terraform-aws-modules/terraform-aws-lambda

Add variable to manage the CreateLogGroup permission

jake-naughton opened this issue · 5 comments

jake-naughton commented

Is your request related to a new offering from AWS?

  • Already exists.

Is your request related to a problem? Please describe.

I have to manage IAM roles outside of this module because it enforces logs:CreateLogGroup permission when the module provisions the CloudWatch log group. However, there are many cases where you don't need or want this permission attached to your lambda and it is a nuisance when you are dealing with ephemeral environments. The problem is described in this issue:
#342

Describe the solution you'd like.

To add a variable that allows for the logs:CreateLogGroup to be turned off even when the module is responsible for provisioning the CloudWatch logs. By default it would be on so no change in behaviour.

variable "attach_create_log_group_permission" {
  description = "..."
  type             = bool
  default        = true
}


data "aws_iam_policy_document" "logs" {
  count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0

  statement {
    effect = "Allow"

    actions = compact([
      !var.use_existing_cloudwatch_log_group && var.attach_create_log_group_permission ? "logs:CreateLogGroup" : "",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ])

    resources = flatten([for _, v in ["%v:*", "%v:*:*"] : format(v, local.log_group_arn)])
  }
}

Describe alternatives you've considered.

Creating my own IAM role outside of the module and passing it in. Could also create the CloudWatch log group outside of the module.

Additional context

Happy to put up a PR for this improvement if it is acceptable.

github-actions commented

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days

jake-naughton commented

Any thoughts on this?

antonbabenko commented

Hi @jake-naughton !

Please make a PR with the proposed change.

jake-naughton commented

Hi @antonbabenko, I have raised the PR here: #514

github-actions commented

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.