qumulo_audit_cloudwatch (Resource)¶

Manages CloudWatch audit log configuration on a Qumulo cluster.

This is a singleton resource (one per cluster). It configures the CloudWatch audit logging settings for sending audit events to AWS CloudWatch Logs.

~> Note: This resource manages a singleton configuration. Deleting this resource resets the CloudWatch audit configuration to disabled state rather than removing it.

~> Note: The cluster must have appropriate IAM permissions to write to CloudWatch Logs. Ensure the cluster's IAM role has the necessary logs:CreateLogStream, logs:DescribeLogGroups, logs:DescribeLogStreams, and logs:PutLogEvents permissions for the specified log group. (Qumulo Core 7.9.0 audit log V2 requires the two Describe actions in addition to the write actions.)

Example Usage¶

Basic CloudWatch Configuration¶

resource "qumulo_audit_cloudwatch" "main" {
  connection_profile = "prod"

  enabled        = true
  log_group_name = "/qumulo/audit"
  region         = "us-west-2"
}

With AWS CloudWatch Log Group¶

resource "aws_cloudwatch_log_group" "qumulo_audit" {
  name              = "/qumulo/audit"
  retention_in_days = 30
}

resource "qumulo_audit_cloudwatch" "main" {
  connection_profile = "prod"

  enabled        = true
  log_group_name = aws_cloudwatch_log_group.qumulo_audit.name
  region         = "us-west-2"
}

Multi-Cluster with for_each¶

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_audit_cloudwatch" "all" {
  for_each = var.clusters

  connection_profile = each.value

  enabled        = true
  log_group_name = "/qumulo/${each.key}/audit"
  region         = "us-west-2"
}

Import¶

using the connection profile name:

terraform import qumulo_audit_cloudwatch.main prod

Schema¶

Required¶

connection_profile (String) Name of a connection profile from the provider block. See the provider reference for how to define profiles.
enabled (Boolean) Enable CloudWatch audit logging.

Optional¶

log_group_name (String) The CloudWatch log group name. Required when enabled is true.
region (String) The AWS region for CloudWatch. Required when enabled is true.