{"id":36767374,"url":"https://github.com/ghostsecurityarchive/terraform-ghost-log-forwarder","last_synced_at":"2026-01-12T13:01:58.860Z","repository":{"id":269086475,"uuid":"902610960","full_name":"ghostsecurity/terraform-ghost-log-forwarder","owner":"ghostsecurity","description":"The Ghost Security terraform module for forwarding logs from AWS","archived":false,"fork":false,"pushed_at":"2025-03-24T20:40:08.000Z","size":31,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-24T21:34:23.542Z","etag":null,"topics":["managed-by-terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ghostsecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-12T23:02:50.000Z","updated_at":"2025-03-24T20:39:32.000Z","dependencies_parsed_at":"2025-03-24T21:27:34.567Z","dependency_job_id":"490a13e6-76c3-4b10-bff5-d4cf47b857b5","html_url":"https://github.com/ghostsecurity/terraform-ghost-log-forwarder","commit_stats":null,"previous_names":["ghostsecurity/terraform-ghost-log-forwarder"],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/ghostsecurity/terraform-ghost-log-forwarder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghostsecurity%2Fterraform-ghost-log-forwarder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghostsecurity%2Fterraform-ghost-log-forwarder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghostsecurity%2Fterraform-ghost-log-forwarder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghostsecurity%2Fterraform-ghost-log-forwarder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ghostsecurity","download_url":"https://codeload.github.com/ghostsecurity/terraform-ghost-log-forwarder/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghostsecurity%2Fterraform-ghost-log-forwarder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28338990,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-12T12:22:26.515Z","status":"ssl_error","status_checked_at":"2026-01-12T12:22:10.856Z","response_time":98,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["managed-by-terraform"],"created_at":"2026-01-12T13:01:56.970Z","updated_at":"2026-01-12T13:01:58.854Z","avatar_url":"https://github.com/ghostsecurity.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-ghost-log-forwarder\nTerraform module which deploys a [Ghost](https://ghostsecurity.com/) log forwarder to AWS for sending [ALB logs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html) to the Ghost platform.\n\nRefer to the [Log Based Discovery](https://docs.ghostsecurity.com/en/articles/9471377-log-based-discovery-alpha) documentation for more on how this is used in the Ghost platform.\n\n## Considerations\n- Ensure resources created in AWS are unique to avoid naming conflict errors.\n- S3 bucket versioning must be enabled on the `source` bucket to allow for S3 bucket replication to be configured.\n- Only replicate new log files to the log forwarder bucket. Do not replicate existing objects.\n- The module expects a Ghost API key with `write:logs` permissions as the value in the `api_key_secret_arn` input variable.\n    - Use the [API Keys](https://app.ghostsecurity.com/settings/apikeys) page to generate a new key and store this in AWS secrets manager.\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Example\nThe following example deploys a log forwarder and configures [S3 ojbect replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html) to copy log files from an existing `source` S3 bucket.\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp/aws\"\n      version = \"~\u003e 5.81.0\"\n    }\n    ghost = {\n      source  = \"ghostsecurity/ghost\",\n      version = \"~\u003e 0.1.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = \"us-east-2\"\n}\n\n# This must be updated to reference an existing S3 bucket that is receiving logs\n# from your application load balancer.\ndata \"aws_s3_bucket\" \"source\" {\n  bucket = \"source-bucket-name\"\n}\n\n# The value in this secret must be a string literal that is the Ghost API key \n# that can be created in your account by navigating to https://app.ghostsecurity.com/settings/apikeys\ndata \"aws_secretsmanager_secret\" \"ghost_api_key\" {\n  name = \"dev/ghost-api-key\"\n}\n\n# Deploy the Ghost log forwarder.\n# Change the name to something meaningful in your organization.\nmodule \"dev-alb-forwarder\" {\n  source             = \"ghostsecurity/log-forwarder/ghost\"\n  name               = \"example-forwarder\"\n  api_key_secret_arn = data.aws_secretsmanager_secret.ghost_api_key.arn\n}\n\ndata \"aws_s3_bucket\" \"dest\" {\n  bucket = module.dev-alb-forwarder.s3_input_bucket\n}\n\n# The following resources configure an example S3 replication policy to\n# copy logs from the source bucket to the log forwarder bucket so that they\n# will be processed and sent to the Ghost platform.\ndata \"aws_iam_policy_document\" \"assume_role\" {\n  statement {\n    effect = \"Allow\"\n\n    principals {\n      type        = \"Service\"\n      identifiers = [\"s3.amazonaws.com\"]\n    }\n\n    actions = [\"sts:AssumeRole\"]\n  }\n}\n\nresource \"aws_iam_role\" \"replication\" {\n  name               = \"example-replication-role\"\n  assume_role_policy = data.aws_iam_policy_document.assume_role.json\n}\n\ndata \"aws_iam_policy_document\" \"replication\" {\n  statement {\n    effect = \"Allow\"\n\n    actions = [\n      \"s3:GetReplicationConfiguration\",\n      \"s3:ListBucket\",\n    ]\n\n    resources = [data.aws_s3_bucket.source.arn]\n  }\n\n  statement {\n    effect = \"Allow\"\n\n    actions = [\n      \"s3:GetObjectVersionForReplication\",\n      \"s3:GetObjectVersionAcl\",\n      \"s3:GetObjectVersionTagging\",\n    ]\n\n    resources = [\"${data.aws_s3_bucket.source.arn}/*\"]\n  }\n\n  statement {\n    effect = \"Allow\"\n\n    actions = [\n      \"s3:ReplicateObject\",\n      \"s3:ReplicateDelete\",\n      \"s3:ReplicateTags\",\n    ]\n\n    resources = [\"${data.aws_s3_bucket.dest.arn}/*\"]\n  }\n}\n\nresource \"aws_iam_policy\" \"replication\" {\n  name   = \"example-replication-policy\"\n  policy = data.aws_iam_policy_document.replication.json\n}\n\nresource \"aws_iam_role_policy_attachment\" \"replication\" {\n  role       = aws_iam_role.replication.name\n  policy_arn = aws_iam_policy.replication.arn\n}\n\nresource \"aws_s3_bucket_replication_configuration\" \"replication\" {\n  role   = aws_iam_role.replication.arn\n  bucket = data.aws_s3_bucket.source.id\n\n  rule {\n    filter {\n      prefix = \"AWSLogs\"\n    }\n\n    status = \"Enabled\"\n\n    delete_marker_replication {\n      status = \"Enabled\"\n    }\n\n    destination {\n      bucket        = data.aws_s3_bucket.dest.arn\n      storage_class = \"STANDARD\"\n    }\n  }\n}\n```\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 5.81.0 |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_lambda_arn\"\u003e\u003c/a\u003e [lambda\\_arn](#output\\_lambda\\_arn) | The ARN of the Log Processing Lambda Function |\n| \u003ca name=\"output_lambda_role_arn\"\u003e\u003c/a\u003e [lambda\\_role\\_arn](#output\\_lambda\\_role\\_arn) | The ARN of the IAM Role used by the Log Processing Lambda Function to access Secrets and S3 |\n| \u003ca name=\"output_s3_input_bucket\"\u003e\u003c/a\u003e [s3\\_input\\_bucket](#output\\_s3\\_input\\_bucket) | The name of the input bucket |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_api_key_secret_arn\"\u003e\u003c/a\u003e [api\\_key\\_secret\\_arn](#input\\_api\\_key\\_secret\\_arn) | ARN of a secret in AWS secrets manager that contains a Ghost API key with write:logs permissions | `string` | n/a | yes |\n| \u003ca name=\"input_api_url\"\u003e\u003c/a\u003e [api\\_url](#input\\_api\\_url) | Base URL for the Ghost API | `string` | `\"https://api.ghostsecurity.com\"` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | The name for this log forwarder. This must be unique within your AWS account. | `string` | n/a | yes |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Map of tags to assign to all resources. By default resources are tagged with ghost:forwarder\\_id and ghost:forwarder\\_name. | `map(string)` | `{}` | no |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_iam_policy.forwarder_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_role.log_converter_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy_attachment.log_converter_bucket_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.log_converter_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_lambda_function.log_converter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |\n| [aws_lambda_permission.log_converter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |\n| [aws_s3_bucket.input_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |\n| [aws_s3_bucket_lifecycle_configuration.input_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |\n| [aws_s3_bucket_notification.input](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |\n| [aws_s3_bucket_versioning.input](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy.basic_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy_document.forwarder_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.lambda_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostsecurityarchive%2Fterraform-ghost-log-forwarder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fghostsecurityarchive%2Fterraform-ghost-log-forwarder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostsecurityarchive%2Fterraform-ghost-log-forwarder/lists"}