Add configurable retention period for cluster logs (#37)

* Add configurable retention period for cluster logs

Per example in docs: https://www.terraform.io/docs/providers/aws/r/eks_cluster.html#enabling-control-plane-logging

Until `depends_on` is supported by modules, there can be a race
condition if `resource "aws_cloudwatch_log_group"` is called at the same
time as this `module`. This can result in the module creating the log
group first requiring a `terraform import ... ; terraform apply` dance.

* Correct ternary logic for enabling retention period

* Add cluster log variables to example

Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>

README.md

@@ -381,6 +381,7 @@ Available targets:
 | aws_cli_assume_role_arn | IAM Role ARN for AWS CLI to assume before calling `aws eks` to update `kubeconfig` | string | `` | no |
 | aws_cli_assume_role_session_name | An identifier for the assumed role session when assuming the IAM Role for AWS CLI before calling `aws eks` to update `kubeconfig` | string | `` | no |
 | aws_eks_update_kubeconfig_additional_arguments | Additional arguments for `aws eks update-kubeconfig` command, e.g. `--role-arn xxxxxxxxx`. For more info, see https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html | string | `` | no |
+| cluster_log_retention_period | Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. | number | `0` | no |
 | configmap_auth_file | Path to `configmap_auth_file` | string | `` | no |
 | configmap_auth_template_file | Path to `config_auth_template_file` | string | `` | no |
 | delimiter | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes` | string | `-` | no |

docs/terraform.md

@@ -10,6 +10,7 @@
 | aws_cli_assume_role_arn | IAM Role ARN for AWS CLI to assume before calling `aws eks` to update `kubeconfig` | string | `` | no |
 | aws_cli_assume_role_session_name | An identifier for the assumed role session when assuming the IAM Role for AWS CLI before calling `aws eks` to update `kubeconfig` | string | `` | no |
 | aws_eks_update_kubeconfig_additional_arguments | Additional arguments for `aws eks update-kubeconfig` command, e.g. `--role-arn xxxxxxxxx`. For more info, see https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html | string | `` | no |
+| cluster_log_retention_period | Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. | number | `0` | no |
 | configmap_auth_file | Path to `configmap_auth_file` | string | `` | no |
 | configmap_auth_template_file | Path to `config_auth_template_file` | string | `` | no |
 | delimiter | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes` | string | `-` | no |

examples/complete/fixtures.us-east-2.tfvars

@@ -30,4 +30,8 @@ kubernetes_version = "1.14"
 
 kubeconfig_path = "/.kube/config"
 
-oidc_provider_enabled = true
+oidc_provider_enabled = true
+
+enabled_cluster_log_types = ["audit"]
+
+cluster_log_retention_period = 7

examples/complete/main.tf

@@ -105,6 +105,9 @@ module "eks_cluster" {
  aws_cli_assume_role_arn = var.aws_cli_assume_role_arn
  aws_cli_assume_role_session_name = var.aws_cli_assume_role_session_name
 
+ enabled_cluster_log_types = var.enabled_cluster_log_types
+ cluster_log_retention_period = var.cluster_log_retention_period
+
  workers_role_arns = [module.eks_workers.workers_role_arn]
  workers_security_group_ids = [module.eks_workers.security_group_id]
 }

examples/complete/variables.tf

@@ -92,6 +92,18 @@ variable "cpu_utilization_low_threshold_percent" {
  description = "Worker nodes AutoScaling Group CPU utilization low threshold percent"
 }
 
+variable "enabled_cluster_log_types" {
+ type = list(string)
+ default = []
+ description = "A list of the desired control plane logging to enable. For more information, see https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. Possible values [`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`]"
+}
+
+variable "cluster_log_retention_period" {
+ type = number
+ default = 0
+ description = "Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html."
+}
+
 variable "map_additional_aws_accounts" {
  description = "Additional AWS account numbers to add to `config-map-aws-auth` ConfigMap"
  type = list(string)

main.tf

@@ -95,6 +95,13 @@ resource "aws_security_group_rule" "ingress_cidr_blocks" {
  type = "ingress"
 }
 
+resource "aws_cloudwatch_log_group" "default" {
+ count = var.enabled && length(var.enabled_cluster_log_types) > 0 ? 1 : 0
+ name = "/aws/eks/${module.label.id}/cluster"
+ retention_in_days = var.cluster_log_retention_period
+ tags = module.label.tags
+}
+
 resource "aws_eks_cluster" "default" {
  count = var.enabled ? 1 : 0
  name = module.label.id
@@ -112,7 +119,8 @@ resource "aws_eks_cluster" "default" {
 
  depends_on = [
  aws_iam_role_policy_attachment.amazon_eks_cluster_policy,
- aws_iam_role_policy_attachment.amazon_eks_service_policy
+ aws_iam_role_policy_attachment.amazon_eks_service_policy,
+ aws_cloudwatch_log_group.default
  ]
 }
 

variables.tf

@@ -119,6 +119,12 @@ variable "enabled_cluster_log_types" {
  description = "A list of the desired control plane logging to enable. For more information, see https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. Possible values [`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`]"
 }
 
+variable "cluster_log_retention_period" {
+ type = number
+ default = 0
+ description = "Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html."
+}
+
 variable "apply_config_map_aws_auth" {
  type = bool
  default = true