# Assignment

The Nautilus DevOps team needs to set up CloudWatch logging for their application. They need to create a CloudWatch log group and log stream with the following specifications:

1) The log group name should be xfusion-log-group.

2) The log stream name should be xfusion-log-stream.

Use Terraform to create the CloudWatch log group and log stream. The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.

Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

# Solution

# CloudWatch Logs — `xfusion-log-group` + `xfusion-log-stream`

Terraform solution to create a CloudWatch log group and a log stream nested inside
it.

## `main.tf`

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_cloudwatch_log_group" "xfusion" {
  name = "xfusion-log-group"
}

resource "aws_cloudwatch_log_stream" "xfusion" {
  name           = "xfusion-log-stream"
  log_group_name = aws_cloudwatch_log_group.xfusion.name
}
```

## How to run

```bash
cd /home/bob/terraform
terraform init
terraform apply -auto-approve
```

## How it works

CloudWatch Logs has a two-level hierarchy: a **log group** is the container (where
you set retention, encryption, and access policy), and a **log stream** is an
ordered sequence of log events inside a group, typically one per source (an
instance, container, or function). This task creates one of each.

### `aws_cloudwatch_log_group`

- **`name = "xfusion-log-group"`** — the group name, exactly as required.
- No `retention_in_days` is set, so logs are retained **indefinitely** (the AWS
  default). The task doesn't specify retention, so the default is fine; you'd add
  `retention_in_days = N` if a policy required expiring logs.

### `aws_cloudwatch_log_stream`

- **`name = "xfusion-log-stream"`** — the stream name, exactly as required.
- **`log_group_name = aws_cloudwatch_log_group.xfusion.name`** — a stream can't
  exist on its own; it must live inside a group. Referencing the group resource's
  `name` attribute (rather than hardcoding the string) does two things:
  1. It wires the value correctly, and
  2. it creates an **implicit dependency** so Terraform provisions the group
     **before** the stream. Without that ordering, the stream create would fail
     because its parent group wouldn't exist yet.

  This is why no explicit `depends_on` is needed — the attribute reference expresses
  the dependency for you.

### Ordering matters

The dependency direction is one-way: group first, then stream. On `destroy`,
Terraform reverses it automatically — stream removed before group — so teardown is
clean too.

## Verify

```bash
# Confirm the group exists
aws logs describe-log-groups \
  --log-group-name-prefix xfusion-log-group \
  --query 'logGroups[0].{Name:logGroupName,Retention:retentionInDays}'

# Confirm the stream exists inside it
aws logs describe-log-streams \
  --log-group-name xfusion-log-group \
  --query 'logStreams[?logStreamName==`xfusion-log-stream`].logStreamName'
```

Expected — the group `xfusion-log-group` (retention `null` = never expire), and the
stream query returning `["xfusion-log-stream"]`.