From 3a1c4e45f21b71f8c57e83293ec6a6109df64da4 Mon Sep 17 00:00:00 2001
From: Zachary Winnerman <98712682+zwinnerman-fleetdm@users.noreply.github.com>
Date: Tue, 9 Aug 2022 13:38:14 -0400
Subject: [PATCH] Add ALB logging for fleet sandbox (#7127)

Closes #7121
---
 .../sandbox/SharedInfrastructure/alb.tf       | 125 ++++++++++++++++++
 .../sandbox/SharedInfrastructure/s3.tf        |  22 +++
 2 files changed, 147 insertions(+)
 create mode 100644 infrastructure/sandbox/SharedInfrastructure/s3.tf

diff --git a/infrastructure/sandbox/SharedInfrastructure/alb.tf b/infrastructure/sandbox/SharedInfrastructure/alb.tf
index 4d97c2d478..ff349f1e6d 100644
--- a/infrastructure/sandbox/SharedInfrastructure/alb.tf
+++ b/infrastructure/sandbox/SharedInfrastructure/alb.tf
@@ -5,6 +5,12 @@ resource "aws_lb" "main" {
   security_groups            = [aws_security_group.lb.id]
   subnets                    = var.vpc.public_subnets
   enable_deletion_protection = true
+
+  access_logs {
+    bucket  = module.s3_bucket_for_logs.s3_bucket_id
+    prefix  = var.prefix
+    enabled = true
+  }
 }
 
 output "lb" {
@@ -115,3 +121,122 @@ resource "cloudflare_record" "wildcard" {
   value   = aws_lb.main.dns_name
   proxied = false
 }
+
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "${var.prefix}-alb-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_elb_log_delivery_policy        = true # Required for ALB logs
+  attach_lb_log_delivery_policy         = true # Required for ALB/NLB logs
+  attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true
+  block_public_acls                     = true
+  block_public_policy                   = true
+  ignore_public_acls                    = true
+  restrict_public_buckets               = true
+  server_side_encryption_configuration = {
+    rule = {
+      apply_server_side_encryption_by_default = {
+        kms_master_key_id = var.kms_key.arn
+        sse_algorithm     = "aws:kms"
+      }
+    }
+  }
+  lifecycle_rule = [
+    {
+      id      = "log"
+      enabled = true
+
+      transition = [
+        {
+          days          = 30
+          storage_class = "ONEZONE_IA"
+        }
+      ]
+      expiration = {
+        days                         = 90
+        expired_object_delete_marker = true
+      }
+      noncurrent_version_expiration = {
+        newer_noncurrent_versions = 5
+        days                      = 30
+      }
+    }
+  ]
+}
+
+resource "aws_athena_database" "logs" {
+  name   = replace("${var.prefix}-alb-logs", "-", "_")
+  bucket = module.athena-s3-bucket.s3_bucket_id
+}
+
+module "athena-s3-bucket" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "${var.prefix}-alb-logs-athena"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_elb_log_delivery_policy        = true # Required for ALB logs
+  attach_lb_log_delivery_policy         = true # Required for ALB/NLB logs
+  attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true
+  block_public_acls                     = true
+  block_public_policy                   = true
+  ignore_public_acls                    = true
+  restrict_public_buckets               = true
+  server_side_encryption_configuration = {
+    rule = {
+      apply_server_side_encryption_by_default = {
+        kms_master_key_id = var.kms_key.arn
+        sse_algorithm     = "aws:kms"
+      }
+    }
+  }
+  lifecycle_rule = [
+    {
+      id      = "log"
+      enabled = true
+
+      transition = [
+        {
+          days          = 30
+          storage_class = "ONEZONE_IA"
+        }
+      ]
+      expiration = {
+        days                         = 90
+        expired_object_delete_marker = true
+      }
+      noncurrent_version_expiration = {
+        newer_noncurrent_versions = 5
+        days                      = 30
+      }
+    }
+  ]
+}
+
+resource "aws_athena_workgroup" "logs" {
+  name = "${var.prefix}-logs"
+
+  configuration {
+    enforce_workgroup_configuration    = true
+    publish_cloudwatch_metrics_enabled = true
+
+    result_configuration {
+      output_location = "s3://${module.athena-s3-bucket.s3_bucket_id}/output/"
+
+      encryption_configuration {
+        encryption_option = "SSE_KMS"
+        kms_key_arn       = var.kms_key.arn
+      }
+    }
+  }
+}
diff --git a/infrastructure/sandbox/SharedInfrastructure/s3.tf b/infrastructure/sandbox/SharedInfrastructure/s3.tf
new file mode 100644
index 0000000000..ec0d79fc18
--- /dev/null
+++ b/infrastructure/sandbox/SharedInfrastructure/s3.tf
@@ -0,0 +1,22 @@
+resource "aws_s3_bucket" "installers" {
+  bucket = "${var.prefix}-installers"
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = var.kms_key.arn
+        sse_algorithm     = "aws:kms"
+      }
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "installers" {
+  bucket = aws_s3_bucket.installers.id
+
+  block_public_acls   = true
+  block_public_policy = true
+}
+
+output "installer_bucket" {
+  value = aws_s3_bucket.installers
+}