Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/terraform-ibm-modules/terraform-ibm-cloud-logs

This module supports configuring an IBM Cloud Logs instance, log routing tenants to enable platform logs and cloud logs policies.
https://github.com/terraform-ibm-modules/terraform-ibm-cloud-logs

cloud-logs core-team ibm-cloud logging logs observability terraform terraform-module

Last synced: 14 days ago
JSON representation

This module supports configuring an IBM Cloud Logs instance, log routing tenants to enable platform logs and cloud logs policies.

Awesome Lists containing this project

README 

          
# IBM Cloud Logs module



[![Graduated (Supported)](https://img.shields.io/badge/Status-Graduated%20(Supported)-brightgreen)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)

[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)

[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)

[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-cloud-logs?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-cloud-logs/releases/latest)

[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)

[![Terraform Registry](https://img.shields.io/badge/terraform-registry-623CE4?logo=terraform)](https://registry.terraform.io/modules/terraform-ibm-modules/cloud-logs/ibm/latest)



This module supports configuring an IBM Cloud Logs instance, log routing tenants to enable platform logs and cloud logs policies.



## Usage



To provision Cloud Logs instance



```hcl

# Locals

locals {

  region      = "us-south"

  default_operations = [{

    api_types = [

      {

        "api_type_id" : "crn:v1:bluemix:public:context-based-restrictions::::api-type:"

      }

    ]

  }]

}



# Required providers

terraform {

  required_version = ">= 1.0.0"

  required_providers {

    ibm = {

      source  = "ibm-cloud/ibm"

      version = "X.Y.Z" # lock into a supported provider version

    }

  }

}

provider "ibm" {

  ibmcloud_api_key = XXXXXXXXXXXX  # pragma: allowlist secret

  region           = local.region

}



# IBM Cloud Logs

module "cloud_logs" {

  source            = "terraform-ibm-modules/cloud-logs/ibm"

  version           = "X.Y.Z" # Replace "X.Y.Z" with a release version to lock into a specific release

  resource_group_id = "xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX"

  region            = local.region

  data_storage = {

    # logs and metrics buckets must be different

    logs_data = {

      enabled         = true

      bucket_crn      = "crn:v1:bluemix:public:cloud-object-storage:global:a/......"

      bucket_endpoint = "s3.direct.us-south.cloud-object-storage.appdomain.cloud"

    },

    metrics_data = {

      enabled         = true

      bucket_crn      = "crn:v1:bluemix:public:cloud-object-storage:global:a/......"

      bucket_endpoint = "s3.direct.us-south.cloud-object-storage.appdomain.cloud"

    }

  }



  # Create policies

  policies = [{

    logs_policy_name        = "logs_policy_name"

    logs_policy_priority    = "type_medium"

    application_rule = [{

      name         = "test-system-app"

      rule_type_id = "start_with"

    }]

    subsystem_rule = [{

      name         = "test-sub-system"

      rule_type_id = "start_with"

    }]

    log_rules = [{

      severities = ["info", "debug"]

    }]

  }]



  # CBR

  cbr_rules = [{

    description      = "Rules for cloud logs access"

    account_id       = "xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX"

    enforcement_mode = "report"

    rule_contexts = [{

      attributes = [

        {

          "name" : "endpointType",

          "value" : "private"

        },

        {

          name  = "networkZoneId"

          value = "xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX"

        }

      ]

      }]

      operations = local.default_operations

  }]

}

```



### Required IAM access policies



You need the following permissions to run this module.



- Service

  - **Resource group only**

    - `Viewer` access on the specific resource group

  - **Cloud Logs**

    - `Editor` platform access

    - `Manager` service access

  - **IBM Cloud Logs Routing** (Required if creating tenants, which are required to enable platform logs)

    - `Editor` platform access

    - `Manager` service access

  - **Tagging service** (Required if attaching access tags to the ICL instance)

    - `Editor` platform access



### Requirements



| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.9.0 |

|  [ibm](#requirement\_ibm) | >= 1.80.2, < 3.0.0 |

|  [random](#requirement\_random) | >= 3.5.1, < 4.0.0 |

|  [time](#requirement\_time) | >= 0.9.1, < 1.0.0 |



### Modules



| Name | Source | Version |

|------|--------|---------|

|  [cbr\_rule](#module\_cbr\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.36.6 |

|  [cos\_bucket\_crn\_parser](#module\_cos\_bucket\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.9.0 |

|  [en\_integration](#module\_en\_integration) | ./modules/webhook | n/a |

|  [logs\_policies](#module\_logs\_policies) | ./modules/logs_policy | n/a |



### Resources



| Name | Type |

|------|------|

| [ibm_iam_authorization_policy.cos_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |

| [ibm_iam_authorization_policy.logs_routing_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |

| [ibm_logs_router_tenant.logs_router_tenant_instances](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/logs_router_tenant) | resource |

| [ibm_resource_instance.cloud_logs](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_instance) | resource |

| [ibm_resource_tag.cloud_logs_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_tag) | resource |

| [random_string.random_tenant_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |

| [time_sleep.wait_for_cos_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |

| [ibm_iam_access_tag.access_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/iam_access_tag) | data source |



### Inputs



| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [access\_tags](#input\_access\_tags) | Add existing access management tags to the Cloud Logs instance to manage access. Before you can attach your access management tags you need to create them first. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#create-access-console). | `list(string)` | `[]` | no |

|  [cbr\_rules](#input\_cbr\_rules) | The context-based restrictions rule to create. Only one rule is allowed. | 
list(object({
    description = string
    account_id  = string
    rule_contexts = list(object({
      attributes = optional(list(object({
        name  = string
        value = string
    }))) }))
    enforcement_mode = string
    operations = optional(list(object({
      api_types = list(object({
        api_type_id = string
      }))
    })))
  }))
 | `[]` | no |

|  [data\_storage](#input\_data\_storage) | A logs data bucket and a metrics bucket in IBM Cloud Object Storage to store your IBM Cloud Logs data for long term storage, search, analysis and alerting. | 
object({
    logs_data = optional(object({
      enabled              = optional(bool, false)
      bucket_crn           = optional(string)
      bucket_endpoint      = optional(string)
      skip_cos_auth_policy = optional(bool, false)
    }), {})
    metrics_data = optional(object({
      enabled              = optional(bool, false)
      bucket_crn           = optional(string)
      bucket_endpoint      = optional(string)
      skip_cos_auth_policy = optional(bool, false)
    }), {})
    }
  )
 | 
{
  "logs_data": null,
  "metrics_data": null
}
 | no |

|  [existing\_event\_notifications\_instances](#input\_existing\_event\_notifications\_instances) | List of Event Notifications instance details for routing critical events that occur in your IBM Cloud Logs. | 
list(object({
    crn                       = string
    integration_name          = optional(string)
    integration_endpoint_type = optional(string, "private")
    skip_iam_auth_policy      = optional(bool, false)
    cloud_logs_endpoint_type  = optional(string, "public")
  }))
 | `[]` | no |

|  [instance\_name](#input\_instance\_name) | The name of the IBM Cloud Logs instance to create. Defaults to 'cloud-logs-' | `string` | `null` | no |

|  [logs\_routing\_tenant\_regions](#input\_logs\_routing\_tenant\_regions) | Pass a list of regions to create a tenant for that is targeted to the IBM Cloud Logs instance created by this module. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants. NOTE: You can only have 1 tenant per region in an account. | `list(any)` | `[]` | no |

|  [plan](#input\_plan) | The IBM Cloud Logs plan to provision. Available: standard | `string` | `"standard"` | no |

|  [policies](#input\_policies) | Configuration of IBM Cloud Logs policies. | 
list(object({
    logs_policy_name        = string
    logs_policy_description = optional(string, null)
    logs_policy_priority    = string
    application_rule = optional(list(object({
      name         = string
      rule_type_id = string
    })))
    subsystem_rule = optional(list(object({
      name         = string
      rule_type_id = string
    })))
    log_rules = optional(list(object({
      severities = list(string)
    })))
    archive_retention = optional(list(object({
      id = string
    })))
  }))
 | `[]` | no |

|  [region](#input\_region) | The IBM Cloud region where IBM Cloud logs instance will be created. | `string` | `"us-south"` | no |

|  [resource\_group\_id](#input\_resource\_group\_id) | The id of the IBM Cloud resource group where the instance will be created. | `string` | `null` | no |

|  [resource\_tags](#input\_resource\_tags) | Add user resource tags to the Cloud Logs instance to organize, track, and manage costs. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#tag-types). | `list(string)` | `[]` | no |

|  [retention\_period](#input\_retention\_period) | The number of days IBM Cloud Logs will retain the logs data in Priority insights. Allowed values: 7, 14, 30, 60, 90. | `number` | `7` | no |

|  [service\_endpoints](#input\_service\_endpoints) | The type of the service endpoint that will be set for the IBM Cloud Logs instance. Allowed values: public-and-private. | `string` | `"public-and-private"` | no |

|  [skip\_logs\_routing\_auth\_policy](#input\_skip\_logs\_routing\_auth\_policy) | Whether to create an IAM authorization policy that permits the Logs Routing server 'Sender' access to the IBM Cloud Logs instance created by this module. | `bool` | `false` | no |



### Outputs



| Name | Description |

|------|-------------|

|  [account\_id](#output\_account\_id) | The account id where IBM Cloud logs instance is provisioned. |

|  [crn](#output\_crn) | The CRN of the provisioned IBM Cloud Logs instance. |

|  [guid](#output\_guid) | The guid of the provisioned IBM Cloud Logs instance. |

|  [ingress\_endpoint](#output\_ingress\_endpoint) | The public ingress endpoint of the provisioned IBM Cloud Logs instance. |

|  [ingress\_private\_endpoint](#output\_ingress\_private\_endpoint) | The private ingress endpoint of the provisioned IBM Cloud Logs instance. |

|  [logs\_policies\_details](#output\_logs\_policies\_details) | The details of the IBM Cloud logs policies created. |

|  [name](#output\_name) | The name of the provisioned IBM Cloud Logs instance. |

|  [resource\_group\_id](#output\_resource\_group\_id) | The resource group where IBM Cloud Logs instance resides. |