@renovosolutions/cdk-library-crowdstrike-ingestion
Version:
A CDK library to ease repetetive construct creation for CrowdStrike data ingestion
69 lines • 10.4 kB
JavaScript
;
var _a;
Object.defineProperty(exports, "__esModule", { value: true });
exports.CrowdStrikeLogSubscription = void 0;
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
const aws_cdk_lib_1 = require("aws-cdk-lib");
const constructs_1 = require("constructs");
;
/**
* A construct that creates an CloudWatch log group filter subscription
* for CrowdStrike data ingestion, along with an IAM role for access.
*/
class CrowdStrikeLogSubscription extends constructs_1.Construct {
/**
* Constructs a new CrowdStrikeLogSubscription.
*
* @param scope The scope in which this construct is defined.
* @param id The scoped construct ID.
* @param props The properties for the subscription.
*/
constructor(scope, id, props) {
super(scope, id);
this.logGroup = props.logGroup;
// If a role is provided, use it; otherwise, create a new role.
if (props.role) {
this.role = props.role;
}
else {
const policy = new aws_cdk_lib_1.aws_iam.ManagedPolicy(this, 'Policy', {
statements: [
new aws_cdk_lib_1.aws_iam.PolicyStatement({
effect: aws_cdk_lib_1.aws_iam.Effect.ALLOW,
actions: [
'logs:PutSubscriptionFilter',
'logs:DescribeSubscriptionFilters',
],
resources: [props.logDestinationArn],
}),
props.kmsKey ? new aws_cdk_lib_1.aws_iam.PolicyStatement({
effect: aws_cdk_lib_1.aws_iam.Effect.ALLOW,
actions: [
'kms:Decrypt',
'kms:GenerateDataKey',
],
resources: [props.kmsKey.keyArn],
}) : undefined,
].filter((statement) => statement !== undefined),
});
this.role = new aws_cdk_lib_1.aws_iam.Role(this, 'Role', {
assumedBy: new aws_cdk_lib_1.aws_iam.ServicePrincipal(`logs.${aws_cdk_lib_1.Stack.of(this).region}.amazonaws.com`),
managedPolicies: [policy],
});
}
/**
* Create the subscription filter for the log group.
* The default filter will match all log events.
*/
this.subscriptionFilter = new aws_cdk_lib_1.aws_logs.CfnSubscriptionFilter(this, 'SubscriptionFilter', {
logGroupName: this.logGroup.logGroupName,
filterPattern: props.filterPattern || '%.%',
destinationArn: props.logDestinationArn,
roleArn: this.role.roleArn,
});
}
}
exports.CrowdStrikeLogSubscription = CrowdStrikeLogSubscription;
_a = JSII_RTTI_SYMBOL_1;
CrowdStrikeLogSubscription[_a] = { fqn: "@renovosolutions/cdk-library-crowdstrike-ingestion.CrowdStrikeLogSubscription", version: "0.1.2" };
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9nc3Vic2NyaXB0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2xvZ3N1YnNjcmlwdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUtxQjtBQUNyQiwyQ0FBdUM7QUFzQ3RDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFhLDBCQUEyQixTQUFRLHNCQUFTO0lBY3ZEOzs7Ozs7T0FNRztJQUNILFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBc0M7UUFDOUUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQixJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUM7UUFFL0IsK0RBQStEO1FBQy9ELElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDO1FBQ3pCLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxNQUFNLEdBQUcsSUFBSSxxQkFBRyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFO2dCQUNuRCxVQUFVLEVBQUU7b0JBQ1YsSUFBSSxxQkFBRyxDQUFDLGVBQWUsQ0FBQzt3QkFDdEIsTUFBTSxFQUFFLHFCQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7d0JBQ3hCLE9BQU8sRUFBRTs0QkFDUCw0QkFBNEI7NEJBQzVCLGtDQUFrQzt5QkFDbkM7d0JBQ0QsU0FBUyxFQUFFLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDO3FCQUNyQyxDQUFDO29CQUNGLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUkscUJBQUcsQ0FBQyxlQUFlLENBQUM7d0JBQ3JDLE1BQU0sRUFBRSxxQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO3dCQUN4QixPQUFPLEVBQUU7NEJBQ1AsYUFBYTs0QkFDYixxQkFBcUI7eUJBQ3RCO3dCQUNELFNBQVMsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO3FCQUNqQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVM7aUJBQ2YsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQW9DLEVBQUUsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUNoRjthQUNGLENBQUMsQ0FBQztZQUVILElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxxQkFBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFO2dCQUNyQyxTQUFTLEVBQUUsSUFBSSxxQkFBRyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxnQkFBZ0IsQ0FBQztnQkFDbEYsZUFBZSxFQUFFLENBQUMsTUFBTSxDQUFDO2FBQzFCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRDs7O1dBR0c7UUFDSCxJQUFJLENBQUMsa0JBQWtCLEdBQUcsSUFBSSxzQkFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksRUFBRSxvQkFBb0IsRUFBRTtZQUNuRixZQUFZLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3hDLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYSxJQUFJLEtBQUs7WUFDM0MsY0FBYyxFQUFFLEtBQUssQ0FBQyxpQkFBaUI7WUFDdkMsT0FBTyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTztTQUMzQixDQUFDLENBQUM7SUFDTCxDQUFDOztBQXBFSCxnRUFxRUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge1xuICBTdGFjayxcbiAgYXdzX2lhbSBhcyBpYW0sXG4gIGF3c19rbXMgYXMga21zLFxuICBhd3NfbG9ncyBhcyBsb2dzLFxufSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcblxuLyoqXG4gKiBQcm9wZXJ0aWVzIGZvciB0aGUgQ3Jvd2RTdHJpa2VMb2dTdWJzY3JpcHRpb24gY29uc3RydWN0LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIENyb3dkU3RyaWtlTG9nU3Vic2NyaXB0aW9uUHJvcHMge1xuICAvKipcbiAgICogVGhlIGxvZyBncm91cCB0byBjcmVhdGUgdGhlIHN1YnNjcmlwdGlvbiBmaWx0ZXIgZm9yLlxuICAgKi9cbiAgcmVhZG9ubHkgbG9nR3JvdXA6IGxvZ3MuSUxvZ0dyb3VwO1xuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgbG9nIGRlc3RpbmF0aW9uIGxvZ2ljYWwgcmVzb3VyY2UuXG4gICAqL1xuICByZWFkb25seSBsb2dEZXN0aW5hdGlvbkFybjogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIGZpbHRlciBwYXR0ZXJuIGZvciB0aGUgc3Vic2NyaXB0aW9uIGZpbHRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgLSAnJS4lJyAobWF0Y2hlcyBhbGwgbG9nIGV2ZW50cykuXG4gICAqL1xuICByZWFkb25seSBmaWx0ZXJQYXR0ZXJuPzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIElBTSByb2xlIHRoYXQgQ2xvdWRXYXRjaCBMb2dzIHdpbGwgYXNzdW1lIHRvIGNyZWF0ZSB0aGUgc3Vic2NyaXB0aW9uLlxuICAgKiBJZiBub3QgcHJvdmlkZWQsIGEgbmV3IHJvbGUgd2lsbCBiZSBjcmVhdGVkIHdpdGggdGhlIG5lY2Vzc2FyeSBwZXJtaXNzaW9ucy5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBhIG5ldyByb2xlIHdpbGwgYmUgY3JlYXRlZC5cbiAgICovXG4gIHJlYWRvbmx5IHJvbGU/OiBpYW0uSVJvbGU7XG4gIC8qKlxuICAgKiBUaGUgS01TIGtleSBhdHRhY2hlZCB0byB0aGUgbG9nIGdyb3VwLCBpZiBhbnkuXG4gICAqIElmIHRoaXMgaXMgcHJvdmlkZWQsIHRoZSBuZWNlc3NhcnkgS01TIHBlcm1pc3Npb25zIHdpbGwgYmUgYWRkZWQgdG8gdGhlIHJvbGUuXG4gICAqIElmIG5vdCBwcm92aWRlZCwgYSB3YXJuaW5nIHdpbGwgYmUgaXNzdWVkIHRvIGVuc3VyZSB0aGF0IHRoZSBsb2cgZ3JvdXAgaXMgbm90IGVuY3J5cHRlZCxcbiAgICogYmVjYXVzZSBkZXBsb3ltZW50IHdpbGwgZmFpbCBkdWUgdG8gbWlzc2luZyBwZXJtaXNzaW9ucyBpZiBhIEtNUyBrZXkgaXMgdXNlZCBhbmQgbm90IGFjY291bnRlZCBmb3IuXG4gICAqIElmIGEgcm9sZSBpcyBwcm92aWRlZCwgaXQgaXMgYXNzdW1lZCB0aGF0IHRoZSByb2xlIGhhcyB0aGUgbmVjZXNzYXJ5IHBlcm1pc3Npb25zLCBhbmQgYSB3YXJuaW5nXG4gICAqIHdpbGwgbm90IGJlIGlzc3VlZCBpZiBhIEtNUyBrZXkgaXMgbm90IHByb3ZpZGVkLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vIEtNUyBrZXkuXG4gICAqL1xuICByZWFkb25seSBrbXNLZXk/OiBrbXMuSUtleTtcbn07XG5cbi8qKlxuICogQSBjb25zdHJ1Y3QgdGhhdCBjcmVhdGVzIGFuIENsb3VkV2F0Y2ggbG9nIGdyb3VwIGZpbHRlciBzdWJzY3JpcHRpb25cbiAqIGZvciBDcm93ZFN0cmlrZSBkYXRhIGluZ2VzdGlvbiwgYWxvbmcgd2l0aCBhbiBJQU0gcm9sZSBmb3IgYWNjZXNzLlxuICovXG5leHBvcnQgY2xhc3MgQ3Jvd2RTdHJpa2VMb2dTdWJzY3JpcHRpb24gZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICAvKipcbiAgICogVGhlIGxvZyBncm91cCBmb3Igd2hpY2ggdGhlIHN1YnNjcmlwdGlvbiBmaWx0ZXIgaXMgY3JlYXRlZC5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBsb2dHcm91cDogbG9ncy5JTG9nR3JvdXA7XG4gIC8qKlxuICAgKiBUaGUgc3Vic2NyaXB0aW9uIGZpbHRlciBmb3IgdGhlIGxvZyBncm91cC5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBzdWJzY3JpcHRpb25GaWx0ZXI6IGxvZ3MuQ2ZuU3Vic2NyaXB0aW9uRmlsdGVyO1xuICAvKipcbiAgICogVGhlIElBTSByb2xlIHRoYXQgQ2xvdWRXYXRjaCBMb2dzIHdpbGwgYXNzdW1lIHRvIGNyZWF0ZSB0aGUgc3Vic2NyaXB0aW9uLlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHJvbGU6IGlhbS5JUm9sZTtcblxuICAvKipcbiAgICogQ29uc3RydWN0cyBhIG5ldyBDcm93ZFN0cmlrZUxvZ1N1YnNjcmlwdGlvbi5cbiAgICpcbiAgICogQHBhcmFtIHNjb3BlIFRoZSBzY29wZSBpbiB3aGljaCB0aGlzIGNvbnN0cnVjdCBpcyBkZWZpbmVkLlxuICAgKiBAcGFyYW0gaWQgVGhlIHNjb3BlZCBjb25zdHJ1Y3QgSUQuXG4gICAqIEBwYXJhbSBwcm9wcyBUaGUgcHJvcGVydGllcyBmb3IgdGhlIHN1YnNjcmlwdGlvbi5cbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBDcm93ZFN0cmlrZUxvZ1N1YnNjcmlwdGlvblByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIHRoaXMubG9nR3JvdXAgPSBwcm9wcy5sb2dHcm91cDtcblxuICAgIC8vIElmIGEgcm9sZSBpcyBwcm92aWRlZCwgdXNlIGl0OyBvdGhlcndpc2UsIGNyZWF0ZSBhIG5ldyByb2xlLlxuICAgIGlmIChwcm9wcy5yb2xlKSB7XG4gICAgICB0aGlzLnJvbGUgPSBwcm9wcy5yb2xlO1xuICAgIH0gZWxzZSB7XG4gICAgICBjb25zdCBwb2xpY3kgPSBuZXcgaWFtLk1hbmFnZWRQb2xpY3kodGhpcywgJ1BvbGljeScsIHtcbiAgICAgICAgc3RhdGVtZW50czogW1xuICAgICAgICAgIG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAgICAgJ2xvZ3M6UHV0U3Vic2NyaXB0aW9uRmlsdGVyJyxcbiAgICAgICAgICAgICAgJ2xvZ3M6RGVzY3JpYmVTdWJzY3JpcHRpb25GaWx0ZXJzJyxcbiAgICAgICAgICAgIF0sXG4gICAgICAgICAgICByZXNvdXJjZXM6IFtwcm9wcy5sb2dEZXN0aW5hdGlvbkFybl0sXG4gICAgICAgICAgfSksXG4gICAgICAgICAgcHJvcHMua21zS2V5ID8gbmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICAgICAna21zOkRlY3J5cHQnLFxuICAgICAgICAgICAgICAna21zOkdlbmVyYXRlRGF0YUtleScsXG4gICAgICAgICAgICBdLFxuICAgICAgICAgICAgcmVzb3VyY2VzOiBbcHJvcHMua21zS2V5LmtleUFybl0sXG4gICAgICAgICAgfSkgOiB1bmRlZmluZWQsXG4gICAgICAgIF0uZmlsdGVyKChzdGF0ZW1lbnQpOiBzdGF0ZW1lbnQgaXMgaWFtLlBvbGljeVN0YXRlbWVudCA9PiBzdGF0ZW1lbnQgIT09IHVuZGVmaW5lZCxcbiAgICAgICAgKSxcbiAgICAgIH0pO1xuXG4gICAgICB0aGlzLnJvbGUgPSBuZXcgaWFtLlJvbGUodGhpcywgJ1JvbGUnLCB7XG4gICAgICAgIGFzc3VtZWRCeTogbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKGBsb2dzLiR7U3RhY2sub2YodGhpcykucmVnaW9ufS5hbWF6b25hd3MuY29tYCksXG4gICAgICAgIG1hbmFnZWRQb2xpY2llczogW3BvbGljeV0sXG4gICAgICB9KTtcbiAgICB9XG5cbiAgICAvKipcbiAgICAgKiBDcmVhdGUgdGhlIHN1YnNjcmlwdGlvbiBmaWx0ZXIgZm9yIHRoZSBsb2cgZ3JvdXAuXG4gICAgICogVGhlIGRlZmF1bHQgZmlsdGVyIHdpbGwgbWF0Y2ggYWxsIGxvZyBldmVudHMuXG4gICAgICovXG4gICAgdGhpcy5zdWJzY3JpcHRpb25GaWx0ZXIgPSBuZXcgbG9ncy5DZm5TdWJzY3JpcHRpb25GaWx0ZXIodGhpcywgJ1N1YnNjcmlwdGlvbkZpbHRlcicsIHtcbiAgICAgIGxvZ0dyb3VwTmFtZTogdGhpcy5sb2dHcm91cC5sb2dHcm91cE5hbWUsXG4gICAgICBmaWx0ZXJQYXR0ZXJuOiBwcm9wcy5maWx0ZXJQYXR0ZXJuIHx8ICclLiUnLFxuICAgICAgZGVzdGluYXRpb25Bcm46IHByb3BzLmxvZ0Rlc3RpbmF0aW9uQXJuLFxuICAgICAgcm9sZUFybjogdGhpcy5yb2xlLnJvbGVBcm4sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==