◾️はじめに

https://dk521123.hatenablog.com/entry/2025/09/17/224604

で、
「案２：S3イベント通知→EventBridge→CloudWatch Logs→Datadog」
という案を提示したが、そのTerraform コードを作ってみた

【１】やろうとしていること

s3 イベント（PUT/DELETE）をEventBridgeで拾い
CloudWatch Logsにログを出力したい

【２】前提知識

１）EventBridge

* 詳細は、以下の関連記事を参照

EventBridge ～基礎知識編～
https://dk521123.hatenablog.com/entry/2021/06/08/213748

２）CloudWatch

* 詳細は、以下の関連記事を参照

CloudWatch ～基礎知識編～
https://dk521123.hatenablog.com/entry/2022/03/08/145856

【３】サンプル

例１：S3イベント通知→EventBridge→CloudWatch Logs

main.tf

provider "aws" {
  region = "us-west-2"
}

# s3 / IAM は既存のものを使う
data "aws_s3_bucket" "target_s3" {
  bucket   = "your-s3-bucket"
}
data "aws_iam_role" "target_role" {
  name = "your_s3_event_role"
}

# For CloudWatch
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group
resource "aws_cloudwatch_log_group" "cloudwatch_for_s3events" {
  name = "aws/events/s3-event"
  retention_in_days = 7
}

# For s3 notifications
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification
# eventbridge - (Optional) Whether to enable Amazon EventBridge notifications. Defaults to false.
#
# Point1: Enable EventBridge notifications
resource "aws_s3_bucket_notification" "eventbridge" {
  bucket = data.aws_s3_bucket.target_s3.id
  eventbridge = true
}

# For Event rule
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule
#
# Point2: Define event rule
resource "aws_cloudwatch_event_rule" "s3_object" {
  name        = "demo-s3-object"
  description = "For demo"

  event_pattern = jsonencode({
    "detail-type" : ["Object Created"],
    "source" : ["aws.s3"],
    "detail" : {
      "bucket" : {
        "name" : [data.aws_s3_bucket.target_s3.bucket]
      },
      "object" : {
        "key" : [{
          "prefix" : "input-file/"
        }]
      }
    }
  })
}

 # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_resource_policy
#
# Point3: Define resource policy of CloudWatch Logs for CloudWatch Logs
resource "aws_cloudwatch_log_resource_policy" "eventbridge_logs_policy" {
  policy_name     = "demo-eventbridge-log-policy"
  policy_document = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Principal = {
          Service = [
            "events.amazonaws.com"
          ]
        },
        Action = [
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ],
        Resource = ["${aws_cloudwatch_log_group. cloudwatch_for_s3events.arn}:*"]
      }
    ]
  })
}

# EventBridge to CloudWatch Logs
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target
# 
# Point4: Associating event rule with CloudWatch Logs
resource "aws_cloudwatch_event_target" "log_group" {
  rule       = aws_cloudwatch_event_rule.s3_object.name
  arn        = aws_cloudwatch_log_group.cloudwatch_for_s3events.arn

  depends_on = [ aws_cloudwatch_log_resource_policy.eventbridge_logs_policy ]
}

ランキング参加中

プログラミング