-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rename ingester to forwarder, backfiller to subscriber
- Loading branch information
Showing
7 changed files
with
212 additions
and
212 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
176 changes: 176 additions & 0 deletions
176
cloudformation-stacks/log-groups-listener.template.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,176 @@ | ||
| Description: A lambda function to auto subscribe Axiom Forwarder to new CloudWatch Log Groups. | ||
| Parameters: | ||
| LambdaFunctionName: | ||
| Type: String | ||
| Description: Name of the AWS Lambda Function. | ||
| Default: cloudwatch-subscriber-axiom | ||
| AllowedPattern: ".+" # required | ||
| AxiomCloudWatchLambdaIngesterARN: | ||
| Type: String | ||
| Description: The ARN of the AWS Lambda Function that is used to ingest data to axiom. | ||
| AllowedPattern: ".+" # required | ||
| CloudWatchLogGroupsPrefix: | ||
| Type: String | ||
| Description: The Prefix of cloudwatch log groups to subscribe to the AWS Lambda ingester. | ||
| Default: "" # all | ||
| AxiomLambdaLogRetention: | ||
| Type: "Number" | ||
| Description: "The number of days to retain CloudWatch logs for the created lambda functions." | ||
| Default: 1 | ||
| EnableCloudTrail: | ||
| Description: "Enable Cloudtrail for cloudwatch CreateLogGroup event notification? If already enabled, choose 'false'" | ||
| Default: true | ||
| Type: String | ||
| AllowedValues: [true, false] | ||
| Conditions: | ||
| ShouldEnableCloudTrail: !Equals [true, !Ref EnableCloudTrail] | ||
| Resources: | ||
| AxiomCloudWatchLogsSubscriberS3Bucket: | ||
| Condition: ShouldEnableCloudTrail | ||
| Type: AWS::S3::Bucket | ||
| Properties: | ||
| AccessControl: BucketOwnerFullControl | ||
| BucketName: !Join ["-", [!Ref AWS::StackName, "cloudtrail"]] | ||
| AxiomCloudWatchLogsSubscriberS3BucketPolicy: | ||
| Type: AWS::S3::BucketPolicy | ||
| Condition: ShouldEnableCloudTrail | ||
| DependsOn: AxiomCloudWatchLogsSubscriberS3Bucket | ||
| Properties: | ||
| Bucket: !Ref AxiomCloudWatchLogsSubscriberS3Bucket | ||
| PolicyDocument: | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": | ||
| [ | ||
| { | ||
| "Sid": "AWSCloudTrailAclCheck20150319", | ||
| "Effect": "Allow", | ||
| "Principal": { "Service": "cloudtrail.amazonaws.com" }, | ||
| "Action": "s3:GetBucketAcl", | ||
| "Resource": | ||
| !GetAtt ["AxiomCloudWatchLogsSubscriberS3Bucket", "Arn"], | ||
| }, | ||
| { | ||
| "Sid": "AWSCloudTrailWrite20150319", | ||
| "Effect": "Allow", | ||
| "Principal": { "Service": "cloudtrail.amazonaws.com" }, | ||
| "Action": "s3:PutObject", | ||
| "Resource": | ||
| !Join [ | ||
| "", | ||
| [ | ||
| !GetAtt ["AxiomCloudWatchLogsSubscriberS3Bucket", "Arn"], | ||
| "/AWSLogs/", | ||
| { "Ref": "AWS::AccountId" }, | ||
| "/*", | ||
| ], | ||
| ], | ||
| "Condition": | ||
| { | ||
| "StringEquals": | ||
| { "s3:x-amz-acl": "bucket-owner-full-control" }, | ||
| }, | ||
| }, | ||
| ], | ||
| } | ||
| AxiomLogsSubscriberCloudTrail: | ||
| Type: AWS::CloudTrail::Trail | ||
| Condition: ShouldEnableCloudTrail | ||
| DependsOn: AxiomCloudWatchLogsSubscriberS3BucketPolicy | ||
| Properties: | ||
| EnableLogFileValidation: false | ||
| IncludeGlobalServiceEvents: true | ||
| IsMultiRegionTrail: true | ||
| IsLogging: true | ||
| S3BucketName: !Ref AxiomCloudWatchLogsSubscriberS3Bucket | ||
| TrailName: !Join ["-", [!Ref AWS::StackName, { "Ref": "AWS::AccountId" }]] | ||
| AxiomLogsSubscriberEventRule: | ||
| DependsOn: AxiomCloudWatchLogsSubscriber | ||
| Type: AWS::Events::Rule | ||
| Properties: | ||
| Description: Axiom log group auto subscription event rule., | ||
| EventPattern: | ||
| source: ["aws.logs"] | ||
| detail-type: ["AWS API Call via CloudTrail"] | ||
| detail: | ||
| eventSource: ["logs.amazonaws.com"] | ||
| eventName: ["CreateLogGroup"] | ||
| Name: | ||
| "Fn::Join": | ||
| ["-", [{ "Ref": "AWS::StackName" }, "auto-subscription-rule"]] | ||
| Targets: | ||
| - Id: !Join ["-", [!Ref "AWS::StackName", "auto-subscription-rule"]] | ||
| Arn: !GetAtt ["AxiomCloudWatchLogsSubscriber", "Arn"] | ||
| AxiomCloudWatchLogsSubscriberPolicy: | ||
| Type: AWS::IAM::Policy | ||
| Properties: | ||
| PolicyDocument: | ||
| Statement: | ||
| - Action: | ||
| - logs:DeleteSubscriptionFilter | ||
| - logs:PutSubscriptionFilter | ||
| - logs:DescribeLogGroups | ||
| - lambda:AddPermission | ||
| - lambda:RemovePermission | ||
| - lambda:InvokeFunction | ||
| - lambda:GetFunction | ||
| - logs:DescribeLogStreams | ||
| - logs:DescribeSubscriptionFilters | ||
| - logs:FilterLogEvents | ||
| - logs:GetLogEvents | ||
| Effect: Allow | ||
| Resource: "*" | ||
| PolicyName: cloudwatch-subscriber-axiom-policy | ||
| Roles: | ||
| - !Ref "AxiomCloudWatchLogsSubscriberRole" | ||
| AxiomCloudWatchLogsSubscriberRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| AssumeRolePolicyDocument: | ||
| Statement: | ||
| - Action: | ||
| - "sts:AssumeRole" | ||
| Effect: Allow | ||
| Principal: | ||
| Service: | ||
| - lambda.amazonaws.com | ||
| - logs.amazonaws.com | ||
| ManagedPolicyArns: | ||
| - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" | ||
| AxiomCloudWatchLogsSubscriber: | ||
| Type: AWS::Lambda::Function | ||
| DependsOn: | ||
| - AxiomCloudWatchLogsSubscriberRole | ||
| Properties: | ||
| FunctionName: !Ref LambdaFunctionName | ||
| Runtime: python3.9 | ||
| Handler: index.lambda_handler | ||
| Code: | ||
| ZipFile: | | ||
| # DO NOT EDIT | ||
| # CI will replace these comments with the code from ./logs_subscriber.py | ||
| Role: !GetAtt | ||
| - AxiomCloudWatchLogsSubscriberRole | ||
| - Arn | ||
| Description: Axiom CloudWatch Automatic Logs Subscriber Lambda | ||
| Environment: | ||
| Variables: | ||
| AXIOM_CLOUDWATCH_LAMBDA_INGESTER_ARN: !Ref "AxiomCloudWatchLambdaIngesterARN" | ||
| LOG_GROUP_PREFIX: !Ref "CloudWatchLogGroupsPrefix" | ||
| AxiomCloudWatchLogsSubscriberPermission: | ||
| Type: AWS::Lambda::Permission | ||
| Properties: | ||
| Action: "lambda:InvokeFunction" | ||
| FunctionName: { "Fn::GetAtt": ["AxiomCloudWatchLogsSubscriber", "Arn"] } | ||
| Principal: "events.amazonaws.com" | ||
| SourceAccount: | ||
| Ref: AWS::AccountId | ||
| SourceArn: !GetAtt ["AxiomLogsSubscriberEventRule", "Arn"] | ||
| AxiomCloudWatchLogsSubscriberLogGroup: | ||
| DependsOn: ["AxiomCloudWatchLogsSubscriberRole"] | ||
| Type: AWS::Logs::LogGroup | ||
| Properties: | ||
| LogGroupName: | ||
| !Join ["", ["/aws/lambda/", { "Ref": "AxiomCloudWatchLogsSubscriber" }]] | ||
| RetentionInDays: | ||
| Ref: "AxiomLambdaLogRetention" |
Oops, something went wrong.