Package com.pulumi.aws.ec2

Class FlowLog

  • public class FlowLog
extends com.pulumi.resources.CustomResource
    Provides a VPC/Subnet/ENI/Transit Gateway/Transit Gateway Attachment Flow Log to capture IP traffic for a specific network interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group, a S3 Bucket, or Amazon Data Firehose ## Example Usage ### CloudWatch Logging 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cloudwatch.LogGroup;
 import com.pulumi.aws.cloudwatch.LogGroupArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.ec2.FlowLog;
 import com.pulumi.aws.ec2.FlowLogArgs;
 import com.pulumi.aws.iam.RolePolicy;
 import com.pulumi.aws.iam.RolePolicyArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleLogGroup = new LogGroup("exampleLogGroup", LogGroupArgs.builder()
             .name("example")
             .build());
 
         final var assumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("vpc-flow-logs.amazonaws.com")
                     .build())
                 .effect("Allow")
                 .actions("sts:AssumeRole")
                 .build())
             .build());
 
         var exampleRole = new Role("exampleRole", RoleArgs.builder()
             .name("example")
             .assumeRolePolicy(assumeRole.json())
             .build());
 
         var exampleFlowLog = new FlowLog("exampleFlowLog", FlowLogArgs.builder()
             .iamRoleArn(exampleRole.arn())
             .logDestination(exampleLogGroup.arn())
             .trafficType("ALL")
             .vpcId(exampleAwsVpc.id())
             .build());
 
         final var example = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .effect("Allow")
                 .actions(                
                     "logs:CreateLogGroup",
                     "logs:CreateLogStream",
                     "logs:PutLogEvents",
                     "logs:DescribeLogGroups",
                     "logs:DescribeLogStreams")
                 .resources("*")
                 .build())
             .build());
 
         var exampleRolePolicy = new RolePolicy("exampleRolePolicy", RolePolicyArgs.builder()
             .name("example")
             .role(exampleRole.id())
             .policy(example.json())
             .build());
 
     }
 }
    ### Amazon Data Firehose logging ### S3 Logging 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.s3.Bucket;
 import com.pulumi.aws.s3.BucketArgs;
 import com.pulumi.aws.ec2.FlowLog;
 import com.pulumi.aws.ec2.FlowLogArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleBucket = new Bucket("exampleBucket", BucketArgs.builder()
             .bucket("example")
             .build());
 
         var example = new FlowLog("example", FlowLogArgs.builder()
             .logDestination(exampleBucket.arn())
             .logDestinationType("s3")
             .trafficType("ALL")
             .vpcId(exampleAwsVpc.id())
             .build());
 
     }
 }
    ### S3 Logging in Apache Parquet format with per-hour partitions 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.s3.Bucket;
 import com.pulumi.aws.s3.BucketArgs;
 import com.pulumi.aws.ec2.FlowLog;
 import com.pulumi.aws.ec2.FlowLogArgs;
 import com.pulumi.aws.ec2.inputs.FlowLogDestinationOptionsArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleBucket = new Bucket("exampleBucket", BucketArgs.builder()
             .bucket("example")
             .build());
 
         var example = new FlowLog("example", FlowLogArgs.builder()
             .destinationOptions(FlowLogDestinationOptionsArgs.builder()
                 .fileFormat("parquet")
                 .perHourPartition(true)
                 .build())
             .logDestination(exampleBucket.arn())
             .logDestinationType("s3")
             .trafficType("ALL")
             .vpcId(exampleAwsVpc.id())
             .build());
 
     }
 }
    ### Cross-Account Amazon Data Firehose Logging The following example shows how to set up a flow log in one AWS account (source) that sends logs to an Amazon Data Firehose delivery stream in another AWS account (destination). See the [AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-firehose.html). 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.ec2.Vpc;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementConditionArgs;
 import com.pulumi.aws.iam.RolePolicy;
 import com.pulumi.aws.iam.RolePolicyArgs;
 import com.pulumi.aws.kinesis.FirehoseDeliveryStream;
 import com.pulumi.aws.kinesis.FirehoseDeliveryStreamArgs;
 import com.pulumi.aws.ec2.FlowLog;
 import com.pulumi.aws.ec2.FlowLogArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         // For source account
         var src = new Vpc("src");
 
         final var srcAssumeRolePolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("delivery.logs.amazonaws.com")
                     .build())
                 .actions("sts:AssumeRole")
                 .effect("Allow")
                 .build())
             .build());
 
         var srcRole = new Role("srcRole", RoleArgs.builder()
             .name("tf-example-mySourceRole")
             .assumeRolePolicy(srcAssumeRolePolicy.json())
             .build());
 
         // For destination account
         final var dstAssumeRolePolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("AWS")
                     .identifiers(srcRole.arn())
                     .build())
                 .actions("sts:AssumeRole")
                 .effect("Allow")
                 .build())
             .build());
 
         var dst = new Role("dst", RoleArgs.builder()
             .name("AWSLogDeliveryFirehoseCrossAccountRole")
             .assumeRolePolicy(dstAssumeRolePolicy.applyValue(_dstAssumeRolePolicy -> _dstAssumeRolePolicy.json()))
             .build());
 
         final var srcRolePolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(            
                 GetPolicyDocumentStatementArgs.builder()
                     .conditions(                    
                         GetPolicyDocumentStatementConditionArgs.builder()
                             .test("StringEquals")
                             .variable("iam:PassedToService")
                             .values("delivery.logs.amazonaws.com")
                             .build(),
                         GetPolicyDocumentStatementConditionArgs.builder()
                             .test("StringLike")
                             .variable("iam:AssociatedResourceARN")
                             .values(src.arn())
                             .build())
                     .effect("Allow")
                     .actions("iam:PassRole")
                     .resources(srcRole.arn())
                     .build(),
                 GetPolicyDocumentStatementArgs.builder()
                     .effect("Allow")
                     .actions(                    
                         "logs:CreateLogDelivery",
                         "logs:DeleteLogDelivery",
                         "logs:ListLogDeliveries",
                         "logs:GetLogDelivery")
                     .resources("*")
                     .build(),
                 GetPolicyDocumentStatementArgs.builder()
                     .effect("Allow")
                     .actions("sts:AssumeRole")
                     .resources(dst.arn())
                     .build())
             .build());
 
         var srcPolicy = new RolePolicy("srcPolicy", RolePolicyArgs.builder()
             .name("tf-example-mySourceRolePolicy")
             .role(srcRole.name())
             .policy(srcRolePolicy.applyValue(_srcRolePolicy -> _srcRolePolicy.json()))
             .build());
 
         var dstFirehoseDeliveryStream = new FirehoseDeliveryStream("dstFirehoseDeliveryStream", FirehoseDeliveryStreamArgs.builder()
             .tags(Map.of("LogDeliveryEnabled", "true"))
             .build());
 
         var srcFlowLog = new FlowLog("srcFlowLog", FlowLogArgs.builder()
             .logDestinationType("kinesis-data-firehose")
             .logDestination(dstFirehoseDeliveryStream.arn())
             .trafficType("ALL")
             .vpcId(src.id())
             .iamRoleArn(srcRole.arn())
             .deliverCrossAccountRole(dst.arn())
             .build());
 
         final var dstRolePolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .effect("Allow")
                 .actions(                
                     "iam:CreateServiceLinkedRole",
                     "firehose:TagDeliveryStream")
                 .resources("*")
                 .build())
             .build());
 
         var dstRolePolicy2 = new RolePolicy("dstRolePolicy2", RolePolicyArgs.builder()
             .name("AWSLogDeliveryFirehoseCrossAccountRolePolicy")
             .role(dst.name())
             .policy(dstRolePolicy.json())
             .build());
 
     }
 }
    ## Import ### Identity Schema #### Required * `id` (String) Flow Log ID. #### Optional * `accountId` (String) AWS Account where this resource is managed. * `region` (String) Region where this resource is managed. Using `pulumi import`, import Flow Logs using the `id`. For example: ```sh $ pulumi import aws:ec2/flowLog:FlowLog test_flow_log fl-1a2b3c4d ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Constructor Summary

      Constructors 
      Constructor Description
      FlowLog​(java.lang.String name)  
      FlowLog​(java.lang.String name, FlowLogArgs args)  
      FlowLog​(java.lang.String name, FlowLogArgs args, com.pulumi.resources.CustomResourceOptions options)  

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      com.pulumi.core.Output<java.lang.String> arn()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> deliverCrossAccountRole()  
      com.pulumi.core.Output<java.util.Optional<FlowLogDestinationOptions>> destinationOptions()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> eniId()  
      static FlowLog get​(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, FlowLogState state, com.pulumi.resources.CustomResourceOptions options)
      Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> iamRoleArn()  
      com.pulumi.core.Output<java.lang.String> logDestination()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> logDestinationType()  
      com.pulumi.core.Output<java.lang.String> logFormat()  
      com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> maxAggregationInterval()  
      com.pulumi.core.Output<java.lang.String> region()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> regionalNatGatewayId()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> subnetId()  
      com.pulumi.core.Output<java.util.Optional<java.util.List<FlowLogTagFieldSpecification>>> tagFieldSpecifications()  
      com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()  
      com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> trafficType()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> transitGatewayAttachmentId()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> transitGatewayId()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> vpcId()  

      • Methods inherited from class com.pulumi.resources.CustomResource

        getId, id, idFuture

      • Methods inherited from class com.pulumi.resources.Resource

        getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • FlowLog

        public FlowLog​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • FlowLog

        public FlowLog​(java.lang.String name,
               @Nullable
               FlowLogArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • FlowLog

        public FlowLog​(java.lang.String name,
               @Nullable
               FlowLogArgs args,
               @Nullable
               com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • arn

        public com.pulumi.core.Output<java.lang.String> arn()
        Returns:
        ARN of the Flow Log.

      • deliverCrossAccountRole

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> deliverCrossAccountRole()
        Returns:
        ARN of the IAM role in the destination account used for cross-account delivery of flow logs.

      • destinationOptions

        public com.pulumi.core.Output<java.util.Optional<FlowLogDestinationOptions>> destinationOptions()
        Returns:
        Destination options for a flow log. More details below.

      • eniId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> eniId()
        Returns:
        Elastic Network Interface ID to attach to.

      • iamRoleArn

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> iamRoleArn()
        Returns:
        ARN of the IAM role used to post flow logs. Corresponds to `DeliverLogsPermissionArn` in the [AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFlowLogs.html).

      • logDestination

        public com.pulumi.core.Output<java.lang.String> logDestination()
        Returns:
        ARN of the logging destination.

      • logDestinationType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> logDestinationType()
        Returns:
        Logging destination type. Valid values: `cloud-watch-logs`, `s3`, `kinesis-data-firehose`. Default: `cloud-watch-logs`.

      • logFormat

        public com.pulumi.core.Output<java.lang.String> logFormat()
        Returns:
        Fields to include in the flow log record. Accepted format example: `"$${interface-id} $${srcaddr} $${dstaddr} $${srcport} $${dstport}"`.

      • maxAggregationInterval

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> maxAggregationInterval()
        Returns:
        Maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds (1 minute) or `600` seconds (10 minutes). Default: `600`. When `transitGatewayId` or `transitGatewayAttachmentId` is specified, `maxAggregationInterval` *must* be 60 seconds (1 minute).

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • regionalNatGatewayId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> regionalNatGatewayId()
        Returns:
        Regional NAT Gateway ID to attach to.

      • subnetId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> subnetId()
        Returns:
        Subnet ID to attach to.

      • tagFieldSpecifications

        public com.pulumi.core.Output<java.util.Optional<java.util.List<FlowLogTagFieldSpecification>>> tagFieldSpecifications()
        Returns:
        Tag configuration for the Flow Logs Amazon EC2 Tags feature fields (e.g., `$${instance-tag}`) used in `logFormat`. More details below.

      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.

      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.

      • trafficType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> trafficType()
        Returns:
        Type of traffic to capture. Valid values: `ACCEPT`,`REJECT`, `ALL`. Required if `eniId`, `regionalNatGatewayId`, `subnetId`, or `vpcId` is specified.

      • transitGatewayAttachmentId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> transitGatewayAttachmentId()
        Returns:
        Transit Gateway Attachment ID to attach to.

      • transitGatewayId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> transitGatewayId()
        Returns:
        Transit Gateway ID to attach to.

      • vpcId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> vpcId()
        Returns:
        VPC ID to attach to. > **NOTE:** One of `eniId`, `regionalNatGatewayId`, `subnetId`, `transitGatewayId`, `transitGatewayAttachmentId`, or `vpcId` must be specified.

      • get

        public static FlowLog get​(java.lang.String name,
                          com.pulumi.core.Output<java.lang.String> id,
                          @Nullable
                          FlowLogState state,
                          @Nullable
                          com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.