feat: Enable EKS logs (#134)

* enable cw logs + metrics * enable eks logs * log retention * remove dd
wandb · Sep 1, 2023 · 2239119 · 2239119
1 parent fecf9ec
commit 2239119
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/modules/app_eks/iam-policy-docs.tf b/modules/app_eks/iam-policy-docs.tf
@@ -1,8 +1,13 @@
 data "aws_iam_policy_document" "node_cloudwatch" {
   statement {
-    actions   = ["cloudwatch:PutMetricData"]
+    actions = [
+      "logs:CreateLogGroup",
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+      "logs:DescribeLogStreams"
+    ]
     effect    = "Allow"
-    resources = ["*"]
+    resources = ["arn:aws:logs:*:*:*"]
   }
 }
 

diff --git a/modules/app_eks/main.tf b/modules/app_eks/main.tf
@@ -37,9 +37,11 @@ module "eks" {
   map_roles    = var.map_roles
   map_users    = var.map_users
 
+  cluster_enabled_log_types = [ "api", "audit", "controllerManager", "scheduler" ]
   cluster_endpoint_private_access      = true
   cluster_endpoint_public_access       = var.cluster_endpoint_public_access
   cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs
+  cluster_log_retention_in_days = 30
 
   cluster_encryption_config = var.kms_key_arn != "" ? [
     {