fix flowlogs policy

sourcefuse · Nov 11, 2024 · 9d90aa2 · 9d90aa2
1 parent 97ac7ac
commit 9d90aa2
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/examples/simple/main.tf b/examples/simple/main.tf
@@ -40,7 +40,7 @@ module "network" {
   name                              = "arc-poc"
   create_internet_geteway           = true
   enable_vpc_flow_log_to_cloudwatch = true
-  enable_vpc_flow_log_to_s3         = true
+  enable_vpc_flow_log_to_s3         = false
 
   availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
   cidr_block         = "10.0.0.0/16"

diff --git a/main.tf b/main.tf
@@ -222,7 +222,8 @@ data "aws_iam_policy_document" "flow_logs_policy" {
       "logs:DescribeLogGroups",
       "logs:DescribeLogStreams"
     ]
-    resources = local.enable_vpc_flow_log_to_cloudwatch && length(aws_cloudwatch_log_group.this) > 0 ? [aws_cloudwatch_log_group.this[0].arn] : ["*"]
+    resources = local.enable_vpc_flow_log_to_cloudwatch && length(aws_cloudwatch_log_group.this) > 0 ? [aws_cloudwatch_log_group.this[0].arn, "${aws_cloudwatch_log_group.this[0].arn}:*"] : ["*"]
+
   }
 }