Terraform IBM Observability instances module

[!IMPORTANT] The IBM Log Analysis and IBM Cloud Activity Tracker services are deprecated and no longer supported in this module. IBM Cloud Logs is the replacement service and is now the default service created with this module.

This module supports provisioning the following observability services:

• IBM Cloud Logs
  • IBM® Cloud Logs is a scalable logging service that persists logs and provides users with capabilities for querying, tailing, and visualizing logs.
• IBM Cloud Activity Tracker Event Routing
  • Use IBM Cloud® Activity Tracker Event Routing to configure how to route auditing events, both global and location-based event data, in your IBM Cloud. Supports routing to the following target types: IBM Cloud Object Storage (COS), IBM Cloud Logs, and IBM® Event Streams for IBM Cloud®.
• IBM Cloud Monitoring with Cloud Monitoring
  • Monitor the health of services and applications in IBM Cloud.

Overview

• terraform-ibm-observability-instances
• Submodules
  • activity_tracker
  • cloud_logs
  • cloud_monitoring
  • metrics_routing
• Examples
  • Advanced Examples configuring Cloud Logs, Monitoring, Activity Tracker routing with multiple target types
  • Basic example (Cloud Logs, Monitoring, Activity Tracker route with Cloud Logs target)
• Contributing

terraform-ibm-observability-instances

Usage

# Locals
locals {
  region      = "us-south"
}

terraform {
  required_version = ">= 1.0.0"
  required_providers {
    ibm = {
      source  = "ibm-cloud/ibm"
      version = "X.Y.Z" # lock into a supported provider version
    }
  }
}

provider "ibm" {
  ibmcloud_api_key = XXXXXXXXXXXX
  region           = local.region
}

# Below config will provision:
# - Cloud Logs instance
# - Monitoring instance
# - Activity Tracker route to the Cloud Logs target
# - Metrics Routing to Cloud Monitoring target
module "observability_instances" {
  source    = "terraform-ibm-modules/observability-instances/ibm"
  version   = "X.Y.Z" # Replace "X.X.X" with a release version to lock into a specific release
  resource_group_id     = "xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX"
  region                = local.region
  cloud_logs_data_storage = {
    # logs and metrics buckets must be different
    logs_data = {
      enabled         = true
      bucket_crn      = "crn:v1:bluemix:public:cloud-object-storage:global:a/......"
      bucket_endpoint = "s3.direct.us-south.cloud-object-storage.appdomain.cloud"
    },
    metrics_data = {
      enabled         = true
      bucket_crn      = "crn:v1:bluemix:public:cloud-object-storage:global:a/......"
      bucket_endpoint = "s3.direct.us-south.cloud-object-storage.appdomain.cloud"
    }
  }
  at_cloud_logs_targets = [
    {
      instance_id   = module.observability_instances.cloud_logs_crn
      target_region = local.region
      target_name   = "my-icl-target"
    }
  ]
  activity_tracker_routes = [
    {
      locations  = ["*", "global"]
      target_ids = [module.observability_instances.activity_tracker_targets["my-icl-target"].id]
      route_name = "my-icl-route"
    }
  ]
  metric_router_targets = [
    {
      # ID of the Cloud logs instance
      destination_crn   = module.observability_instances.cloud_monitoring_crn
      target_region = "us-south"
      target_name   = "my-mr-target"
    }
  ]
  metric_router_routes = [
    {
        name = "my-mr-route"
        rules = [
            {
                action = "send"
                targets = [{
                    id = module.observability_instances.metrics_router_targets["my-mr-target].id
                }]
                inclusion_filters = [{
                    operand = "location"
                    operator = "is"
                    values = ["us-south"]
                }]
            }
        ]
    }
  ]
}

Required IAM access policies

You need the following permissions to run this module.

• Service
  • Resource group only
    • Viewer access on the specific resource group
  • Activity Tracker Event Routing (Required if creating AT routes and targets)
    • Editor platform access
    • Manager service access
  • Cloud Logs
    • Editor platform access
    • Manager service access
  • IBM Cloud Logs Routing (Required if creating tenants, which are required to enable platform logs)
    • Editor platform access
    • Manager service access
  • Cloud Monitoring
    • Editor platform access
    • Manager service access
  • Tagging service (Required if attaching access tags)
    • Editor platform access

Requirements

Modules

Resources

No resources.

Inputs

list(object({
    locations  = list(string)
    target_ids = list(string)
    route_name = string
  }))

list(object({
    instance_id                              = string
    target_region                            = optional(string)
    target_name                              = string
    skip_atracker_cloud_logs_iam_auth_policy = optional(bool, false)
  }))

list(object({
    endpoint                          = string
    bucket_name                       = string
    instance_id                       = string
    api_key                           = optional(string)
    service_to_service_enabled        = optional(bool, true)
    target_region                     = optional(string)
    target_name                       = string
    skip_atracker_cos_iam_auth_policy = optional(bool, false)
  }))

list(object({
    instance_id                      = string
    brokers                          = list(string)
    topic                            = string
    api_key                          = optional(string)
    service_to_service_enabled       = optional(bool, true)
    skip_atracker_es_iam_auth_policy = optional(bool, false)
    target_region                    = optional(string)
    target_name                      = string
  }))

object({
    logs_data = optional(object({
      enabled              = optional(bool, false)
      bucket_crn           = optional(string)
      bucket_endpoint      = optional(string)
      skip_cos_auth_policy = optional(bool, false)
    }), {})
    metrics_data = optional(object({
      enabled              = optional(bool, false)
      bucket_crn           = optional(string)
      bucket_endpoint      = optional(string)
      skip_cos_auth_policy = optional(bool, false)
    }), {})
    }
  )

{
  "logs_data": null,
  "metrics_data": null
}

list(object({
    en_instance_id      = string
    en_region           = string
    en_integration_name = optional(string)
    skip_en_auth_policy = optional(bool, false)
  }))

list(object({
    logs_policy_name        = string
    logs_policy_description = optional(string, null)
    logs_policy_priority    = string
    application_rule = optional(list(object({
      name         = string
      rule_type_id = optional(string, "unspecified")
    })))
    subsystem_rule = optional(list(object({
      name         = string
      rule_type_id = optional(string, "unspecified")
    })))
    log_rules = optional(list(object({
      severities = list(string)
    })))
    archive_retention = optional(list(object({
      id = string
    })))
  }))

object({
    default_targets           = optional(list(string), [])
    metadata_region_primary   = string
    metadata_region_backup    = optional(string)
    permitted_target_regions  = list(string)
    private_api_endpoint_only = optional(bool, false)
  })

list(object({
    name = string
    rules = list(object({
      action = string
      targets = list(object({
        id = string
      }))
      inclusion_filters = list(object({
        operand  = string
        operator = string
        values   = list(string)
      }))
    }))
  }))

object({
    default_targets = list(object({
      id = string
    }))
    permitted_target_regions  = list(string)
    primary_metadata_region   = string
    backup_metadata_region    = string
    private_api_endpoint_only = bool
  })

list(object({
    destination_crn                     = string
    target_name                         = string
    target_region                       = string
    skip_mrouter_sysdig_iam_auth_policy = optional(bool, false)
  }))

Outputs

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.