feat: Restrict flow log policy to use log group ARNs

evgenii-bezmaternykh commented 4 months ago

Description

This pull request updates the AWS VPC terraform module to use log group ARNs instead of wildcard ("*") as the resource in the flow log policy. This change restricts the flow log policy to specific log groups, improving security and ensuring that only authorized log groups can receive flow log data.

Motivation and Context

The previous implementation allowed logging to any log group in AWS CloudWatch Logs, which could potentially lead to unauthorized access to log data. The updated implementation ensures that flow log data is only sent to designated log groups specified by their ARNs.

Breaking Changes

This change does not break backwards compatibility with the current major version.

How Has This Been Tested?

[ ] I have updated at least one of the examples/* to demonstrate and validate my change(s)
[x] I have tested and validated these changes using one or more of the provided examples/* projects
[x] I have executed pre-commit run -a on my pull request to ensure that all relevant pre-commit checks have passed.

Thank you.

github-actions[bot] commented 2 months ago

This PR has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this PR will be closed in 10 days

antonbabenko commented 2 months ago

This PR is included in version 5.12.0 :tada:

github-actions[bot] commented 4 weeks ago

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

terraform-aws-modules / terraform-aws-vpc