update docs to include IAM roles
This commit is contained in:
parent
cc43ae8c4b
commit
8e23607b67
|
@ -13,11 +13,55 @@ interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group.
|
|||
|
||||
```
|
||||
resource "aws_flow_log" "test_flow_log" {
|
||||
# log_group_name needs to exist before hand
|
||||
# until we have a CloudWatch Log Group Resource
|
||||
log_group_name = "tf-test-log-group"
|
||||
iam_role_arn = "arn:aws:iam::470663696735:role/tf-test-cloud"
|
||||
iam_role_arn = "${aws_iam_role.test_role.arn}"
|
||||
vpc_id = "${aws_vpc.default.id}"
|
||||
traffic_type = "ALL"
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "test_role" {
|
||||
name = "test_role"
|
||||
assume_role_policy = <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "vpc-flow-logs.amazonaws.com"
|
||||
},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "test_policy" {
|
||||
name = "test_policy"
|
||||
role = "${aws_iam_role.test_role.id}"
|
||||
policy = <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Action": [
|
||||
"logs:CreateLogGroup",
|
||||
"logs:CreateLogStream",
|
||||
"logs:PutLogEvents",
|
||||
"logs:DescribeLogGroups",
|
||||
"logs:DescribeLogStreams"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
```
|
||||
|
||||
## Argument Reference
|
||||
|
|
Loading…
Reference in New Issue