{"id":26096253,"url":"https://github.com/terraform-ibm-modules/terraform-ibm-cloud-logs","last_synced_at":"2026-06-27T10:00:51.660Z","repository":{"id":281319064,"uuid":"944923802","full_name":"terraform-ibm-modules/terraform-ibm-cloud-logs","owner":"terraform-ibm-modules","description":"This module supports configuring an IBM Cloud Logs instance, log routing tenants to enable platform logs and cloud logs policies.","archived":false,"fork":false,"pushed_at":"2026-06-26T20:02:05.000Z","size":876,"stargazers_count":0,"open_issues_count":2,"forks_count":2,"subscribers_count":12,"default_branch":"main","last_synced_at":"2026-06-26T22:05:52.284Z","etag":null,"topics":["cloud-logs","core-team","ibm-cloud","logging","logs","observability","terraform","terraform-module"],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/terraform-ibm-modules.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-03-08T08:42:07.000Z","updated_at":"2026-06-25T06:15:28.000Z","dependencies_parsed_at":"2026-06-26T22:03:10.874Z","dependency_job_id":null,"html_url":"https://github.com/terraform-ibm-modules/terraform-ibm-cloud-logs","commit_stats":null,"previous_names":["terraform-ibm-modules/terraform-ibm-cloud-logs"],"tags_count":154,"template":false,"template_full_name":"terraform-ibm-modules/terraform-ibm-module-template","purl":"pkg:github/terraform-ibm-modules/terraform-ibm-cloud-logs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-ibm-modules%2Fterraform-ibm-cloud-logs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-ibm-modules%2Fterraform-ibm-cloud-logs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-ibm-modules%2Fterraform-ibm-cloud-logs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-ibm-modules%2Fterraform-ibm-cloud-logs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/terraform-ibm-modules","download_url":"https://codeload.github.com/terraform-ibm-modules/terraform-ibm-cloud-logs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-ibm-modules%2Fterraform-ibm-cloud-logs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34848932,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-27T02:00:06.362Z","response_time":126,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-logs","core-team","ibm-cloud","logging","logs","observability","terraform","terraform-module"],"created_at":"2025-03-09T14:36:03.678Z","updated_at":"2026-06-27T10:00:51.654Z","avatar_url":"https://github.com/terraform-ibm-modules.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# IBM Cloud Logs module\n\n[![Graduated (Supported)](https://img.shields.io/badge/Status-Graduated%20(Supported)-brightgreen)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)\n[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)\n[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit\u0026logoColor=white)](https://github.com/pre-commit/pre-commit)\n[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-cloud-logs?logo=GitHub\u0026sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-cloud-logs/releases/latest)\n[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)\n[![Terraform Registry](https://img.shields.io/badge/terraform-registry-623CE4?logo=terraform)](https://registry.terraform.io/modules/terraform-ibm-modules/cloud-logs/ibm/latest)\n\nThis module supports configuring an IBM Cloud Logs instance, log routing tenants to enable platform logs and cloud logs policies.\n\n## Usage\n\nTo provision Cloud Logs instance\n\n```hcl\n# Locals\nlocals {\n  region      = \"us-south\"\n  default_operations = [{\n    api_types = [\n      {\n        \"api_type_id\" : \"crn:v1:bluemix:public:context-based-restrictions::::api-type:\"\n      }\n    ]\n  }]\n}\n\n# Required providers\nterraform {\n  required_version = \"\u003e= 1.0.0\"\n  required_providers {\n    ibm = {\n      source  = \"ibm-cloud/ibm\"\n      version = \"X.Y.Z\" # lock into a supported provider version\n    }\n  }\n}\nprovider \"ibm\" {\n  ibmcloud_api_key = XXXXXXXXXXXX  # pragma: allowlist secret\n  region           = local.region\n}\n\n# IBM Cloud Logs\nmodule \"cloud_logs\" {\n  source            = \"terraform-ibm-modules/cloud-logs/ibm\"\n  version           = \"X.Y.Z\" # Replace \"X.Y.Z\" with a release version to lock into a specific release\n  resource_group_id = \"xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX\"\n  region            = local.region\n  data_storage = {\n    # logs and metrics buckets must be different\n    logs_data = {\n      enabled         = true\n      bucket_crn      = \"crn:v1:bluemix:public:cloud-object-storage:global:a/......\"\n      bucket_endpoint = \"s3.direct.us-south.cloud-object-storage.appdomain.cloud\"\n    },\n    metrics_data = {\n      enabled         = true\n      bucket_crn      = \"crn:v1:bluemix:public:cloud-object-storage:global:a/......\"\n      bucket_endpoint = \"s3.direct.us-south.cloud-object-storage.appdomain.cloud\"\n    }\n  }\n\n  # Create policies\n  policies = [{\n    logs_policy_name        = \"logs_policy_name\"\n    logs_policy_priority    = \"type_medium\"\n    application_rule = [{\n      name         = \"test-system-app\"\n      rule_type_id = \"start_with\"\n    }]\n    subsystem_rule = [{\n      name         = \"test-sub-system\"\n      rule_type_id = \"start_with\"\n    }]\n    log_rules = [{\n      severities = [\"info\", \"debug\"]\n    }]\n  }]\n\n  # CBR\n  cbr_rules = [{\n    description      = \"Rules for cloud logs access\"\n    account_id       = \"xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX\"\n    enforcement_mode = \"report\"\n    rule_contexts = [{\n      attributes = [\n        {\n          \"name\" : \"endpointType\",\n          \"value\" : \"private\"\n        },\n        {\n          name  = \"networkZoneId\"\n          value = \"xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX\"\n        }\n      ]\n      }]\n      operations = local.default_operations\n  }]\n}\n```\n\n### Required IAM access policies\n\nYou need the following permissions to run this module.\n\n- Service\n  - **Resource group only**\n    - `Viewer` access on the specific resource group\n  - **Cloud Logs**\n    - `Editor` platform access\n    - `Manager` service access\n  - **IBM Cloud Logs Routing** (Required if creating tenants, which are required to enable platform logs)\n    - `Editor` platform access\n    - `Manager` service access\n  - **Tagging service** (Required if attaching access tags to the ICL instance)\n    - `Editor` platform access\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n### Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.9.0 |\n| \u003ca name=\"requirement_ibm\"\u003e\u003c/a\u003e [ibm](#requirement\\_ibm) | \u003e= 1.80.2, \u003c 3.0.0 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | \u003e= 3.5.1, \u003c 4.0.0 |\n| \u003ca name=\"requirement_time\"\u003e\u003c/a\u003e [time](#requirement\\_time) | \u003e= 0.9.1, \u003c 1.0.0 |\n\n### Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_cbr_rule\"\u003e\u003c/a\u003e [cbr\\_rule](#module\\_cbr\\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.36.6 |\n| \u003ca name=\"module_cos_bucket_crn_parser\"\u003e\u003c/a\u003e [cos\\_bucket\\_crn\\_parser](#module\\_cos\\_bucket\\_crn\\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.9.0 |\n| \u003ca name=\"module_en_integration\"\u003e\u003c/a\u003e [en\\_integration](#module\\_en\\_integration) | ./modules/webhook | n/a |\n| \u003ca name=\"module_logs_policies\"\u003e\u003c/a\u003e [logs\\_policies](#module\\_logs\\_policies) | ./modules/logs_policy | n/a |\n\n### Resources\n\n| Name | Type |\n|------|------|\n| [ibm_iam_authorization_policy.cos_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |\n| [ibm_iam_authorization_policy.logs_routing_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |\n| [ibm_logs_router_tenant.logs_router_tenant_instances](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/logs_router_tenant) | resource |\n| [ibm_resource_instance.cloud_logs](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_instance) | resource |\n| [ibm_resource_tag.cloud_logs_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_tag) | resource |\n| [random_string.random_tenant_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |\n| [time_sleep.wait_for_cos_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |\n| [ibm_iam_access_tag.access_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/iam_access_tag) | data source |\n\n### Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_access_tags\"\u003e\u003c/a\u003e [access\\_tags](#input\\_access\\_tags) | Add existing access management tags to the Cloud Logs instance to manage access. Before you can attach your access management tags you need to create them first. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag\u0026interface=ui#create-access-console). | `list(string)` | `[]` | no |\n| \u003ca name=\"input_cbr_rules\"\u003e\u003c/a\u003e [cbr\\_rules](#input\\_cbr\\_rules) | The context-based restrictions rule to create. Only one rule is allowed. | \u003cpre\u003elist(object({\u003cbr/\u003e    description = string\u003cbr/\u003e    account_id  = string\u003cbr/\u003e    rule_contexts = list(object({\u003cbr/\u003e      attributes = optional(list(object({\u003cbr/\u003e        name  = string\u003cbr/\u003e        value = string\u003cbr/\u003e    }))) }))\u003cbr/\u003e    enforcement_mode = string\u003cbr/\u003e    operations = optional(list(object({\u003cbr/\u003e      api_types = list(object({\u003cbr/\u003e        api_type_id = string\u003cbr/\u003e      }))\u003cbr/\u003e    })))\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_data_storage\"\u003e\u003c/a\u003e [data\\_storage](#input\\_data\\_storage) | A logs data bucket and a metrics bucket in IBM Cloud Object Storage to store your IBM Cloud Logs data for long term storage, search, analysis and alerting. | \u003cpre\u003eobject({\u003cbr/\u003e    logs_data = optional(object({\u003cbr/\u003e      enabled              = optional(bool, false)\u003cbr/\u003e      bucket_crn           = optional(string)\u003cbr/\u003e      bucket_endpoint      = optional(string)\u003cbr/\u003e      skip_cos_auth_policy = optional(bool, false)\u003cbr/\u003e    }), {})\u003cbr/\u003e    metrics_data = optional(object({\u003cbr/\u003e      enabled              = optional(bool, false)\u003cbr/\u003e      bucket_crn           = optional(string)\u003cbr/\u003e      bucket_endpoint      = optional(string)\u003cbr/\u003e      skip_cos_auth_policy = optional(bool, false)\u003cbr/\u003e    }), {})\u003cbr/\u003e    }\u003cbr/\u003e  )\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"logs_data\": null,\u003cbr/\u003e  \"metrics_data\": null\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_existing_event_notifications_instances\"\u003e\u003c/a\u003e [existing\\_event\\_notifications\\_instances](#input\\_existing\\_event\\_notifications\\_instances) | List of Event Notifications instance details for routing critical events that occur in your IBM Cloud Logs. | \u003cpre\u003elist(object({\u003cbr/\u003e    crn                       = string\u003cbr/\u003e    integration_name          = optional(string)\u003cbr/\u003e    integration_endpoint_type = optional(string, \"private\")\u003cbr/\u003e    skip_iam_auth_policy      = optional(bool, false)\u003cbr/\u003e    cloud_logs_endpoint_type  = optional(string, \"public\")\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_instance_name\"\u003e\u003c/a\u003e [instance\\_name](#input\\_instance\\_name) | The name of the IBM Cloud Logs instance to create. Defaults to 'cloud-logs-\u003cregion\u003e' | `string` | `null` | no |\n| \u003ca name=\"input_logs_routing_tenant_regions\"\u003e\u003c/a\u003e [logs\\_routing\\_tenant\\_regions](#input\\_logs\\_routing\\_tenant\\_regions) | Pass a list of regions to create a tenant for that is targeted to the IBM Cloud Logs instance created by this module. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants. NOTE: You can only have 1 tenant per region in an account. | `list(any)` | `[]` | no |\n| \u003ca name=\"input_plan\"\u003e\u003c/a\u003e [plan](#input\\_plan) | The IBM Cloud Logs plan to provision. Available: standard | `string` | `\"standard\"` | no |\n| \u003ca name=\"input_policies\"\u003e\u003c/a\u003e [policies](#input\\_policies) | Configuration of IBM Cloud Logs policies. | \u003cpre\u003elist(object({\u003cbr/\u003e    logs_policy_name        = string\u003cbr/\u003e    logs_policy_description = optional(string, null)\u003cbr/\u003e    logs_policy_priority    = string\u003cbr/\u003e    application_rule = optional(list(object({\u003cbr/\u003e      name         = string\u003cbr/\u003e      rule_type_id = string\u003cbr/\u003e    })))\u003cbr/\u003e    subsystem_rule = optional(list(object({\u003cbr/\u003e      name         = string\u003cbr/\u003e      rule_type_id = string\u003cbr/\u003e    })))\u003cbr/\u003e    log_rules = optional(list(object({\u003cbr/\u003e      severities = list(string)\u003cbr/\u003e    })))\u003cbr/\u003e    archive_retention = optional(list(object({\u003cbr/\u003e      id = string\u003cbr/\u003e    })))\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_region\"\u003e\u003c/a\u003e [region](#input\\_region) | The IBM Cloud region where IBM Cloud logs instance will be created. | `string` | `\"us-south\"` | no |\n| \u003ca name=\"input_resource_group_id\"\u003e\u003c/a\u003e [resource\\_group\\_id](#input\\_resource\\_group\\_id) | The id of the IBM Cloud resource group where the instance will be created. | `string` | `null` | no |\n| \u003ca name=\"input_resource_tags\"\u003e\u003c/a\u003e [resource\\_tags](#input\\_resource\\_tags) | Add user resource tags to the Cloud Logs instance to organize, track, and manage costs. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag\u0026interface=ui#tag-types). | `list(string)` | `[]` | no |\n| \u003ca name=\"input_retention_period\"\u003e\u003c/a\u003e [retention\\_period](#input\\_retention\\_period) | The number of days IBM Cloud Logs will retain the logs data in Priority insights. Allowed values: 7, 14, 30, 60, 90. | `number` | `7` | no |\n| \u003ca name=\"input_service_endpoints\"\u003e\u003c/a\u003e [service\\_endpoints](#input\\_service\\_endpoints) | The type of the service endpoint that will be set for the IBM Cloud Logs instance. Allowed values: public-and-private. | `string` | `\"public-and-private\"` | no |\n| \u003ca name=\"input_skip_logs_routing_auth_policy\"\u003e\u003c/a\u003e [skip\\_logs\\_routing\\_auth\\_policy](#input\\_skip\\_logs\\_routing\\_auth\\_policy) | Whether to create an IAM authorization policy that permits the Logs Routing server 'Sender' access to the IBM Cloud Logs instance created by this module. | `bool` | `false` | no |\n\n### Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_account_id\"\u003e\u003c/a\u003e [account\\_id](#output\\_account\\_id) | The account id where IBM Cloud logs instance is provisioned. |\n| \u003ca name=\"output_crn\"\u003e\u003c/a\u003e [crn](#output\\_crn) | The CRN of the provisioned IBM Cloud Logs instance. |\n| \u003ca name=\"output_guid\"\u003e\u003c/a\u003e [guid](#output\\_guid) | The guid of the provisioned IBM Cloud Logs instance. |\n| \u003ca name=\"output_ingress_endpoint\"\u003e\u003c/a\u003e [ingress\\_endpoint](#output\\_ingress\\_endpoint) | The public ingress endpoint of the provisioned IBM Cloud Logs instance. |\n| \u003ca name=\"output_ingress_private_endpoint\"\u003e\u003c/a\u003e [ingress\\_private\\_endpoint](#output\\_ingress\\_private\\_endpoint) | The private ingress endpoint of the provisioned IBM Cloud Logs instance. |\n| \u003ca name=\"output_logs_policies_details\"\u003e\u003c/a\u003e [logs\\_policies\\_details](#output\\_logs\\_policies\\_details) | The details of the IBM Cloud logs policies created. |\n| \u003ca name=\"output_name\"\u003e\u003c/a\u003e [name](#output\\_name) | The name of the provisioned IBM Cloud Logs instance. |\n| \u003ca name=\"output_resource_group_id\"\u003e\u003c/a\u003e [resource\\_group\\_id](#output\\_resource\\_group\\_id) | The resource group where IBM Cloud Logs instance resides. |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-ibm-modules%2Fterraform-ibm-cloud-logs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fterraform-ibm-modules%2Fterraform-ibm-cloud-logs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-ibm-modules%2Fterraform-ibm-cloud-logs/lists"}