blocks|key|112257|text|我错误地定义了aws_cloudwatch_log_subscription_filter资源-在这种情况下，您不应该提供role_arn参数。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|112258|您还需要添加一个aws_lambda_permission资源(在筛选器上定义了depends_on关系，否则TF可能会以错误的顺序进行添加)。|112259|请注意，AWS+lambda控制台UI会以不可见的方式为您添加lambda权限，因此请注意，如果您之前在控制台UI中执行过相同的操作，则aws_cloudwatch_log_subscription_filter将在没有权限资源的情况下工作。|112260|必要的TF配置如下所示(最后两个资源是配置实际cloudwatch->lambda触发器的相关资源)：|112261|//+intended+for+application+logs+(access+logs,+modsec,+etc.)
resource+"aws_cloudwatch_log_group"+"test-app-loggroup"+{
++name++++++++++++++=+"test-app"
++retention_in_days+=+90
}

resource+"aws_security_group"+"cloudwatch-sumologic-lambda-sg"+{
++name+=+"cloudwatch-sumologic-lambda-sg"

++tags+{
++++Name+=+"cloudwatch-sumologic-lambda-sg"
++}

++description+=+"Security+group+for+lambda+to+move+logs+from+CWL+to+SumoLogic"
++vpc_id++++++=+"${aws_vpc.dev-vpc.id}"
}

resource+"aws_security_group_rule"+"https-egress-cloudwatch-sumologic-to-internet"+{
++type++++++++++++++=+"egress"
++from_port+++++++++=+443
++to_port+++++++++++=+443
++protocol++++++++++=+"tcp"
++security_group_id+=+"${aws_security_group.cloudwatch-sumologic-lambda-sg.id}"
++cidr_blocks+++++++=+["0.0.0.0/0"]
}

resource+"aws_iam_role"+"test-cloudwatch-lambda-role"+{
++name+=+"test-cloudwatch-lambda-role"

++assume_role_policy+=+<<EOF
{
++"Version":+"2012-10-17",
++"Statement":+[
++++{
++++++"Action":+"sts:AssumeRole",
++++++"Principal":+{
++++++++"Service":+"lambda.amazonaws.com"
++++++},
++++++"Effect":+"Allow"
++++}
++]
}
EOF
}

resource+"aws_iam_role_policy"+"test-cloudwatch-lambda-policy"+{
++name+=+"test-cloudwatch-lambda-policy"
++role+=+"${aws_iam_role.test-cloudwatch-lambda-role.id}"

++policy+=+<<EOF
{
++"Version":+"2012-10-17",
++"Statement":+[
++++{
++++++"Sid":+"CopiedFromTemplateAWSLambdaVPCAccessExecutionRole1",
++++++"Effect":+"Allow",
++++++"Action":+[
++++++++"ec2:CreateNetworkInterface"
++++++],
++++++"Resource":+"*"
++++},
++++{
++++++"Sid":+"CopiedFromTemplateAWSLambdaVPCAccessExecutionRole2",
++++++"Effect":+"Allow",
++++++"Action":+[
++++++++"ec2:DescribeNetworkInterfaces",
++++++++"ec2:DeleteNetworkInterface"
++++++],
++++++"Resource":+"arn:aws:ec2:ap-southeast-2:${var.dev_vpc_account_id}:network-interface/*"
++++},

++++{
++++++"Sid":+"CopiedFromTemplateAWSLambdaBasicExecutionRole1",
++++++"Effect":+"Allow",
++++++"Action":+"logs:CreateLogGroup",
++++++"Resource":+"arn:aws:logs:ap-southeast-2:${var.dev_vpc_account_id}:*"
++++},
++++{
++++++"Sid":+"CopiedFromTemplateAWSLambdaBasicExecutionRole2",
++++++"Effect":+"Allow",
++++++"Action":+[
++++++++"logs:CreateLogStream",
++++++++"logs:PutLogEvents"
++++++],
++++++"Resource":+[
++++"arn:aws:logs:ap-southeast-2:${var.dev_vpc_account_id}:log-group:/aws/lambda/*"
++++++]
++++},

++++{
++++++"Sid":+"CopiedFromTemplateAWSLambdaAMIExecutionRole",
++++++"Effect":+"Allow",
++++++"Action":+[
+++++++++"ec2:DescribeImages"
++++++],
++++++"Resource":+"*"
++++}


++]
}
EOF
}

resource+"aws_lambda_function"+"cloudwatch-sumologic-lambda"+{
++function_name++++=+"cloudwatch-sumologic-lambda"
++filename+++++++++=+"${var.lambda_dir}/cloudwatchSumologicLambda.zip"
++source_code_hash+=+"${base64sha256(file("${var.lambda_dir}/cloudwatchSumologicLambda.zip"))}"
++handler++++++++++=+"cloudwatchSumologic.handler"

++role++++++++=+"${aws_iam_role.test-cloudwatch-lambda-role.arn}"
++memory_size+=+"128"
++runtime+++++=+"nodejs4.3"

++//+set+low+because+I'm+concerned+about+cost-blowout+in+the+case+of+mis-configuration
++timeout+=+"15"

++vpc_config+=+{
++++subnet_ids+++++++++=+["${aws_subnet.dev-private-subnet.id}"]
++++security_group_ids+=+["${aws_security_group.cloudwatch-sumologic-lambda-sg.id}"]
++}
}

resource+"aws_lambda_permission"+"test-app-allow-cloudwatch"+{
++statement_id++=+"test-app-allow-cloudwatch"
++action++++++++=+"lambda:InvokeFunction"
++function_name+=+"${aws_lambda_function.cloudwatch-sumologic-lambda.arn}"
++principal+++++=+"logs.ap-southeast-2.amazonaws.com"
++source_arn++++=+"${aws_cloudwatch_log_group.test-app-loggroup.arn}"
}

resource+"aws_cloudwatch_log_subscription_filter"+"test-app-cloudwatch-sumologic-lambda-subscription"+{
++depends_on++++++=+["aws_lambda_permission.test-app-allow-cloudwatch"]
++name++++++++++++=+"cloudwatch-sumologic-lambda-subscription"
++log_group_name++=+"${aws_cloudwatch_log_group.test-app-loggroup.name}"
++filter_pattern++=+""
++destination_arn+=+"${aws_lambda_function.cloudwatch-sumologic-lambda.arn}"
}|code-block|syntax|javascript|112262|编辑：请注意，上面的TF代码是几年前使用0.11.x版本编写的-它应该仍然可以工作，但可能有更好的方法。具体地说，除非需要，否则不要使用这样的内联策略，而是使用aws_iam_policy_document+-随着时间的推移，它们更容易维护。|BOLD|112263|entityMap|0|LINK|mutability|MUTABLE|url|https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html^0|7|12|1P|8|0|8|L|14|A|0|1W|12|0|N|I|0|0|0|2|K|6|28|N|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@$9|12|A|13|B|C]|$9|14|A|15|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|16|8|@$9|17|A|18|B|C]|$9|19|A|1A|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|1B|8|@$9|1C|A|1D|B|C]]|D|@]|E|$]]|$1|J|3|K|5|6|7|1E|8|@$9|1F|A|1G|B|C]]|D|@]|E|$]]|$1|L|3|M|5|N|7|1H|8|@]|D|@]|E|$O|P]]|$1|Q|3|R|5|6|7|1I|8|@$9|1J|A|1K|B|S]|$9|1L|A|1M|B|C]]|D|@$9|1N|A|1O|1|1P]]|E|$]]|$1|T|3|-4|5|6|7|1Q|8|@]|D|@]|E|$]]]|U|$V|$5|W|X|Y|E|$Z|10]]]]

I had the <code>aws_cloudwatch_log_subscription_filter</code> resource defined incorrectly - you should not provide the <code>role_arn</code> argument in this situation.

You also need to add an <code>aws_lambda_permission</code> resource (with a <code>depends_on</code> relationship defined on the filter or TF may do it in the wrong order).

Note that the AWS lambda console UI adds the lambda permission for you invisibly, so beware that the <code>aws_cloudwatch_log_subscription_filter</code> will work without the permission resource if you happen to have done the same action before in the console UI.

The necessary TF config looks like this (the last two resources are the relevant ones for configuring the actual <code>cloudwatch-&gt;lambda</code> trigger):

<pre class="lang-hcl prettyprint-override"><code>// intended for application logs (access logs, modsec, etc.)
resource "aws_cloudwatch_log_group" "test-app-loggroup" {
 name = "test-app"
 retention_in_days = 90
}

resource "aws_security_group" "cloudwatch-sumologic-lambda-sg" {
 name = "cloudwatch-sumologic-lambda-sg"

 tags {
 Name = "cloudwatch-sumologic-lambda-sg"
 }

 description = "Security group for lambda to move logs from CWL to SumoLogic"
 vpc_id = "${aws_vpc.dev-vpc.id}"
}

resource "aws_security_group_rule" "https-egress-cloudwatch-sumologic-to-internet" {
 type = "egress"
 from_port = 443
 to_port = 443
 protocol = "tcp"
 security_group_id = "${aws_security_group.cloudwatch-sumologic-lambda-sg.id}"
 cidr_blocks = ["0.0.0.0/0"]
}

resource "aws_iam_role" "test-cloudwatch-lambda-role" {
 name = "test-cloudwatch-lambda-role"

 assume_role_policy = &lt;&lt;EOF
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Action": "sts:AssumeRole",
 "Principal": {
 "Service": "lambda.amazonaws.com"
 },
 "Effect": "Allow"
 }
 ]
}
EOF
}

resource "aws_iam_role_policy" "test-cloudwatch-lambda-policy" {
 name = "test-cloudwatch-lambda-policy"
 role = "${aws_iam_role.test-cloudwatch-lambda-role.id}"

 policy = &lt;&lt;EOF
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "CopiedFromTemplateAWSLambdaVPCAccessExecutionRole1",
 "Effect": "Allow",
 "Action": [
 "ec2:CreateNetworkInterface"
 ],
 "Resource": "*"
 },
 {
 "Sid": "CopiedFromTemplateAWSLambdaVPCAccessExecutionRole2",
 "Effect": "Allow",
 "Action": [
 "ec2:DescribeNetworkInterfaces",
 "ec2:DeleteNetworkInterface"
 ],
 "Resource": "arn:aws:ec2:ap-southeast-2:${var.dev_vpc_account_id}:network-interface/*"
 },

 {
 "Sid": "CopiedFromTemplateAWSLambdaBasicExecutionRole1",
 "Effect": "Allow",
 "Action": "logs:CreateLogGroup",
 "Resource": "arn:aws:logs:ap-southeast-2:${var.dev_vpc_account_id}:*"
 },
 {
 "Sid": "CopiedFromTemplateAWSLambdaBasicExecutionRole2",
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogStream",
 "logs:PutLogEvents"
 ],
 "Resource": [
 "arn:aws:logs:ap-southeast-2:${var.dev_vpc_account_id}:log-group:/aws/lambda/*"
 ]
 },

 {
 "Sid": "CopiedFromTemplateAWSLambdaAMIExecutionRole",
 "Effect": "Allow",
 "Action": [
 "ec2:DescribeImages"
 ],
 "Resource": "*"
 }


 ]
}
EOF
}

resource "aws_lambda_function" "cloudwatch-sumologic-lambda" {
 function_name = "cloudwatch-sumologic-lambda"
 filename = "${var.lambda_dir}/cloudwatchSumologicLambda.zip"
 source_code_hash = "${base64sha256(file("${var.lambda_dir}/cloudwatchSumologicLambda.zip"))}"
 handler = "cloudwatchSumologic.handler"

 role = "${aws_iam_role.test-cloudwatch-lambda-role.arn}"
 memory_size = "128"
 runtime = "nodejs4.3"

 // set low because I'm concerned about cost-blowout in the case of mis-configuration
 timeout = "15"

 vpc_config = {
 subnet_ids = ["${aws_subnet.dev-private-subnet.id}"]
 security_group_ids = ["${aws_security_group.cloudwatch-sumologic-lambda-sg.id}"]
 }
}

resource "aws_lambda_permission" "test-app-allow-cloudwatch" {
 statement_id = "test-app-allow-cloudwatch"
 action = "lambda:InvokeFunction"
 function_name = "${aws_lambda_function.cloudwatch-sumologic-lambda.arn}"
 principal = "logs.ap-southeast-2.amazonaws.com"
 source_arn = "${aws_cloudwatch_log_group.test-app-loggroup.arn}"
}

resource "aws_cloudwatch_log_subscription_filter" "test-app-cloudwatch-sumologic-lambda-subscription" {
 depends_on = ["aws_lambda_permission.test-app-allow-cloudwatch"]
 name = "cloudwatch-sumologic-lambda-subscription"
 log_group_name = "${aws_cloudwatch_log_group.test-app-loggroup.name}"
 filter_pattern = ""
 destination_arn = "${aws_lambda_function.cloudwatch-sumologic-lambda.arn}"
}
</code></pre>

EDIT: Please note that the above TF code was written years ago, using version <code>0.11.x</code> - it should still work but there may be better ways of doing things. Specifically, don't use an inline policy like this unless needed, use an <a href="https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html" rel="noreferrer">aws_iam_policy_document</a> instead - they're just way easier to maintain over time.

blocks|key|114987|text|在使用Terraform+v0.12.29和亚马逊网络服务提供商v3.1.0时，我遇到了一个奇怪的问题，这花费了我几个小时的调试时间。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|114988|为了节省其他人的宝贵时间，我将分享它，作为对公认答案的补充。|114989|云监控日志组arn的值|BOLD|114990|${aws_cloudwatch_log_group.test-app-loggroup.arn}|code-block|syntax|javascript|114991|的插值不正确-在输出的末尾缺少一个。|114992|这会导致以下错误：|114993|创建{+the+-can+|114994|+}时出错:+InvalidCloudWatchLogsLogGroupArnException:请检查日志组ARN：{the-can+service}无法验证它。|blockquote|114995|114996|114997|添加:*后缀解决了这个问题：|114998|source_arn+=+"${aws_cloudwatch_log_group.test-app-loggroup.arn}:*"+#<----Notice+the+:*+postfix|114999|entityMap^0|D|8|W|6|0|0|0|9|0|0|0|I|0|0|9|0|0|D|0|0|2A|0|0|0|0|E|2|2|0|0^^$0|@$1|2|3|4|5|6|7|16|8|@$9|17|A|18|B|C]|$9|19|A|1A|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1B|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|1C|8|@$9|1D|A|1E|B|J]]|D|@]|E|$]]|$1|K|3|L|5|M|7|1F|8|@]|D|@]|E|$N|O]]|$1|P|3|Q|5|6|7|1G|8|@$9|1H|A|1I|B|J]]|D|@]|E|$]]|$1|R|3|S|5|6|7|1J|8|@$9|1K|A|1L|B|J]]|D|@]|E|$]]|$1|T|3|U|5|6|7|1M|8|@$9|1N|A|1O|B|J]]|D|@]|E|$]]|$1|V|3|W|5|X|7|1P|8|@$9|1Q|A|1R|B|J]]|D|@]|E|$]]|$1|Y|3|-4|5|6|7|1S|8|@]|D|@]|E|$]]|$1|Z|3|-4|5|6|7|1T|8|@]|D|@]|E|$]]|$1|10|3|11|5|6|7|1U|8|@$9|1V|A|1W|B|J]|$9|1X|A|1Y|B|C]]|D|@]|E|$]]|$1|12|3|13|5|M|7|1Z|8|@]|D|@]|E|$N|O]]|$1|14|3|-4|5|6|7|20|8|@]|D|@]|E|$]]]|15|$]]

Working with Terraform <code>v0.12.29</code> and AWS provider <code>v3.1.0</code> I encountered a strange issue which cost me a few hours of debugging.
In order to save others some valuable time I'll share it as a complementary to the accepted answer.
The value of the cloudwatch log group arn:
<pre><code>${aws_cloudwatch_log_group.test-app-loggroup.arn}
</code></pre>
Isn't being interpolated correctly - there is a missing &quot;<code>:*</code>&quot; at the end of the output.
This leads to the error below:
<blockquote>
Error creating {the-calling-service}: InvalidCloudWatchLogsLogGroupArnException:
Check the log group ARN: {the-calling-service} can't validate it.
</blockquote>
Adding a <code>:*</code> postfix solved the issue:
<pre><code>source_arn = &quot;${aws_cloudwatch_log_group.test-app-loggroup.arn}:*&quot; #&lt;----Notice the :* postfix
</code></pre>

I need to ship my cloudwatch logs to a log analysis service.

I've followed along with these articles <a href="https://jambr.co.uk/2016/05/17/aws-lambda-logs-into-sumologic/" rel="noreferrer">here</a> and <a href="https://github.com/SumoLogic/sumologic-aws-lambda/tree/master/cloudwatchlogs" rel="noreferrer">here</a> and got it working by hand, no worries. 

Now I'm trying to automate all this with Terraform (roles/policies, security groups, cloudwatch log group, lambda, and triggering the lambda from the log group).

But I can't figure out how to use TF to configure AWS to trigger the lambda from the cloudwatch logs.

I can link the two TF resources together by hand by doing the following (in the Lambda web console UI):

<ul>
<li>go into the lambda function's "Triggers" section</li>
<li>click "Add Trigger"</li>
<li>select "cloudwatch logs" from the list of trigger types</li>
<li>select the log group I want to trigger the lambda</li>
<li>enter a filter name</li>
<li>leave the filter pattern empty (implying trigger on all log streams)</li>
<li>make sure "enable trigger" is selected</li>
<li>click the submit button</li>
</ul>

Once that's done, the lambda shows up on the cloudwatch logs console in the subscriptions column - displays as "Lambda (cloudwatch-sumologic-lambda)".

I tried to create the subscription with the following TF resource:

<pre class="lang-hcl prettyprint-override"><code>resource "aws_cloudwatch_log_subscription_filter" "cloudwatch-sumologic-lambda-subscription" {
 name = "cloudwatch-sumologic-lambda-subscription"
 role_arn = "${aws_iam_role.jordi-waf-cloudwatch-lambda-role.arn}"
 log_group_name = "${aws_cloudwatch_log_group.jordi-waf-int-app-loggroup.name}"
 filter_pattern = "logtype test"
 destination_arn = "${aws_lambda_function.cloudwatch-sumologic-lambda.arn}"
}
</code></pre>

But it fails with: 

<blockquote>
 aws_cloudwatch_log_subscription_filter.cloudwatch-sumologic-lambda-subscription: InvalidParameterException: destinationArn for vendor lambda cannot be used with roleArn
</blockquote>

I found <a href="https://stackoverflow.com/questions/35895315/use-terraform-to-set-up-a-lambda-function-triggered-by-a-scheduled-event-source">this answer</a> about setting up a similar thing for a scheduled event, but that doesn't seem to be equivalent to what the console actions I described above do (the console UI method doesn't create an event/rule that I can see).

Can someone give me a pointer on what I'm doing wrong please?

Terraform: configuring cloudwatch log subscription delivery to lambda?

日志分析

云监控

Terraform

我需要将我的cloudwatch日志发送到日志分析服务。我已经阅读了和这两篇文章，并手把手地让它工作，不用担心。现在，我正在尝试使用Terraform自动化所有这些操作(角色/策略、安全组、cloudwatch日志组、lambda以及从日志组触发lambda )。但是我不知道如何使用TF来配置AWS来触发cloudwa...

问Terraform:配置到lambda的cloudwatch日志订阅交付？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Terraform:配置到lambda的cloudwatch日志订阅交付？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Terraform:配置到lambda的cloudwatch日志订阅交付？
EN