TECH-378: Remove old IAM resources #8
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
magreenbaum
commented
Mar 29, 2021
| aws_cloudwatch_log_group.log_group.arn, | ||
| "${aws_cloudwatch_log_group.log_group.arn}/*" | ||
| "${aws_cloudwatch_log_group.log_group.arn}:*", | ||
| "${aws_cloudwatch_log_group.log_group.arn}:*:*" |
There was a problem hiding this comment.
Bumping aws provider to latest revealed a bugfix that was done here which removed the :* from the cloudwatch logs arn: hashicorp/terraform-provider-aws#14214.
Now we'll need to specifically include the :*.
Also noting that the arn format of log group and log stream is:
Log group | arn:aws:logs:region:account-id:log-group:log_group_name
Log stream | arn:aws:logs:region:account-id:log-group:log_group_name:log-stream:log-stream-name
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html
Planning to bump CMW terraform aws provider to latest v3 which will have the arn bugfix. Required for these changes.
Tested in dev:
"Resource": [
"arn:aws:logs:<region>:<account>:log-group:rabbitmq-<app_name>-dev:*:*",
"arn:aws:logs:<region>:<account>:log-group:rabbitmq-<app_name>-dev:*"
Logs show up in CW.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This is to remove old IAM resources that do not have the region name suffixes. Moved new resources in
iam-new.tfintomain.tfto consolidate.See also changes to cloudwatch log group in comments. Using later aws provider versions has changed arn of cloudwatch logs.
Test
Applied in dev to confirm appropriate resources are destroyed and that the cloudwatch changes are accurate (note that this means bumping aws provider version to v3 in app repo using this module).
To Do
Once cutover to the new IAM instance profile is completed for all RMQ launch configurations, update source ref of rmq module in CMW to the hash of this commit. Also bump aws provider version to >3. This will be at least another 1.5 to 2 weeks out.