CCM-11007: Adding log subscription for Splunk forwarding

Author: sidnhs

infrastructure/terraform/components/api/cloudwatch_log_group_api_gateway_access.tf

@@ -2,3 +2,11 @@ resource "aws_cloudwatch_log_group" "api_gateway_access" {
   name              = "/aws/api-gateway/${aws_api_gateway_rest_api.main.id}/${var.environment}/access-logs"
   retention_in_days = var.log_retention_in_days
 }
+
+resource "aws_cloudwatch_log_subscription_filter" "api_gateway_access" {
+  name            = replace(aws.cloudwatch_log_group.api_gateway_access.name, "/", "-")
+  role_arn        = local.acct.log_subscription_role_arn
+  log_group_name  = aws_cloudwatch_log_group.api_gateway_access.name
+  filter_pattern  = ""
+  destination_arn = local.destination_arn
+}

infrastructure/terraform/components/api/cloudwatch_log_group_api_gateway_execution.tf

@@ -5,3 +5,11 @@ resource "aws_cloudwatch_log_group" "api_gateway_execution" {
   )
   retention_in_days = var.log_retention_in_days
 }
+
+resource "aws_cloudwatch_log_subscription_filter" "api_gateway_execution" {
+  name            = replace(aws.cloudwatch_log_group.api_gateway_access.name, "/", "-")
+  role_arn        = local.acct.log_subscription_role_arn
+  log_group_name  = aws_cloudwatch_log_group.api_gateway_access.name
+  filter_pattern  = ""
+  destination_arn = local.destination_arn
+}

infrastructure/terraform/components/api/locals.tf

@@ -1,10 +1,12 @@
 locals {
-    aws_lambda_functions_dir_path = "../../../../lambdas"
+  aws_lambda_functions_dir_path = "../../../../lambdas"
 
-    openapi_spec = templatefile("${path.module}/resources/spec.tmpl.json", {
-        APIG_EXECUTION_ROLE_ARN  = aws_iam_role.api_gateway_execution_role.arn
-        AWS_REGION               = var.region
-        AUTHORIZER_LAMBDA_ARN    = module.authorizer_lambda.function_arn
-        HELLO_WORLD_LAMBDA_ARN    = module.hello_world.function_arn
-    })
+  openapi_spec = templatefile("${path.module}/resources/spec.tmpl.json", {
+    APIG_EXECUTION_ROLE_ARN = aws_iam_role.api_gateway_execution_role.arn
+    AWS_REGION              = var.region
+    AUTHORIZER_LAMBDA_ARN   = module.authorizer_lambda.function_arn
+    HELLO_WORLD_LAMBDA_ARN  = module.hello_world.function_arn
+  })
+
+  destination_arn = "arn:aws:logs:${var.region}:${var.shared_infra_account_id}:destination:nhs-${var.environment}-obs-firehose-logs"
 }

infrastructure/terraform/components/api/module_authorizer_lambda.tf

@@ -26,4 +26,8 @@ module "authorizer_lambda" {
 
   enable_lambda_insights   = false
   force_lambda_code_deploy = var.force_lambda_code_deploy
+
+  send_to_firehose          = true
+  log_destination_arn       = local.destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
 }

infrastructure/terraform/components/api/module_kms.tf

@@ -2,7 +2,7 @@ module "kms" {
   source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms?ref=v2.0.10"
 
   providers = {
-    aws = aws
+    aws           = aws
     aws.us-east-1 = aws.us-east-1
   }
 

infrastructure/terraform/components/api/module_lambda_hello_world.tf

@@ -31,6 +31,10 @@ module "hello_world" {
   force_lambda_code_deploy = var.force_lambda_code_deploy
   enable_lambda_insights   = false
 
+  send_to_firehose          = true
+  log_destination_arn       = local.destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+
   lambda_env_vars = {
   }
 }

infrastructure/terraform/components/api/variables.tf

@@ -80,3 +80,9 @@ variable "parent_acct_environment" {
   description = "Name of the environment responsible for the acct resources used, affects things like DNS zone. Useful for named dev environments"
   default     = "main"
 }
+
+variable "shared_infra_account_id" {
+  type        = string
+  description = "The AWS Account ID of the shared infrastructure account"
+  default     = "000000000000"
+}