Merge pull request #2 from geekcell/tune-cloudwatch-logs

feat: Improve AWS WAF Logging

README.md

@@ -64,7 +64,12 @@ it is mandatory to run in the "us-east-1" region. Check the example.
 
 ## Resources
 
+- resource.aws_cloudwatch_log_resource_policy.main (cloudwatch.tf#13)
 - resource.aws_wafv2_web_acl.main (main.tf#7)
+- resource.aws_wafv2_web_acl_logging_configuration.main (cloudwatch.tf#8)
+- data source.aws_caller_identity.current (cloudwatch.tf#59)
+- data source.aws_iam_policy_document.main (cloudwatch.tf#18)
+- data source.aws_region.current (cloudwatch.tf#57)
 
 # Examples
 ### Complete

cloudwatch.tf

@@ -0,0 +1,59 @@
+module "cloudwatch_log_group" {
+  source  = "geekcell/cloudwatch-log-group/aws"
+  version = ">= 1.0.1, < 2.0.0"
+
+  name = "aws-waf-logs-${var.name}"
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "main" {
+  log_destination_configs = [module.cloudwatch_log_group.arn]
+  resource_arn            = aws_wafv2_web_acl.main.arn
+}
+
+resource "aws_cloudwatch_log_resource_policy" "main" {
+  policy_document = data.aws_iam_policy_document.main.json
+  policy_name     = "aws-waf-logs-policy-${var.name}"
+}
+
+data "aws_iam_policy_document" "main" {
+  version = "2012-10-17"
+  statement {
+
+    effect = "Allow"
+
+    principals {
+      identifiers = [
+        "delivery.logs.amazonaws.com"
+      ]
+      type = "Service"
+    }
+
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+    resources = [
+      "${module.cloudwatch_log_group.arn}:*"
+    ]
+
+    condition {
+      test = "ArnLike"
+      values = [
+        "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"
+      ]
+      variable = "aws:SourceArn"
+    }
+
+    condition {
+      test = "StringEquals"
+      values = [
+        tostring(data.aws_caller_identity.current.account_id)
+      ]
+      variable = "aws:SourceAccount"
+    }
+  }
+}
+
+data "aws_region" "current" {}
+
+data "aws_caller_identity" "current" {}

main.tf

@@ -84,10 +84,3 @@ resource "aws_wafv2_web_acl" "main" {
 
   tags = var.tags
 }
-
-module "cloudwatch_log_group" {
-  source  = "geekcell/cloudwatch-log-group/aws"
-  version = ">= 1.0.1, < 2.0.0"
-
-  name = "/aws/cloudfront/waf/${var.name}"
-}