Configure EC2 logs to Cloudwatch

In this article, ec2 (Amazon Linux) will be configured with Cloud Watch to send its logs.

All the resources will be created with Terraform.

Let's start with VPC, subnet, route tables & etc..

VPC.tf

resource "aws_vpc" "vpc" {
  cidr_block       = var.vpc_cidr
  instance_tenancy = "default"
  tags = {
    Name = "${var.environment}-vpc"
  }
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.vpc.id
  depends_on = [
    aws_vpc.vpc
  ]
  tags = {
    "Name" = "${var.environment}-igw"
  }
}

resource "aws_subnet" "subnet" {
  vpc_id     = aws_vpc.vpc.id
  cidr_block = var.subnet_cidr
  tags = {
    Name = "${var.environment}-subnet"
  }
}

resource "aws_route_table" "public-rt" {
  vpc_id = aws_vpc.vpc.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
  tags = {
    "Name" = "${var.environment}-public-route-table"
  }
}

resource "aws_route_table_association" "rta-sub" {
  subnet_id      = aws_subnet.subnet.id
  route_table_id = aws_route_table.public-rt.id
}

resource "aws_security_group" "sg" {
  name = "${var.environment}-demo-sg"
  vpc_id = aws_vpc.vpc.id
  ingress {
    from_port = var.security_group_open_port[0]
    to_port   = var.security_group_open_port[1]
    protocol  = "tcp"
    cidr_blocks = [local.workstation_external_ip]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = -1
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group_rule" "access_for_ip" {
  for_each    = toset(var.security_group_allow_ip)
  type        = "ingress"
  from_port   = var.security_group_open_port[0]
  to_port     = var.security_group_open_port[1]
  protocol    = "tcp"
  cidr_blocks = [each.value]
  security_group_id = aws_security_group.sg.id
}

In security group block, ingress cidr_block is configured to local.workstation_external_ip. This will be your local-machine public IP, which you can see at whatismyipaddress.com

Now, we have to get the IP through terraform.

get_external_ip.tf

data "http" "workstation-external-ip" {
  url = "http://ipv4.icanhazip.com"
}

locals {
  workstation_external_ip = "${chomp(data.http.workstation-external-ip.body)}/32"
}

ec2.tf

resource "tls_private_key" "ssh" {
  algorithm = "RSA"
  rsa_bits  = "4096"
}
resource "local_file" "ssh_private_key" {
  content         = tls_private_key.ssh.private_key_pem
  filename        = "./tls/private.pem"
  file_permission = "0600"
}
resource "aws_key_pair" "tf-ssh-key" {
  key_name   = "${var.environment}-ssh-key"
  public_key = tls_private_key.ssh.public_key_openssh
}


resource "aws_instance" "ec2" {
  count = var.instance_count
  ami                    = var.instance_ami
  instance_type          = var.instance_type
  key_name               = aws_key_pair.tf-ssh-key.key_name
  vpc_security_group_ids = [aws_security_group.sg.id]
  tags = {
    Name = "${var.environment}-vm"
  }
  associate_public_ip_address = true
  subnet_id                   = aws_subnet.subnet.id
  iam_instance_profile = aws_iam_instance_profile.profile.id
  user_data = <<-EOF
  #!/bin/bash
  yum update -y
  yum install -y awslogs
  systemctl start awslogsd
  EOF
}

cloudwatch.tf

resource "aws_iam_policy" "logs-push-policy" {
  name        = "cw-policy-to-push-logs-to-ec2"
  path        = "/"
  description = "cw-policy-to-push-logs-to-ec2"

  policy = jsonencode({
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams"
    ],
      "Resource": [
        "arn:aws:logs:*:*:*"
    ]
  }
 ]
})
}
resource "aws_iam_role" "ec2-cw-role" {
    name = "cw-ec2-logs-role"
    assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}
resource "aws_iam_role_policy_attachment" "attach-cw-role" {
    role = aws_iam_role.ec2-cw-role.id
    policy_arn = aws_iam_policy.logs-push-policy.id
}
resource "aws_iam_instance_profile" "profile" {
    name = "ec2-cw-profile"
    role = aws_iam_role.ec2-cw-role.id
}

variables.tf

variable "region" {
    default = "us-east-1"
}
variable "environment" {
    default = "dev"
}
variable "vpc_cidr" {
    default = "18.0.0.0/16"
}

variable "subnet_cidr" {
    default = "18.0.0.0/24"
}

variable "security_group_open_port" {
    default = [22, 22]
}
variable "security_group_allow_ip" {
    default = ["180.0.0.0/32"]
}

variable "instance_count" {
    default = 1
}

variable "instance_type" {
    default = "t2.micro"
}
variable "instance_ami" {
    default = "ami-026b57f3c383c2eec" ## amazon linux
}

outputs.tf

output "local_workstation_ip" {
  value = local.workstation_external_ip
}
output "ec2_public_ip" {
  #   value       = aws_instance.ec2[0].public_ip
  value = aws_instance.ec2[*].public_ip
}

Run terraform commands to create resourcs

$ terraform init
$ terraform plan
-> Plan: 15 to add, 0 to change, 0 to destroy.

$ terraform apply --auto-approve
-> 
Apply complete! Resources: 15 added, 0 changed, 0 destroyed.

Outputs:

ec2_public_ip = [
  "52.87.50.72",
]
local_workstation_ip = "***.49.55.31/32"

Once resources are created, check In-bound Rule in Security Groups

go to AWS Dashboard > VPC management > Security Groups

Now, try ssh log-in with private key generated in tls folder. Get public IP from outputs.

$ ssh -i ./tls/private.pem ec2-user@52.87.50.72

Check Cloudwatch logs go to AWS Dashboard > CloudWatch > Log groups > /var/log/messages

Destroy the resources once done

$ terraform destroy

-> Destroy complete! Resources: 15 destroyed.

Terraform code will be available at Github.

Thanks for reading.... :)