initial commit

2026-02-13 15:44:24 +08:00
parent 66be8224f4
commit 09ce4c881a
570 changed files with 61807 additions and 0 deletions
@@ -0,0 +1,63 @@
+resource "aws_flow_log" "vpc-flowlog" {
+  count           = var.enable-flow-log ? 1 : 0
+  iam_role_arn    = aws_iam_role.vpcflowlog-role.arn
+  log_destination = aws_cloudwatch_log_group.vpcflowlog-loggroup[0].arn
+  traffic_type    = "ALL"
+  vpc_id          = aws_vpc.vpc.id
+  tags = {
+    Name = "${local.resource-prefix}-vpcflowlog"
+  }
+}
+
+resource "aws_cloudwatch_log_group" "vpcflowlog-loggroup" {
+  count = var.enable-flow-log ? 1 : 0
+
+  name_prefix = "vpcflowlog/${aws_vpc.vpc.id}/"
+  kms_key_id  = var.vpcflowlog-cwl-loggroup-key-arn
+
+  retention_in_days = var.vpcflowlog-retain-days
+}
+
+resource "aws_iam_role" "vpcflowlog-role" {
+  name               = "${local.resource-prefix}-vpcflowlog"
+  path               = "/service/"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "vpc-flow-logs.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "vpcflowlog-role-policy" {
+  name = "${local.resource-prefix}-vpcflowlog"
+  role = aws_iam_role.vpcflowlog-role.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}