qumulo_audit_cloudwatch (Resource)

Manages CloudWatch audit log configuration on a Qumulo cluster.

This is a singleton resource (one per cluster). It configures the CloudWatch audit logging settings for sending audit events to AWS CloudWatch Logs.

~> Note: This resource manages a singleton configuration. Deleting this resource resets the CloudWatch audit configuration to disabled state rather than removing it.

~> Note: The cluster must have appropriate IAM permissions to write to CloudWatch Logs. Ensure the cluster's IAM role has the necessary logs:CreateLogStream, logs:DescribeLogGroups, logs:DescribeLogStreams, and logs:PutLogEvents permissions for the specified log group. (Qumulo Core 7.9.0 audit log V2 requires the two Describe actions in addition to the write actions.)

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic CloudWatch Configuration

resource "qumulo_audit_cloudwatch" "main" {
  connection_profile = "prod"

  enabled        = true
  log_group_name = "/qumulo/audit"
  region         = "us-west-2"
}

With AWS CloudWatch Log Group

resource "aws_cloudwatch_log_group" "qumulo_audit" {
  name              = "/qumulo/audit"
  retention_in_days = 30
}

resource "qumulo_audit_cloudwatch" "main" {
  connection_profile = "prod"

  enabled        = true
  log_group_name = aws_cloudwatch_log_group.qumulo_audit.name
  region         = "us-west-2"
}

Multi-Cluster with for_each

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_audit_cloudwatch" "all" {
  for_each = var.clusters

  connection_profile = each.value

  enabled        = true
  log_group_name = "/qumulo/${each.key}/audit"
  region         = "us-west-2"
}

Import

using the connection profile name:

terraform import qumulo_audit_cloudwatch.main prod

Schema

Required

• connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

- enabled (Boolean) Enable CloudWatch audit logging.

Optional

• log_group_name (String) The CloudWatch log group name. Required when enabled is true.
• region (String) The AWS region for CloudWatch. Required when enabled is true.