Skip to main content
Sponsor @cloudposse

Module: cloudwatch-flow-logs

Terraform module for enabling flow logs for vpc and subnets.

Usage​

module "flow_logs" {
  source    = "git::https://github.com/cloudposse/terraform-aws-cloudwatch-flow-logs.git?ref=master"
  vpc_id    = "${var.vpc_id}"
  namespace = "${var.namespace}"
  stage     = "${var.stage}"
}

Variables​

Required Variables​

vpc_id (any) required

ID of VPC

Optional Variables​

encryption_type (string) optional

GUID for the customer-managed KMS key to use for encryption. The only acceptable values are NONE or KMS


Default value: "NONE"

eni_ids (list(string)) optional

IDs of ENIs


Default value: [ ]

filter_pattern (string) optional

Valid CloudWatch Logs filter pattern for subscribing to a filtered stream of log events


Default value: "[version, account, eni, source, destination, srcport, destport, protocol, packets, bytes, windowstart, windowend, action, flowlogstatus]"

kms_key_id (string) optional

ID of KMS key


Default value: ""

region (string) optional

AWS region


Default value: ""

retention_in_days (string) optional

Number of days you want to retain log events in the log group


Default value: "30"

retention_period (string) optional

Length of time data records are accessible after they are added to the stream


Default value: "48"

shard_count (string) optional

Number of shards that the stream will use


Default value: "1"

shard_level_metrics (list) optional

List of shard-level CloudWatch metrics which can be enabled for the stream


Default value:

[
  "IncomingBytes",
  "OutgoingBytes"
]
subnet_ids (list(string)) optional

IDs of subnets


Default value: [ ]

traffic_type (string) optional

Type of traffic to capture. Valid values: ACCEPT,REJECT, ALL


Default value: "ALL"

Context Variables​

The following variables are defined in the context.tf file of this module and part of the terraform-null-label pattern.

namespace (string) required

Namespace (e.g. cp or cloudposse)
Required: Yes

Default value: ``

stage (string) required

Stage (e.g. prod, dev, staging)
Required: Yes

Default value: ``

attributes (list(string)) optional

Additional attributes (e.g. policy or role)
Required: No

Default value: [ ]

delimiter (string) optional

Delimiter to be used between name, namespace, stage, etc.
Required: No

Default value: "-"

enabled (string) optional

Set to false to prevent the module from creating anything
Required: No

Default value: "true"

name (string) optional

Name (e.g. bastion or db)
Required: No

Default value: ""

tags (map(string)) optional

Additional tags (e.g. map(BusinessUnit,XYZ)
Required: No

Default value: { }

Outputs​

eni_flow_ids

Flow Log IDs of ENIs

kinesis_arn

Kinesis Stream ARN

kinesis_id

Kinesis Stream ID

kinesis_name

Kinesis Stream name

kinesis_shard_count

Kinesis Stream Shard count

log_group_arn

ARN of the log group

subnet_flow_ids

Flow Log IDs of subnets

vpc_flow_id

VPC Flow Log ID

Dependencies​

Providers​

  • aws

Modules​

NameVersionSourceDescription
kinesis_labeltags/0.3.1git::https://github.com/cloudposse/terraform-null-label.gitn/a
log_group_labeltags/0.3.1git::https://github.com/cloudposse/terraform-null-label.gitn/a
subnet_labeltags/0.3.1git::https://github.com/cloudposse/terraform-null-label.gitn/a
subscription_filter_labeltags/0.3.1git::https://github.com/cloudposse/terraform-null-label.gitn/a
vpc_labeltags/0.3.1git::https://github.com/cloudposse/terraform-null-label.gitn/a

Resources​

The following resources are used by this module:

Data Sources​

The following data sources are used by this module: