Merge pull request #191 from tablexi/fix_cloudtrail_logging_bucket

Create unique logging bucket for Cloudtrail module
tablexi · Feb 4, 2021 · d5fcc96 · d5fcc96
2 parents d9c8204 + 91e60f4
commit d5fcc96
Showing 1 changed file with 12 additions and 5 deletions.
diff --git a/aws/cloudtrail/main.tf b/aws/cloudtrail/main.tf
@@ -5,21 +5,28 @@ resource "aws_cloudtrail" "mod" {
   enable_logging                = true
   enable_log_file_validation    = true
 
-  cloud_watch_logs_group_arn    = var.cloud_watch_logs_group_arn
-  cloud_watch_logs_role_arn     = var.cloud_watch_logs_role_arn
+  cloud_watch_logs_group_arn = var.cloud_watch_logs_group_arn
+  cloud_watch_logs_role_arn  = var.cloud_watch_logs_role_arn
 
-  tags                          = var.tags
+  tags = var.tags
+}
+
+resource "aws_s3_bucket" "logs" {
+  bucket_prefix = "${var.name}-cloudtrail-logs"
+  acl           = "log-delivery-write"
+
+  tags = var.tags
 }
 
 resource "aws_s3_bucket" "mod" {
   bucket = "${var.name}-cloudtrail"
   acl    = "private"
   policy = data.aws_iam_policy_document.s3.json
 
-  tags   = var.tags
+  tags = var.tags
 
   logging {
-    target_bucket = "cloudtrail-logs"
+    target_bucket = aws_s3_bucket.logs.id
     target_prefix = var.name
   }
 }