVPCFlowLogsPushToCloudWatch"
88+
89+
effect = "Allow"
90+
91+
actions = [
92+
"logs:CreateLogGroup",
93+
"logs:CreateLogStream",
94+
"logs:PutLogEvents",
95+
"logs:DescribeLogGroups",
96+
"logs:DescribeLogStreams",
97+
]
98+
99+
resources = ["*"]
100+
}
101+
}
102+

‎examples/vpc-flow-logs/main.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
locals {
6+
s3_bucket_name = "vpc-flow-logs-to-s3-${random_pet.this.id}"
7+
cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
8+
}
9+
10+
resource "random_pet" "this" {
11+
length = 2
12+
}

‎examples/vpc-flow-logs/outputs.tf

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# VPC flow log - Cloudwatch logs (default)
2+
output "vpc_with_flow_logs_cloudwatch_logs_default_vpc_flow_log_id" {
3+
description = "The ID of the Flow Log resource"
4+
value = module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_flow_log_id
5+
}
6+
7+
output "vpc_with_flow_logs_cloudwatch_logs_default_vpc_flow_log_destination_arn" {
8+
description = "The ARN of the destination for VPC Flow Logs"
9+
value = module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_flow_log_destination_arn
10+
}
11+
12+
output "vpc_with_flow_logs_cloudwatch_logs_default_vpc_flow_log_destination_type" {
13+
description = "The type of the destination for VPC Flow Logs"
14+
value = module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_flow_log_destination_type
15+
}
16+
17+
output "vpc_with_flow_logs_cloudwatch_logs_default_vpc_flow_log_cloudwatch_iam_role_arn" {
18+
description = "The ARN of the IAM role used when pushing logs to Cloudwatch log group"
19+
value = module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_flow_log_cloudwatch_iam_role_arn
20+
}
21+
22+
# VPC flow log - Cloudwatch logs (created separately)
23+
output "vpc_with_flow_logs_cloudwatch_logs_vpc_flow_log_id" {
24+
description = "The ID of the Flow Log resource"
25+
value = module.vpc_with_flow_logs_cloudwatch_logs.vpc_flow_log_id
26+
}
27+
28+
output "vpc_with_flow_logs_cloudwatch_logs_vpc_flow_log_destination_arn" {
29+
description = "The ARN of the destination for VPC Flow Logs"
30+
value = module.vpc_with_flow_logs_cloudwatch_logs.vpc_flow_log_destination_arn
31+
}
32+
33+
output "vpc_with_flow_logs_cloudwatch_logs_vpc_flow_log_destination_type" {
34+
description = "The type of the destination for VPC Flow Logs"
35+
value = module.vpc_with_flow_logs_cloudwatch_logs.vpc_flow_log_destination_type
36+
}
37+
38+
output "vpc_with_flow_logs_cloudwatch_logs_vpc_flow_log_cloudwatch_iam_role_arn" {
39+
description = "The ARN of the IAM role used when pushing logs to Cloudwatch log group"
40+
value = module.vpc_with_flow_logs_cloudwatch_logs.vpc_flow_log_cloudwatch_iam_role_arn
41+
}
42+
43+
# VPC flow log - S3 bucket
44+
output "vpc_flow_logs_s3_bucket_vpc_flow_log_id" {
45+
description = "The ID of the Flow Log resource"
46+
value = module.vpc_with_flow_logs_s3_bucket.vpc_flow_log_id
47+
}
48+
49+
output "vpc_flow_logs_s3_bucket_vpc_flow_log_destination_arn" {
50+
description = "The ARN of the destination for VPC Flow Logs"
51+
value = module.vpc_with_flow_logs_s3_bucket.vpc_flow_log_destination_arn
52+
}
53+
54+
output "vpc_flow_logs_s3_bucket_vpc_flow_log_destination_type" {
55+
description = "The type of the destination for VPC Flow Logs"
56+
value = module.vpc_with_flow_logs_s3_bucket.vpc_flow_log_destination_type
57+
}
58+

0 commit comments

Comments
 (0)