diff --git a/infrastructure/modules/lambda/cloudwatch_log_group.tf b/infrastructure/modules/lambda/cloudwatch_log_group.tf index 1937fc1..dff7497 100644 --- a/infrastructure/modules/lambda/cloudwatch_log_group.tf +++ b/infrastructure/modules/lambda/cloudwatch_log_group.tf @@ -10,3 +10,17 @@ resource "aws_cloudwatch_log_group" "main" { }, ) } + +resource "aws_cloudwatch_log_group" "main_edge" { + count = var.lambda_at_edge ? 1 : 0 + name = "/aws/lambda/us-east-1.${local.csi}" + retention_in_days = var.log_retention_in_days + kms_key_id = var.kms_key_arn + + tags = merge( + local.default_tags, + { + Name = local.csi + }, + ) +} diff --git a/infrastructure/modules/lambda/data_iam_policy_document_put_logs.tf b/infrastructure/modules/lambda/data_iam_policy_document_put_logs.tf index a794885..978ddf7 100644 --- a/infrastructure/modules/lambda/data_iam_policy_document_put_logs.tf +++ b/infrastructure/modules/lambda/data_iam_policy_document_put_logs.tf @@ -9,9 +9,11 @@ data "aws_iam_policy_document" "put_logs" { ] #trivy:ignore:aws-iam-no-policy-wildcards - resources = [ + resources = flatten([[ "${aws_cloudwatch_log_group.main.arn}:*", - ] + ], var.lambda_at_edge ? [ + "${aws_cloudwatch_log_group.main_edge[0].arn}:*", + ] : []]) } dynamic "statement" {