103 lines
3.3 KiB
Markdown
103 lines
3.3 KiB
Markdown
# Assignment
|
|
|
|
The Nautilus DevOps team needs to set up CloudWatch logging for their application. They need to create a CloudWatch log group and log stream with the following specifications:
|
|
|
|
1) The log group name should be xfusion-log-group.
|
|
|
|
2) The log stream name should be xfusion-log-stream.
|
|
|
|
Use Terraform to create the CloudWatch log group and log stream. The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.
|
|
|
|
Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
|
|
|
# Solution
|
|
|
|
# CloudWatch Logs — `xfusion-log-group` + `xfusion-log-stream`
|
|
|
|
Terraform solution to create a CloudWatch log group and a log stream nested inside
|
|
it.
|
|
|
|
## `main.tf`
|
|
|
|
```hcl
|
|
terraform {
|
|
required_providers {
|
|
aws = {
|
|
source = "hashicorp/aws"
|
|
version = "~> 6.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "aws" {
|
|
region = "us-east-1"
|
|
}
|
|
|
|
resource "aws_cloudwatch_log_group" "xfusion" {
|
|
name = "xfusion-log-group"
|
|
}
|
|
|
|
resource "aws_cloudwatch_log_stream" "xfusion" {
|
|
name = "xfusion-log-stream"
|
|
log_group_name = aws_cloudwatch_log_group.xfusion.name
|
|
}
|
|
```
|
|
|
|
## How to run
|
|
|
|
```bash
|
|
cd /home/bob/terraform
|
|
terraform init
|
|
terraform apply -auto-approve
|
|
```
|
|
|
|
## How it works
|
|
|
|
CloudWatch Logs has a two-level hierarchy: a **log group** is the container (where
|
|
you set retention, encryption, and access policy), and a **log stream** is an
|
|
ordered sequence of log events inside a group, typically one per source (an
|
|
instance, container, or function). This task creates one of each.
|
|
|
|
### `aws_cloudwatch_log_group`
|
|
|
|
- **`name = "xfusion-log-group"`** — the group name, exactly as required.
|
|
- No `retention_in_days` is set, so logs are retained **indefinitely** (the AWS
|
|
default). The task doesn't specify retention, so the default is fine; you'd add
|
|
`retention_in_days = N` if a policy required expiring logs.
|
|
|
|
### `aws_cloudwatch_log_stream`
|
|
|
|
- **`name = "xfusion-log-stream"`** — the stream name, exactly as required.
|
|
- **`log_group_name = aws_cloudwatch_log_group.xfusion.name`** — a stream can't
|
|
exist on its own; it must live inside a group. Referencing the group resource's
|
|
`name` attribute (rather than hardcoding the string) does two things:
|
|
1. It wires the value correctly, and
|
|
2. it creates an **implicit dependency** so Terraform provisions the group
|
|
**before** the stream. Without that ordering, the stream create would fail
|
|
because its parent group wouldn't exist yet.
|
|
|
|
This is why no explicit `depends_on` is needed — the attribute reference expresses
|
|
the dependency for you.
|
|
|
|
### Ordering matters
|
|
|
|
The dependency direction is one-way: group first, then stream. On `destroy`,
|
|
Terraform reverses it automatically — stream removed before group — so teardown is
|
|
clean too.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
# Confirm the group exists
|
|
aws logs describe-log-groups \
|
|
--log-group-name-prefix xfusion-log-group \
|
|
--query 'logGroups[0].{Name:logGroupName,Retention:retentionInDays}'
|
|
|
|
# Confirm the stream exists inside it
|
|
aws logs describe-log-streams \
|
|
--log-group-name xfusion-log-group \
|
|
--query 'logStreams[?logStreamName==`xfusion-log-stream`].logStreamName'
|
|
```
|
|
|
|
Expected — the group `xfusion-log-group` (retention `null` = never expire), and the
|
|
stream query returning `["xfusion-log-stream"]`. |