update docs to include IAM roles
This commit is contained in:
parent
cc43ae8c4b
commit
8e23607b67
|
@ -13,11 +13,55 @@ interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group.
|
||||||
|
|
||||||
```
|
```
|
||||||
resource "aws_flow_log" "test_flow_log" {
|
resource "aws_flow_log" "test_flow_log" {
|
||||||
|
# log_group_name needs to exist before hand
|
||||||
|
# until we have a CloudWatch Log Group Resource
|
||||||
log_group_name = "tf-test-log-group"
|
log_group_name = "tf-test-log-group"
|
||||||
iam_role_arn = "arn:aws:iam::470663696735:role/tf-test-cloud"
|
iam_role_arn = "${aws_iam_role.test_role.arn}"
|
||||||
vpc_id = "${aws_vpc.default.id}"
|
vpc_id = "${aws_vpc.default.id}"
|
||||||
traffic_type = "ALL"
|
traffic_type = "ALL"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_role" "test_role" {
|
||||||
|
name = "test_role"
|
||||||
|
assume_role_policy = <<EOF
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Sid": "",
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Principal": {
|
||||||
|
"Service": "vpc-flow-logs.amazonaws.com"
|
||||||
|
},
|
||||||
|
"Action": "sts:AssumeRole"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_role_policy" "test_policy" {
|
||||||
|
name = "test_policy"
|
||||||
|
role = "${aws_iam_role.test_role.id}"
|
||||||
|
policy = <<EOF
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Action": [
|
||||||
|
"logs:CreateLogGroup",
|
||||||
|
"logs:CreateLogStream",
|
||||||
|
"logs:PutLogEvents",
|
||||||
|
"logs:DescribeLogGroups",
|
||||||
|
"logs:DescribeLogStreams"
|
||||||
|
],
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Resource": "*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
## Argument Reference
|
## Argument Reference
|
||||||
|
|
Loading…
Reference in New Issue