national-document-repository-infrastructure/infrastructure/cloudwatch_rum.tf at cdcee703d0ce5f6ba01633cea9b7f1f9136a5c27 · NHSDigital/national-document-repository-infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
locals {
  cognito_role_name = "${terraform.workspace}-cognito-unauth-role"
  cw_log_group      = "/aws/rum/my-rum-monitor/${terraform.workspace}-app-monitor"
}

resource "aws_iam_role" "cognito_unauthenticated" {
  name = local.cognito_role_name

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Principal : {
          Federated : "cognito-identity.amazonaws.com"
        },
        Action = "sts:AssumeRoleWithWebIdentity",
        Condition = {
          StringEquals = {
            "cognito-identity.amazonaws.com:aud" = aws_cognito_identity_pool.cloudwatch_rum.id
          },
          "ForAnyValue:StringLike" = {
            "cognito-identity.amazonaws.com:amr" = "unauthenticated"
          }
        }
      }
    ]
  })
}

resource "aws_iam_policy" "cloudwatch_rum_cognito_access" {
  name        = "${terraform.workspace}-cloudwatch-rum-cognito-access-policy"
  description = "Policy for unauthenticated Cognito identities"

  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Action" : "rum:PutRumEvents",
          "Resource" : "arn:aws:rum:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:appmonitor/${aws_rum_app_monitor.ndr.id}"
        }
      ]
  })
}

resource "aws_cloudwatch_log_resource_policy" "rum_log" {
  policy_name = "AWSRUMLoggingPolicy"

  policy_document = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Principal = {
          Service = "rum.amazonaws.com"
        },
        Action = [
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DeleteResourcePolicy",
          "logs:DeleteLogGroup",
          "logs:DescribeLogGroups"
        ],
        Resource = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/vendedlogs/RUMService_*"
      }
    ]
  })
  lifecycle {
    prevent_destroy = false
  }
}

resource "aws_iam_role_policy_attachment" "cloudwatch_rum_cognito_unauth" {
  role       = aws_iam_role.cognito_unauthenticated.name
  policy_arn = aws_iam_policy.cloudwatch_rum_cognito_access.arn
}

resource "aws_cognito_identity_pool_roles_attachment" "cloudwatch_rum" {
  identity_pool_id = aws_cognito_identity_pool.cloudwatch_rum.id
  roles = {
    unauthenticated = aws_iam_role.cognito_unauthenticated.arn
  }
}

resource "aws_cognito_identity_pool" "cloudwatch_rum" {
  identity_pool_name               = "${terraform.workspace}-cloudwatch-rum-identity-pool"
  allow_unauthenticated_identities = true
}

resource "aws_rum_app_monitor" "ndr" {
  name           = "${terraform.workspace}-app-monitor"
  domain         = "*.${var.domain}"
  cw_log_enabled = true

  app_monitor_configuration {
    identity_pool_id    = aws_cognito_identity_pool.cloudwatch_rum.id
    allow_cookies       = true
    enable_xray         = false
    session_sample_rate = 1.0
    telemetries         = ["errors", "performance", "http"]
  }

  custom_events {
    status = "ENABLED"
  }

  depends_on = [aws_cloudwatch_log_resource_policy.rum_log]
}