File tree 9 files changed +106
-0
lines changed
9 files changed +106
-0
lines changed Original file line number Diff line number Diff line change @@ -7,6 +7,11 @@ All notable changes to this project are documented in this file.
7
7
8
8
The format is based on {uri-changelog} [Keep a Changelog].
9
9
10
+ == 0.3.0 - Unreleased
11
+
12
+ === Added
13
+ * Module for Web Application Firewall service logs
14
+
10
15
== 0.2.0 (Oct 18, 2021)
11
16
12
17
=== Added
Original file line number Diff line number Diff line change @@ -96,6 +96,8 @@ loggroup_tags = {
96
96
#vpnlog ={loggroup="vpnloggroup",service="vpn",resource="<ipsecname>"}
97
97
#devopslog = {loggroup="devopsloggroup",service="devops",resource="<projectname>"}
98
98
#emaillog = {loggroup="emailloggroup",service="email",resource="<emaildomain>"}
99
+ #intlog = {loggroup="intloggroup",service="integration",resource="<integrationinstance>"}
100
+ #waflog = {loggroup="wafloggroup",service="waf",resource="<firewallname>"}
99
101
}
100
102
----
101
103
|
Original file line number Diff line number Diff line change @@ -28,6 +28,9 @@ locals {
28
28
29
29
vpnlogdef = { for k , v in var . service_logdef : k => v if v . service == " vpn" }
30
30
vpnloggroup = [for k , v in var . service_logdef : v . loggroup if v . service == " vpn" ]
31
+
32
+ waflogdef = { for k , v in var . service_logdef : k => v if v . service == " waf" }
33
+ wafloggroup = [for k , v in var . service_logdef : v . loggroup if v . service == " waf" ]
31
34
}
32
35
33
36
locals {
Original file line number Diff line number Diff line change @@ -118,6 +118,18 @@ resource "oci_logging_log_group" "vpnloggroup" {
118
118
119
119
}
120
120
121
+ # WAF loggroup resource
122
+ resource "oci_logging_log_group" "wafloggroup" {
123
+
124
+ for_each = toset (local. wafloggroup )
125
+
126
+ compartment_id = var. compartment_id
127
+ description = " WAF Loggroup"
128
+ display_name = var. label_prefix == " none" ? each. value : format (" %s-%s" , var. label_prefix , each. value )
129
+ freeform_tags = var. loggroup_tags
130
+
131
+ }
132
+
121
133
# Custom Linux loggroup resource
122
134
resource "oci_logging_log_group" "linuxloggroup" {
123
135
@@ -277,3 +289,15 @@ module "vpnlog" {
277
289
count = length (local. vpnlogdef ) >= 1 ? 1 : 0
278
290
279
291
}
292
+
293
+ module "waflog" {
294
+ source = " ./modules/waf"
295
+ compartment_id = var. compartment_id
296
+ label_prefix = var. label_prefix
297
+ logdefinition = local. waflogdef
298
+ log_retention_duration = var. log_retention_duration
299
+ loggroup = oci_logging_log_group. wafloggroup
300
+
301
+ count = length (local. waflogdef ) >= 1 ? 1 : 0
302
+
303
+ }
Original file line number Diff line number Diff line change
1
+ output "waf_logid" {
2
+ value = { for v in oci_logging_log . waf_log : v . display_name => v . id }
3
+ }
4
+
5
+ output "waf_loggroupid" {
6
+ value = { for k , v in var . loggroup : v . display_name => v . id }
7
+ }
Original file line number Diff line number Diff line change
1
+ variable "label_prefix" {
2
+ default = " none"
3
+ description = " A string that will be prepended to log resources."
4
+ type = string
5
+ }
6
+ variable "logdefinition" {
7
+ type = map (any )
8
+ description = " Log definition"
9
+ }
10
+ variable "log_retention_duration" {
11
+ type = string
12
+ description = " Duration to retain logs"
13
+ }
14
+
15
+ variable "compartment_id" {
16
+ type = string
17
+ description = " Compartment ID where the resources will be created"
18
+ }
19
+
20
+ variable "loggroup" {
21
+ type = map (any )
22
+ description = " Log Group"
23
+ }
Original file line number Diff line number Diff line change
1
+ data "oci_waf_web_app_firewalls" "web_app_firewalls" {
2
+ for_each = var. logdefinition
3
+ compartment_id = var. compartment_id
4
+
5
+ display_name = each. value . resource
6
+ state = [" ACTIVE" ]
7
+ }
8
+
9
+ resource "oci_logging_log" "waf_log" {
10
+
11
+
12
+ for_each = var. logdefinition
13
+
14
+ display_name = var. label_prefix == " none" ? each. key : format (" %s-%s" , var. label_prefix , each. key )
15
+ log_group_id = var. loggroup [each . value . loggroup ]. id
16
+ log_type = " SERVICE"
17
+ configuration {
18
+ source {
19
+ category = " all"
20
+ resource = data. oci_waf_web_app_firewalls . web_app_firewalls [each . key ]. web_app_firewall_collection [0 ][" items" ]. 0 . id
21
+ service = " waf"
22
+ source_type = " OCISERVICE"
23
+ }
24
+ }
25
+
26
+ is_enabled = lookup (each. value , " enable" , true )
27
+ retention_duration = var. log_retention_duration
28
+
29
+ }
Original file line number Diff line number Diff line change @@ -143,6 +143,18 @@ output "vpn_loggroupid" {
143
143
144
144
}
145
145
146
+ # WAF log and loggroup id
147
+ output "waf_logid" {
148
+ value = try (module. waflog [0 ]. waf_logid , " " )
149
+ description = " WAF logs id"
150
+ }
151
+
152
+ output "waf_loggroupid" {
153
+ value = try (module. waflog [0 ]. waf_loggroupid , " " )
154
+ description = " WAF loggroup id"
155
+
156
+ }
157
+
146
158
# Windows custom log and loggroup id
147
159
output "windows_logid" {
148
160
value = try (module. customlog [0 ]. windowslogid , " " )
Original file line number Diff line number Diff line change @@ -29,6 +29,7 @@ service_logdef = {
29
29
#devopslog = {loggroup="devopsloggroup",service="devops",resource="<projectname>"}
30
30
#emaillog = {loggroup="emailloggroup",service="email",resource="<emaildomain>"}
31
31
#intlog = {loggroup="intloggroup",service="integration",resource="<integrationinstance>"}
32
+ #waflog = {loggroup="wafloggroup",service="waf",resource="<firewallname>"}
32
33
33
34
}
34
35
You can’t perform that action at this time.
0 commit comments