Skip to content

Commit 2ce62aa

Browse files
alexandertgtalbotalexandertgtalbot
committed
feat: Add Flow Logging Support
- Add conditional flow logging mimicing the style of the following Terraform module: https://github.com/terraform-aws-modules/terraform-aws-vpc.
1 parent 01789bd commit 2ce62aa

File tree

10 files changed

+1148
-1
lines changed

10 files changed

+1148
-1
lines changed

‎README.md

Lines changed: 187 additions & 1 deletion
Large diffs are not rendered by default.

‎examples/complete/main.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,15 @@ module "tgw" {
3535
# When "true", allows service discovery through IGMP
3636
enable_multicast_support = false
3737

38+
# Flow log configuration (optional)
39+
enable_flow_log = true
40+
create_flow_log_cloudwatch_log_group = true
41+
create_flow_log_cloudwatch_iam_role = true
42+
43+
flow_log_cloudwatch_log_group_retention_in_days = 14
44+
flow_log_traffic_type = "ALL"
45+
flow_log_max_aggregation_interval = 600
46+
3847
vpc_attachments = {
3948
vpc1 = {
4049
vpc_id = module.vpc1.vpc_id

‎examples/flow-logs/README.md

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
# Transit Gateway Flow Logs Example
2+
3+
This example demonstrates how to configure Transit Gateway Flow Logs with various destination options.
4+
5+
## Features
6+
7+
This example shows how to:
8+
9+
- Enable Transit Gateway Flow Logs to CloudWatch Logs
10+
- Configure custom log format and retention
11+
- Set up S3 destination for flow logs
12+
- Use external CloudWatch Log Group and IAM role
13+
- Configure flow log aggregation intervals
14+
15+
## Usage
16+
17+
To run this example, you need to execute:
18+
19+
```bash
20+
$ terraform init
21+
$ terraform plan
22+
$ terraform apply
23+
```
24+
25+
Note that this example may create resources which will incur monetary charges on your AWS bill. Run `terraform destroy` when you no longer need these resources.
26+
27+
## Flow Log Destinations
28+
29+
### CloudWatch Logs (Default)
30+
31+
Flow logs are sent to CloudWatch Logs with automatic IAM role and log group creation:
32+
33+
```hcl
34+
module "tgw_with_cloudwatch_logs" {
35+
source = "../../"
36+
37+
name = "tgw-flow-logs-cloudwatch"
38+
description = "TGW with CloudWatch flow logs"
39+
40+
enable_flow_log = true
41+
create_flow_log_cloudwatch_log_group = true
42+
create_flow_log_cloudwatch_iam_role = true
43+
44+
# CloudWatch specific settings
45+
flow_log_cloudwatch_log_group_retention_in_days = 30
46+
flow_log_cloudwatch_log_group_kms_key_id = aws_kms_key.log_encryption.arn
47+
48+
# Traffic settings
49+
flow_log_traffic_type = "ALL"
50+
flow_log_max_aggregation_interval = 60
51+
52+
vpc_attachments = {
53+
vpc = {
54+
vpc_id = module.vpc.vpc_id
55+
subnet_ids = module.vpc.private_subnets
56+
}
57+
}
58+
59+
tags = local.tags
60+
}
61+
```
62+
63+
### S3 Destination
64+
65+
Flow logs are sent to S3 bucket with Parquet format:
66+
67+
```hcl
68+
module "tgw_with_s3_logs" {
69+
source = "../../"
70+
71+
name = "tgw-flow-logs-s3"
72+
description = "TGW with S3 flow logs"
73+
74+
enable_flow_log = true
75+
flow_log_destination_type = "s3"
76+
flow_log_destination_arn = aws_s3_bucket.flow_logs.arn
77+
78+
# S3 specific settings
79+
flow_log_file_format = "parquet"
80+
flow_log_hive_compatible_partitions = true
81+
flow_log_per_hour_partition = true
82+
83+
vpc_attachments = {
84+
vpc = {
85+
vpc_id = module.vpc.vpc_id
86+
subnet_ids = module.vpc.private_subnets
87+
}
88+
}
89+
90+
tags = local.tags
91+
}
92+
```
93+
94+
### External Resources
95+
96+
Using existing CloudWatch Log Group and IAM role:
97+
98+
```hcl
99+
module "tgw_with_external_resources" {
100+
source = "../../"
101+
102+
name = "tgw-flow-logs-external"
103+
description = "TGW with external flow log resources"
104+
105+
enable_flow_log = true
106+
create_flow_log_cloudwatch_log_group = false
107+
create_flow_log_cloudwatch_iam_role = false
108+
109+
flow_log_destination_arn = aws_cloudwatch_log_group.external.arn
110+
flow_log_cloudwatch_iam_role_arn = aws_iam_role.external.arn
111+
112+
vpc_attachments = {
113+
vpc = {
114+
vpc_id = module.vpc.vpc_id
115+
subnet_ids = module.vpc.private_subnets
116+
}
117+
}
118+
119+
tags = local.tags
120+
}
121+
```
122+
123+
## Custom Log Format
124+
125+
You can specify a custom log format to capture specific fields:
126+
127+
```hcl
128+
# Custom log format with specific fields
129+
flow_log_log_format = "$${version} $${account-id} $${transit-gateway-id} $${transit-gateway-attachment-id} $${srcaddr} $${dstaddr} $${srcport} $${dstport} $${protocol} $${packets} $${bytes} $${windowstart} $${windowend} $${action}"
130+
```
131+
132+
Available fields for Transit Gateway Flow Logs:
133+
- `version` - VPC Flow Logs version
134+
- `account-id` - AWS account ID
135+
- `transit-gateway-id` - Transit Gateway ID
136+
- `transit-gateway-attachment-id` - Transit Gateway attachment ID
137+
- `srcaddr` - Source address
138+
- `dstaddr` - Destination address
139+
- `srcport` - Source port
140+
- `dstport` - Destination port
141+
- `protocol` - IANA protocol number
142+
- `packets` - Number of packets transferred
143+
- `bytes` - Number of bytes transferred
144+
- `windowstart` - Start time of the aggregation interval
145+
- `windowend` - End time of the aggregation interval
146+
- `action` - Action that is associated with the traffic (ACCEPT or REJECT)
147+
148+
## Security Considerations
149+
150+
- Flow logs may contain sensitive network information
151+
- Use KMS encryption for CloudWatch Logs
152+
- Implement proper S3 bucket policies for S3 destinations
153+
- Consider log retention policies to manage costs
154+
- Use IAM policies to restrict access to flow log data
155+
156+
## Requirements
157+
158+
| Name | Version |
159+
|------|---------|
160+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
161+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.4 |
162+
163+
## Providers
164+
165+
| Name | Version |
166+
|------|---------|
167+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.4 |
168+
169+
## Modules
170+
171+
| Name | Source | Version |
172+
|------|--------|---------|
173+
| <a name="module_tgw_with_cloudwatch_logs"></a> [tgw\_with\_cloudwatch\_logs](#module\_tgw\_with\_cloudwatch\_logs) | ../../ | n/a |
174+
| <a name="module_tgw_with_s3_logs"></a> [tgw\_with\_s3\_logs](#module\_tgw\_with\_s3\_logs) | ../../ | n/a |
175+
| <a name="module_tgw_with_external_resources"></a> [tgw\_with\_external\_resources](#module\_tgw\_with\_external\_resources) | ../../ | n/a |
176+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
177+
178+
## Resources
179+
180+
| Name | Type |
181+
|------|------|
182+
| [aws_cloudwatch_log_group.external](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
183+
| [aws_iam_role.external](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
184+
| [aws_kms_key.log_encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
185+
| [aws_s3_bucket.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
186+
| [aws_s3_bucket_policy.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
187+
188+
## Outputs
189+
190+
| Name | Description |
191+
|------|-------------|
192+
| <a name="output_tgw_flow_log_cloudwatch_id"></a> [tgw\_flow\_log\_cloudwatch\_id](#output\_tgw\_flow\_log\_cloudwatch\_id) | CloudWatch flow log ID |
193+
| <a name="output_tgw_flow_log_s3_id"></a> [tgw\_flow\_log\_s3\_id](#output\_tgw\_flow\_log\_s3\_id) | S3 flow log ID |
194+
| <a name="output_tgw_flow_log_external_id"></a> [tgw\_flow\_log\_external\_id](#output\_tgw\_flow\_log\_external\_id) | External resources flow log ID |

0 commit comments

Comments
 (0)