Add cloudwatch logging - api gateway global settings #8
Conversation
niroz89
changed the title
There was a problem hiding this comment.
Please help to suppress checkov if not relevant. For kms, we can stick with default encryption, no need to go for cmk which is additional cost + needs rotation.
And generate terraform docs.
terraform-docs markdown --lockfile=false --recursive table --output-file README.md --output-mode inject .
main.tf
Outdated
| tags = { | ||
| global_cwl_log_arn = var.enable_global_apigw_logging ? aws_api_gateway_account.api_gateway_account[0].cloudwatch_role_arn : "" | ||
| } |
There was a problem hiding this comment.
@jaezeu how this tag will be used ?
There was a problem hiding this comment.
@niroz89 this is to force implicit dependency so that the stage will be created after the global aws_api_gateway_account cloudwatch role arn is updated.
There was a problem hiding this comment.
I think depends_on = [aws_api_gateway_account.api_gateway_account] might be sufficient. That should handle the "conditional" aspect -- I misunderstood your question on Slack.
* adding cwl log * terraform docs * checkov suppression * checkov suppression for cwl * add depends on * fmt Co-authored-by: Jazeel <[email protected]>
Adding cwl global iam role
Adding aws_api_gateway_account as a tag to the api_gateway_stage resource, so that the aws_api_gateway_account resource would be created prior to the stage.