Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/terraform-ibm-modules/terraform-ibm-observability-instances

Deploys services for Log Analysis, Activity Tracker, Monitoring, and Cloud Logs
https://github.com/terraform-ibm-modules/terraform-ibm-observability-instances

activity-tracker core-team graduated ibm-cloud log-analysis logging monitoring observability-instances supported terraform terraform-module

Last synced: 6 days ago
JSON representation

Deploys services for Log Analysis, Activity Tracker, Monitoring, and Cloud Logs

Awesome Lists containing this project

README

        

# Terraform IBM Observability instances module

[![Graduated (Supported)](https://img.shields.io/badge/Status-Graduated%20(Supported)-brightgreen)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-observability-instances?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-observability-instances/releases/latest)
[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)

> [!IMPORTANT]
> The IBM Log Analysis and IBM Cloud Activity Tracker services are deprecated. IBM Cloud Logs is the replacement service. This module will be updated to provision the new services before the end of support in March 2025.

This module supports provisioning the following observability instances:

* **IBM Cloud Activity Tracker**
* Records events, compliant with CADF standard, triggered by user-initiated activities that change the state of a service in the cloud.
* **IBM Cloud Logging with Log Analysis**
* Manage operating system logs, application logs, and platform logs in IBM Cloud.
* **IBM Cloud Monitoring with Cloud Monitoring**
* Monitor the health of services and applications in IBM Cloud.

:information_source: The module also creates a manager key for each instance, and supports passing COS bucket details to enable archiving for Log Analysis and Activity Tracker, it also supports activity tracker event routing to COS, Log Analysis and Event Streams.

## Overview
* [terraform-ibm-observability-instances](#terraform-ibm-observability-instances)
* [Submodules](./modules)
* [activity_tracker](./modules/activity_tracker)
* [cloud_logs](./modules/cloud_logs)
* [cloud_monitoring](./modules/cloud_monitoring)
* [log_analysis](./modules/log_analysis)
* [Examples](./examples)
* [Provision IBM Cloud Monitoring, Log Analysis, Cloud Logs and Activity Tracker with archiving and event routing](./examples/advanced)
* [Provision basic observability instances (Log Analysis, Cloud Monitoring, Activity Tracker, Cloud Logs)](./examples/basic)
* [Contributing](#contributing)

## terraform-ibm-observability-instances

### Usage

To provision Activity Tracker, Log Analysis and IBM Cloud Monitoring

```hcl
# required ibm provider config
provider "ibm" {
ibmcloud_api_key = var.ibmcloud_api_key
}

# required logdna provider config
locals {
at_endpoint = "https://api.${var.region}.logging.cloud.ibm.com"
}

provider "logdna" {
alias = "at"
servicekey = module.observability_instances.activity_tracker_resource_key != null ? module.observability_instances.activity_tracker_resource_key : ""
url = local.at_endpoint
}

provider "logdna" {
alias = "ld"
servicekey = module.observability_instances.log_analysis_resource_key != null ? module.observability_instances.log_analysis_resource_key : ""
url = local.at_endpoint
}

module "observability_instances" {
source = "terraform-ibm-modules/observability-instances/ibm"
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
providers = {
logdna.at = logdna.at
logdna.ld = logdna.ld
}
resource_group_id = var.resource_group.id
region = var.ibm_region
}
```

To provision Log Analysis only

```hcl
# required ibm provider config
provider "ibm" {
ibmcloud_api_key = var.ibmcloud_api_key
}

# required log analysis provider config
locals {
at_endpoint = "https://api.${var.region}.logging.cloud.ibm.com"
}

provider "logdna" {
alias = "ld"
servicekey = module.log_analysis.resource_key
url = local.at_endpoint
}

module "log_analysis" {
source = "terraform-ibm-modules/observability-instances/ibm//modules/log_analysis"
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
providers = {
logdna.ld = logdna.ld
}
resource_group_id = module.resource_group.resource_group_id
region = var.region
}
```

To provision Activity Tracker only

```hcl
# required ibm provider config
provider "ibm" {
ibmcloud_api_key = var.ibmcloud_api_key
}

# required logdna provider config
locals {
at_endpoint = "https://api.${var.region}.logging.cloud.ibm.com"
}

provider "logdna" {
alias = "at"
servicekey = module.activity_tracker.at_resource_key
url = local.at_endpoint
}

module "activity_tracker" {
source = "terraform-ibm-modules/observability-instances/ibm//modules/activity_tracker"
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
providers = {
logdna.at = logdna.at
}
resource_group_id = module.resource_group.resource_group_id
region = var.region
}
```

To provision IBM Cloud Monitoring only

```hcl
module "cloud_monitoring" {
source = "terraform-ibm-modules/observability-instances/ibm//modules/cloud_monitoring"
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
resource_group_id = module.resource_group.resource_group_id
region = var.region
}
```

To provision IBM Cloud Logs only

```hcl
module "cloud_logs" {
source = "terraform-ibm-modules/observability-instances/ibm//modules/cloud_logs"
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
resource_group_id = module.resource_group.resource_group_id
region = var.region
}
```

### Required IAM access policies

You need the following permissions to run this module.

- Account Management
- **Resource Group** service
- `Viewer` platform access
- IAM Services
- **IBM Cloud Activity Tracker** service
- `Editor` platform access
- `Manager` service access
- **IBM Cloud Monitoring** service
- `Editor` platform access
- `Manager` service access
- **IBM Log Analysis** service
- `Editor` platform access
- `Manager` service access
- **IBM Cloud Logs** service
- `Editor` platform access
- `Manager` service access

To attach access management tags to resources in this module, you need the following permissions.

- IAM Services
- **Tagging** service
- `Administrator` platform access

### Requirements

| Name | Version |
|------|---------|
| [terraform](#requirement\_terraform) | >= 1.0.0 |
| [ibm](#requirement\_ibm) | >= 1.69.2, < 2.0.0 |
| [logdna](#requirement\_logdna) | >= 1.14.2, < 2.0.0 |

### Modules

| Name | Source | Version |
|------|--------|---------|
| [activity\_tracker](#module\_activity\_tracker) | ./modules/activity_tracker | n/a |
| [cloud\_logs](#module\_cloud\_logs) | ./modules/cloud_logs | n/a |
| [cloud\_monitoring](#module\_cloud\_monitoring) | ./modules/cloud_monitoring | n/a |
| [log\_analysis](#module\_log\_analysis) | ./modules/log_analysis | n/a |

### Resources

No resources.

### Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [activity\_tracker\_access\_tags](#input\_activity\_tracker\_access\_tags) | A list of access tags to apply to the Activity Tracker instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no |
| [activity\_tracker\_enable\_archive](#input\_activity\_tracker\_enable\_archive) | Enable archive on activity tracker instances | `bool` | `false` | no |
| [activity\_tracker\_instance\_name](#input\_activity\_tracker\_instance\_name) | The name of the Activity Tracker instance to create. Defaults to 'activity-tracker-' | `string` | `null` | no |
| [activity\_tracker\_manager\_key\_name](#input\_activity\_tracker\_manager\_key\_name) | The name to give the Activity Tracker manager key. | `string` | `"AtManagerKey"` | no |
| [activity\_tracker\_manager\_key\_tags](#input\_activity\_tracker\_manager\_key\_tags) | Tags associated with the Activity Tracker manager key. | `list(string)` | `[]` | no |
| [activity\_tracker\_plan](#input\_activity\_tracker\_plan) | The Activity Tracker plan to provision. Available: lite, 7-day, 14-day, 30-day, hipaa-30-day | `string` | `"lite"` | no |
| [activity\_tracker\_provision](#input\_activity\_tracker\_provision) | Provision an Activity Tracker instance? | `bool` | `true` | no |
| [activity\_tracker\_routes](#input\_activity\_tracker\_routes) | List of routes to be created, maximum four routes are allowed |

list(object({
locations = list(string)
target_ids = list(string)
route_name = string
}))
| `[]` | no |
| [activity\_tracker\_service\_endpoints](#input\_activity\_tracker\_service\_endpoints) | The type of the service endpoint that will be set for the activity tracker instance. | `string` | `"public-and-private"` | no |
| [activity\_tracker\_tags](#input\_activity\_tracker\_tags) | Tags associated with the Activity Tracker instance (Optional, array of strings). | `list(string)` | `[]` | no |
| [at\_cloud\_logs\_targets](#input\_at\_cloud\_logs\_targets) | List of Cloud Logs targets to be created |
list(object({
instance_id = string
target_region = optional(string)
target_name = string
skip_atracker_cloud_logs_iam_auth_policy = optional(bool, false)
}))
| `[]` | no |
| [at\_cos\_bucket\_endpoint](#input\_at\_cos\_bucket\_endpoint) | An endpoint for the COS bucket for the Activity Tracker archive. Pass either the public or private endpoint (Only required when var.activity\_tracker\_enable\_archive and var.activity\_tracker\_provision are true) | `string` | `null` | no |
| [at\_cos\_bucket\_name](#input\_at\_cos\_bucket\_name) | The name of an existing COS bucket to be used for the Activity Tracker archive (Only required when var.activity\_tracker\_enable\_archive and var.activity\_tracker\_provision are true). | `string` | `null` | no |
| [at\_cos\_instance\_id](#input\_at\_cos\_instance\_id) | The ID of the cloud object storage instance containing the Activity Tracker archive bucket (Only required when var.activity\_tracker\_enable\_archive and var.activity\_tracker\_provision are true). | `string` | `null` | no |
| [at\_cos\_targets](#input\_at\_cos\_targets) | List of cos target to be created |
list(object({
endpoint = string
bucket_name = string
instance_id = string
api_key = optional(string)
service_to_service_enabled = optional(bool, true)
target_region = optional(string)
target_name = string
skip_atracker_cos_iam_auth_policy = optional(bool, false)
}))
| `[]` | no |
| [at\_eventstreams\_targets](#input\_at\_eventstreams\_targets) | List of event streams target to be created |
list(object({
instance_id = string
brokers = list(string)
topic = string
api_key = string
target_region = optional(string)
target_name = string
}))
| `[]` | no |
| [at\_log\_analysis\_targets](#input\_at\_log\_analysis\_targets) | List of log analysis target to be created |
list(object({
instance_id = string
ingestion_key = string
target_region = optional(string)
target_name = string
}))
| `[]` | no |
| [cloud\_logs\_access\_tags](#input\_cloud\_logs\_access\_tags) | A list of access tags to apply to the IBM Cloud Logs instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no |
| [cloud\_logs\_data\_storage](#input\_cloud\_logs\_data\_storage) | A logs data bucket and a metrics bucket in IBM Cloud Object Storage to store your IBM Cloud Logs data for long term storage, search, analysis and alerting. |
object({
logs_data = optional(object({
enabled = optional(bool, false)
bucket_crn = optional(string)
bucket_endpoint = optional(string)
skip_cos_auth_policy = optional(bool, false)
}), {})
metrics_data = optional(object({
enabled = optional(bool, false)
bucket_crn = optional(string)
bucket_endpoint = optional(string)
skip_cos_auth_policy = optional(bool, false)
}), {})
}
)
|
{
"logs_data": null,
"metrics_data": null
}
| no |
| [cloud\_logs\_existing\_en\_instances](#input\_cloud\_logs\_existing\_en\_instances) | List of Event Notifications instance details for routing critical events that occur in your IBM Cloud Logs. |
list(object({
en_instance_id = string
en_region = string
en_integration_name = optional(string)
skip_en_auth_policy = optional(bool, false)
}))
| `[]` | no |
| [cloud\_logs\_instance\_name](#input\_cloud\_logs\_instance\_name) | The name of the IBM Cloud Logs instance to create. Defaults to 'cloud\_logs-' | `string` | `null` | no |
| [cloud\_logs\_plan](#input\_cloud\_logs\_plan) | The IBM Cloud Logs plan to provision. Available: standard | `string` | `"standard"` | no |
| [cloud\_logs\_provision](#input\_cloud\_logs\_provision) | Provision a IBM Cloud Logs instance? | `bool` | `true` | no |
| [cloud\_logs\_retention\_period](#input\_cloud\_logs\_retention\_period) | The number of days IBM Cloud Logs will retain the logs data in Priority insights. Allowed values: 7, 14, 30, 60, 90. | `number` | `7` | no |
| [cloud\_logs\_service\_endpoints](#input\_cloud\_logs\_service\_endpoints) | The type of the service endpoint that will be set for the IBM Cloud Logs instance. | `string` | `"public-and-private"` | no |
| [cloud\_logs\_tags](#input\_cloud\_logs\_tags) | Tags associated with the IBM Cloud Logs instance (Optional, array of strings). | `list(string)` | `[]` | no |
| [cloud\_monitoring\_access\_tags](#input\_cloud\_monitoring\_access\_tags) | A list of access tags to apply to the Cloud Monitoring instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no |
| [cloud\_monitoring\_instance\_name](#input\_cloud\_monitoring\_instance\_name) | The name of the IBM Cloud Monitoring instance to create. Defaults to 'cloud\_monitoring-' | `string` | `null` | no |
| [cloud\_monitoring\_manager\_key\_name](#input\_cloud\_monitoring\_manager\_key\_name) | The name to give the IBM Cloud Monitoring manager key. | `string` | `"SysdigManagerKey"` | no |
| [cloud\_monitoring\_manager\_key\_tags](#input\_cloud\_monitoring\_manager\_key\_tags) | Tags associated with the IBM Cloud Monitoring manager key. | `list(string)` | `[]` | no |
| [cloud\_monitoring\_plan](#input\_cloud\_monitoring\_plan) | The IBM Cloud Monitoring plan to provision. Available: lite, graduated-tier | `string` | `"lite"` | no |
| [cloud\_monitoring\_provision](#input\_cloud\_monitoring\_provision) | Provision a IBM cloud monitoring instance? | `bool` | `true` | no |
| [cloud\_monitoring\_service\_endpoints](#input\_cloud\_monitoring\_service\_endpoints) | The type of the service endpoint that will be set for the IBM Cloud Monitoring instance. Allowed values: public-and-private | `string` | `"public-and-private"` | no |
| [cloud\_monitoring\_tags](#input\_cloud\_monitoring\_tags) | Tags associated with the IBM Cloud Monitoring instance (Optional, array of strings). | `list(string)` | `[]` | no |
| [enable\_platform\_logs](#input\_enable\_platform\_logs) | Receive platform logs in the provisioned IBM Cloud Logging instance. | `bool` | `true` | no |
| [enable\_platform\_metrics](#input\_enable\_platform\_metrics) | Receive platform metrics in the provisioned IBM Cloud Monitoring instance. | `bool` | `true` | no |
| [global\_event\_routing\_settings](#input\_global\_event\_routing\_settings) | Global settings for event routing |
object({
default_targets = optional(list(string), [])
metadata_region_primary = string
metadata_region_backup = optional(string)
permitted_target_regions = list(string)
private_api_endpoint_only = optional(bool, false)
})
| `null` | no |
| [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | Restricted IBM Cloud API Key used only for writing Log Analysis archives to Cloud Object Storage | `string` | `null` | no |
| [log\_analysis\_access\_tags](#input\_log\_analysis\_access\_tags) | A list of access tags to apply to the Log Analysis instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no |
| [log\_analysis\_cos\_bucket\_endpoint](#input\_log\_analysis\_cos\_bucket\_endpoint) | An endpoint for the COS bucket for the Log Analysis archive. Pass either the public or private endpoint. (Only required when var.log\_analysis\_enable\_archive and var.log\_analysis\_provision are true). | `string` | `null` | no |
| [log\_analysis\_cos\_bucket\_name](#input\_log\_analysis\_cos\_bucket\_name) | The name of an existing COS bucket to be used for the Log Analysis archive. (Only required when var.log\_analysis\_enable\_archive and var.log\_analysis\_provision are true). | `string` | `null` | no |
| [log\_analysis\_cos\_instance\_id](#input\_log\_analysis\_cos\_instance\_id) | The ID of the cloud object storage instance containing the Log Analysis archive bucket. (Only required when var.log\_analysis\_enable\_archive and var.log\_analysis\_provision are true). | `string` | `null` | no |
| [log\_analysis\_enable\_archive](#input\_log\_analysis\_enable\_archive) | Enable archive on log analysis instances | `bool` | `false` | no |
| [log\_analysis\_instance\_name](#input\_log\_analysis\_instance\_name) | The name of the IBM Cloud Logging instance to create. Defaults to 'log-analysis-' | `string` | `null` | no |
| [log\_analysis\_manager\_key\_name](#input\_log\_analysis\_manager\_key\_name) | The name to give the IBM Cloud Logging manager key. | `string` | `"LogDnaManagerKey"` | no |
| [log\_analysis\_manager\_key\_tags](#input\_log\_analysis\_manager\_key\_tags) | Tags associated with the IBM Cloud Logging manager key. | `list(string)` | `[]` | no |
| [log\_analysis\_plan](#input\_log\_analysis\_plan) | The IBM Cloud Logging plan to provision. Available: lite, 7-day, 14-day, 30-day, hipaa-30-day | `string` | `"lite"` | no |
| [log\_analysis\_provision](#input\_log\_analysis\_provision) | Provision an IBM Cloud Logging instance? | `bool` | `true` | no |
| [log\_analysis\_resource\_key\_role](#input\_log\_analysis\_resource\_key\_role) | Role assigned to provide the IBM Cloud Logging key. | `string` | `"Manager"` | no |
| [log\_analysis\_service\_endpoints](#input\_log\_analysis\_service\_endpoints) | The type of the service endpoint that will be set for the Log Analysis instance. | `string` | `"public-and-private"` | no |
| [log\_analysis\_tags](#input\_log\_analysis\_tags) | Tags associated with the IBM Cloud Logging instance (Optional, array of strings). | `list(string)` | `[]` | no |
| [logs\_routing\_tenant\_regions](#input\_logs\_routing\_tenant\_regions) | Pass a list of regions to create a tenant for that is targetted to the Cloud Logs instance created by this module. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants. | `list(any)` | `[]` | no |
| [region](#input\_region) | The IBM Cloud region where instances will be created. | `string` | `"us-south"` | no |
| [resource\_group\_id](#input\_resource\_group\_id) | The id of the IBM Cloud resource group where the instance(s) will be created. | `string` | n/a | yes |
| [skip\_logs\_routing\_auth\_policy](#input\_skip\_logs\_routing\_auth\_policy) | Whether to create an IAM authorization policy that permits Logs Routing Sender access to the IBM Cloud Logs. | `bool` | `false` | no |

### Outputs

| Name | Description |
|------|-------------|
| [activity\_tracker\_crn](#output\_activity\_tracker\_crn) | The id of the provisioned Activity Tracker instance. |
| [activity\_tracker\_guid](#output\_activity\_tracker\_guid) | The guid of the provisioned Activity Tracker instance. |
| [activity\_tracker\_manager\_key\_name](#output\_activity\_tracker\_manager\_key\_name) | The Activity Tracker manager key name |
| [activity\_tracker\_name](#output\_activity\_tracker\_name) | The name of the provisioned Activity Tracker instance. |
| [activity\_tracker\_resource\_group\_id](#output\_activity\_tracker\_resource\_group\_id) | The resource group where Activity Tracker instance resides |
| [activity\_tracker\_resource\_key](#output\_activity\_tracker\_resource\_key) | The resource/service key for agents to use |
| [activity\_tracker\_routes](#output\_activity\_tracker\_routes) | The map of created routes |
| [activity\_tracker\_targets](#output\_activity\_tracker\_targets) | The map of created targets |
| [cloud\_logs\_crn](#output\_cloud\_logs\_crn) | The id of the provisioned Cloud Logs instance. |
| [cloud\_logs\_guid](#output\_cloud\_logs\_guid) | The guid of the provisioned Cloud Logs instance. |
| [cloud\_logs\_ingress\_endpoint](#output\_cloud\_logs\_ingress\_endpoint) | The public ingress endpoint of the provisioned Cloud Logs instance. |
| [cloud\_logs\_ingress\_private\_endpoint](#output\_cloud\_logs\_ingress\_private\_endpoint) | The private ingress endpoint of the provisioned Cloud Logs instance. |
| [cloud\_logs\_name](#output\_cloud\_logs\_name) | The name of the provisioned Cloud Logs instance. |
| [cloud\_logs\_resource\_group\_id](#output\_cloud\_logs\_resource\_group\_id) | The resource group where Cloud Logs instance resides. |
| [cloud\_monitoring\_access\_key](#output\_cloud\_monitoring\_access\_key) | IBM cloud monitoring access key for agents to use |
| [cloud\_monitoring\_crn](#output\_cloud\_monitoring\_crn) | The id of the provisioned IBM cloud monitoring instance. |
| [cloud\_monitoring\_guid](#output\_cloud\_monitoring\_guid) | The guid of the provisioned IBM cloud monitoring instance. |
| [cloud\_monitoring\_manager\_key\_name](#output\_cloud\_monitoring\_manager\_key\_name) | The IBM cloud monitoring manager key name |
| [cloud\_monitoring\_name](#output\_cloud\_monitoring\_name) | The name of the provisioned IBM cloud monitoring instance. |
| [cloud\_monitoring\_resource\_group\_id](#output\_cloud\_monitoring\_resource\_group\_id) | The resource group where IBM cloud monitoring monitor instance resides |
| [log\_analysis\_crn](#output\_log\_analysis\_crn) | The id of the provisioned Log Analysis instance. |
| [log\_analysis\_guid](#output\_log\_analysis\_guid) | The guid of the provisioned Log Analysis instance. |
| [log\_analysis\_ingestion\_key](#output\_log\_analysis\_ingestion\_key) | Log Analysis ingest key for agents to use |
| [log\_analysis\_manager\_key\_name](#output\_log\_analysis\_manager\_key\_name) | The Log Analysis manager key name |
| [log\_analysis\_name](#output\_log\_analysis\_name) | The name of the provisioned Log Analysis instance. |
| [log\_analysis\_resource\_group\_id](#output\_log\_analysis\_resource\_group\_id) | The resource group where Log Analysis instance resides |
| [log\_analysis\_resource\_key](#output\_log\_analysis\_resource\_key) | Log Analysis service key for agents to use |
| [region](#output\_region) | Region that instance(s) are provisioned to. |

## Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See [Report an issue or request a feature](https://github.com/terraform-ibm-modules/.github/blob/main/.github/SUPPORT.md).

To set up your local development environment, see [Local development setup](https://terraform-ibm-modules.github.io/documentation/#/local-dev-setup) in the project documentation.