@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
287 lines • 10.8 kB
JavaScript
"use strict";
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.FlowLog = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Provides a VPC/Subnet/ENI/Transit Gateway/Transit Gateway Attachment Flow Log to capture IP traffic for a specific network
* interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group, a S3 Bucket, or Amazon Data Firehose
*
* ## Example Usage
*
* ### CloudWatch Logging
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const exampleLogGroup = new aws.cloudwatch.LogGroup("example", {name: "example"});
* const assumeRole = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["vpc-flow-logs.amazonaws.com"],
* }],
* actions: ["sts:AssumeRole"],
* }],
* });
* const exampleRole = new aws.iam.Role("example", {
* name: "example",
* assumeRolePolicy: assumeRole.then(assumeRole => assumeRole.json),
* });
* const exampleFlowLog = new aws.ec2.FlowLog("example", {
* iamRoleArn: exampleRole.arn,
* logDestination: exampleLogGroup.arn,
* trafficType: "ALL",
* vpcId: exampleAwsVpc.id,
* });
* const example = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* actions: [
* "logs:CreateLogGroup",
* "logs:CreateLogStream",
* "logs:PutLogEvents",
* "logs:DescribeLogGroups",
* "logs:DescribeLogStreams",
* ],
* resources: ["*"],
* }],
* });
* const exampleRolePolicy = new aws.iam.RolePolicy("example", {
* name: "example",
* role: exampleRole.id,
* policy: example.then(example => example.json),
* });
* ```
*
* ### Amazon Data Firehose logging
*
* ### S3 Logging
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const exampleBucket = new aws.s3.Bucket("example", {bucket: "example"});
* const example = new aws.ec2.FlowLog("example", {
* logDestination: exampleBucket.arn,
* logDestinationType: "s3",
* trafficType: "ALL",
* vpcId: exampleAwsVpc.id,
* });
* ```
*
* ### S3 Logging in Apache Parquet format with per-hour partitions
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const exampleBucket = new aws.s3.Bucket("example", {bucket: "example"});
* const example = new aws.ec2.FlowLog("example", {
* logDestination: exampleBucket.arn,
* logDestinationType: "s3",
* trafficType: "ALL",
* vpcId: exampleAwsVpc.id,
* destinationOptions: {
* fileFormat: "parquet",
* perHourPartition: true,
* },
* });
* ```
*
* ### Cross-Account Amazon Data Firehose Logging
*
* The following example shows how to set up a flow log in one AWS account (source) that sends logs to an Amazon Data Firehose delivery stream in another AWS account (destination).
* See the [AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-firehose.html).
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* // For source account
* const src = new aws.ec2.Vpc("src", {});
* const srcAssumeRolePolicy = aws.iam.getPolicyDocument({
* statements: [{
* actions: ["sts:AssumeRole"],
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["delivery.logs.amazonaws.com"],
* }],
* }],
* });
* const srcRole = new aws.iam.Role("src", {
* name: "tf-example-mySourceRole",
* assumeRolePolicy: srcAssumeRolePolicy.then(srcAssumeRolePolicy => srcAssumeRolePolicy.json),
* });
* // For destination account
* const dstAssumeRolePolicy = aws.iam.getPolicyDocumentOutput({
* statements: [{
* actions: ["sts:AssumeRole"],
* effect: "Allow",
* principals: [{
* type: "AWS",
* identifiers: [srcRole.arn],
* }],
* }],
* });
* const dst = new aws.iam.Role("dst", {
* name: "AWSLogDeliveryFirehoseCrossAccountRole",
* assumeRolePolicy: dstAssumeRolePolicy.apply(dstAssumeRolePolicy => dstAssumeRolePolicy.json),
* });
* const srcRolePolicy = aws.iam.getPolicyDocumentOutput({
* statements: [
* {
* effect: "Allow",
* actions: ["iam:PassRole"],
* resources: [srcRole.arn],
* conditions: [
* {
* test: "StringEquals",
* variable: "iam:PassedToService",
* values: ["delivery.logs.amazonaws.com"],
* },
* {
* test: "StringLike",
* variable: "iam:AssociatedResourceARN",
* values: [src.arn],
* },
* ],
* },
* {
* effect: "Allow",
* actions: [
* "logs:CreateLogDelivery",
* "logs:DeleteLogDelivery",
* "logs:ListLogDeliveries",
* "logs:GetLogDelivery",
* ],
* resources: ["*"],
* },
* {
* effect: "Allow",
* actions: ["sts:AssumeRole"],
* resources: [dst.arn],
* },
* ],
* });
* const srcPolicy = new aws.iam.RolePolicy("src_policy", {
* name: "tf-example-mySourceRolePolicy",
* role: srcRole.name,
* policy: srcRolePolicy.apply(srcRolePolicy => srcRolePolicy.json),
* });
* const dstFirehoseDeliveryStream = new aws.kinesis.FirehoseDeliveryStream("dst", {tags: {
* LogDeliveryEnabled: "true",
* }});
* const srcFlowLog = new aws.ec2.FlowLog("src", {
* logDestinationType: "kinesis-data-firehose",
* logDestination: dstFirehoseDeliveryStream.arn,
* trafficType: "ALL",
* vpcId: src.id,
* iamRoleArn: srcRole.arn,
* deliverCrossAccountRole: dst.arn,
* });
* const dstRolePolicy = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* actions: [
* "iam:CreateServiceLinkedRole",
* "firehose:TagDeliveryStream",
* ],
* resources: ["*"],
* }],
* });
* const dstRolePolicy2 = new aws.iam.RolePolicy("dst", {
* name: "AWSLogDeliveryFirehoseCrossAccountRolePolicy",
* role: dst.name,
* policy: dstRolePolicy.then(dstRolePolicy => dstRolePolicy.json),
* });
* ```
*
* ## Import
*
* Using `pulumi import`, import Flow Logs using the `id`. For example:
*
* ```sh
* $ pulumi import aws:ec2/flowLog:FlowLog test_flow_log fl-1a2b3c4d
* ```
*/
class FlowLog extends pulumi.CustomResource {
/**
* Get an existing FlowLog resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new FlowLog(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of FlowLog. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === FlowLog.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["arn"] = state?.arn;
resourceInputs["deliverCrossAccountRole"] = state?.deliverCrossAccountRole;
resourceInputs["destinationOptions"] = state?.destinationOptions;
resourceInputs["eniId"] = state?.eniId;
resourceInputs["iamRoleArn"] = state?.iamRoleArn;
resourceInputs["logDestination"] = state?.logDestination;
resourceInputs["logDestinationType"] = state?.logDestinationType;
resourceInputs["logFormat"] = state?.logFormat;
resourceInputs["maxAggregationInterval"] = state?.maxAggregationInterval;
resourceInputs["region"] = state?.region;
resourceInputs["subnetId"] = state?.subnetId;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
resourceInputs["trafficType"] = state?.trafficType;
resourceInputs["transitGatewayAttachmentId"] = state?.transitGatewayAttachmentId;
resourceInputs["transitGatewayId"] = state?.transitGatewayId;
resourceInputs["vpcId"] = state?.vpcId;
}
else {
const args = argsOrState;
resourceInputs["deliverCrossAccountRole"] = args?.deliverCrossAccountRole;
resourceInputs["destinationOptions"] = args?.destinationOptions;
resourceInputs["eniId"] = args?.eniId;
resourceInputs["iamRoleArn"] = args?.iamRoleArn;
resourceInputs["logDestination"] = args?.logDestination;
resourceInputs["logDestinationType"] = args?.logDestinationType;
resourceInputs["logFormat"] = args?.logFormat;
resourceInputs["maxAggregationInterval"] = args?.maxAggregationInterval;
resourceInputs["region"] = args?.region;
resourceInputs["subnetId"] = args?.subnetId;
resourceInputs["tags"] = args?.tags;
resourceInputs["trafficType"] = args?.trafficType;
resourceInputs["transitGatewayAttachmentId"] = args?.transitGatewayAttachmentId;
resourceInputs["transitGatewayId"] = args?.transitGatewayId;
resourceInputs["vpcId"] = args?.vpcId;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(FlowLog.__pulumiType, name, resourceInputs, opts);
}
}
exports.FlowLog = FlowLog;
/** @internal */
FlowLog.__pulumiType = 'aws:ec2/flowLog:FlowLog';
//# sourceMappingURL=flowLog.js.map