Streamlining Log Management to Amazon S3 Using Atlas Push-based Log Exports With HashiCorp Terraform

1
terraform {
2
 required_providers {
3
   mongodbatlas = {
4
     source  = "mongodb/mongodbatlas"
5
     version = ">= 1.16.0"
6
   }
7
   aws = {
8
     source  = "hashicorp/aws"
9
     version = ">= 5.0"
10
   }
11
 }
12
 required_version = ">= 1.0"
13
}

1
# Atlas Organization ID
2
variable "atlas_org_id" {
3
 type        = string
4
 description = "Atlas Organization ID"
5
}
6
7
# Atlas Project Name
8
variable "atlas_project_name" {
9
 type        = string
10
 description = "Atlas Organization ID"
11
}
12
13
# Unique AWS S3 Bucket Name
14
variable "s3_bucket_name" {
15
 type        = string
16
 description = "AWS S3 Bucket Name for logs"
17
}

1
atlas_org_id = "<UPDATE WITH YOUR ORG ID>"
2
atlas_project_name = "<UPDATE WITH A NAME FOR PROJECT>"
3
s3_bucket_name = "<UPDATE WITH A UNIQUE NAME FOR YOUR S3 BUCKET>"

1
resource "mongodbatlas_project" "exampleProject" {
2
 name   = var.atlas_project_name
3
 org_id = var.atlas_org_id
4
}
5
6
resource "mongodbatlas_cloud_provider_access_setup" "setupOnly" {
7
 project_id    = mongodbatlas_project.exampleProject.id
8
 provider_name = "AWS"
9
}

1
resource "aws_iam_role" "atlasRole" {
2
 name                 = "atlas-role"
3
 max_session_duration = 43200
4
5
 assume_role_policy = jsonencode({
6
   "Version" : "2012-10-17",
7
   "Statement" : [
8
     {
9
       "Effect" : "Allow",
10
       "Principal" : {
11
         "AWS" : "${mongodbatlas_cloud_provider_access_setup.setupOnly.aws_config[0].atlas_aws_account_arn}"
12
       },
13
       "Action" : "sts:AssumeRole",
14
       "Condition" : {
15
         "StringEquals" : {
16
           "sts:ExternalId" : "${mongodbatlas_cloud_provider_access_setup.setupOnly.aws_config[0].atlas_assumed_role_external_id}"
17
         }
18
       }
19
     }
20
   ]
21
 })
22
}
23
24
resource "aws_iam_role_policy" "atlasRolePolicy" {
25
 name = "atlas-role-policy"
26
 role = aws_iam_role.atlasRole.id
27
28
 policy = jsonencode({
29
   "Version" : "2012-10-17",
30
   "Statement" : [
31
     {
32
       "Effect" : "Allow",
33
       "Action" : "s3:*",
34
       "Resource" : "*"
35
     }
36
   ]
37
 })
38
}

1
resource "mongodbatlas_cloud_provider_access_authorization" "authRole" {
2
 project_id = mongodbatlas_project.exampleProject.id
3
 role_id    = mongodbatlas_cloud_provider_access_setup.setupOnly.role_id
4
5
 aws {
6
   iam_assumed_role_arn = aws_iam_role.atlasRole.arn
7
 }
8
}

1
resource "aws_s3_bucket" "atlasLogBucket" {
2
 bucket        = var.s3_bucket_name
3
 force_destroy = true      // required for destroying as Atlas creates a test folder in the bucket when push-based log export is initially created
4
}
5
6
resource "aws_iam_role_policy" "atlasLogBucketPolicy" {
7
 name = "atlas-log-bucket-policy"
8
 role = aws_iam_role.atlasRole.id
9
10
 policy = jsonencode({
11
   "Version" : "2012-10-17",
12
   "Statement" : [
13
     {
14
       "Effect" : "Allow",
15
       "Action" : [
16
         "s3:ListBucket",
17
         "s3:PutObject",
18
         "s3:GetObject",
19
         "s3:GetBucketLocation"
20
       ],
21
       "Resource" : [
22
         "${aws_s3_bucket.atlasLogBucket.arn}",
23
         "${aws_s3_bucket.atlasLogBucket.arn}/*"
24
       ]
25
     }
26
   ]
27
 })
28
}

1
terraform plan
2
terraform apply

1
resource "mongodbatlas_push_based_log_export" "logExport" {
2
 project_id  = mongodbatlas_project.exampleProject.id
3
 bucket_name = aws_s3_bucket.atlasLogBucket.bucket
4
 iam_role_id = mongodbatlas_cloud_provider_access_authorization.authRole.role_id
5
 prefix_path = "push-based-log-test"
6
}

1
terraform plan
2
terraform apply

1
data "aws_s3_objects" "atlasLogObjects" {
2
 bucket = aws_s3_bucket.atlasLogBucket.bucket
3
 prefix = mongodbatlas_push_based_log_export.logExport.prefix_path
4
}

1
output "log_bucket_keys" {
2
 value = data.aws_s3_objects.atlasLogObjects.keys
3
}