Use Terraform to configure Log Audit Service

Benefits of Terraform

• Multi-cloud infrastructure deployment

  Terraform is suitable for multi-cloud scenarios in which multiple similar infrastructures are deployed across Alibaba Cloud, third-party cloud services, and data centers. Terraform allows developers to use the same tools and similar configuration files to manage infrastructures across different cloud service providers.

• Automated infrastructure management

  Terraform allows you to create configuration file templates to define, provision, and configure Elastic Compute Service (ECS) resources in a repeated and predictable manner. This reduces human errors during deployment and management operations. You can use the same template multiple times to create identical development, test, and production environments.

• Infrastructure as code (IaC)

  Terraform supports the code-based management and maintenance of resources. Terraform stores a copy of the current configurations of your infrastructure. This way, you can track changes made to the components in the IaC system and share infrastructure configurations with other users.

• Reduced development costs

  You can use Terraform to create development and deployment environments based on your business requirements and reduce development and deployment costs. In addition, you can use Terraform to evaluate development costs before you make changes to your system.

Step 1: Specify the identity information and region of the central project for Log Audit Service

Use environment variables to specify the identity information and region of the central project for Log Audit Service.

export ALICLOUD_ACCESS_KEY="AccessKey ID"
export ALICLOUD_SECRET_KEY="AccessKey Secret"
export ALICLOUD_REGION="cn-huhehaote"

Step 2: Complete RAM authorization

If the AliyunServiceRoleForSLSAudit service-linked role does not exist in the central account, you must first create the service-linked role. For more information, see Initially configure Log Audit Service.

For information about how to configure other member accounts in custom authentication mode and the related custom policies, see Use a custom policy to authorize Log Service to collect and synchronize logs.

Step 3: Configure Log Audit Service

1. Create a Terraform directory named sls and create a file named terraform.tf in the directory.
2. Open the terraform.tf file and add the following content:

   resource "alicloud_log_audit" "example" {
     display_name = "tf-audit-test"
     aliuid       = "1379186349****"
   }

   The following table describes the parameters.

   Parameter	Description
   example	The name of the resource. You can specify a custom name.
   display_name	The name of the collection configuration. You can specify a custom name.
   aliuid	The ID of your Alibaba Cloud account.

3. Run the following command in the sls directory to initialize the directory:

   terraform init

   If the command output contains Terraform has been successfully initialized!, the directory is initialized.
4. Open the terraform.tf file and configure the parameters of Log Audit Service.

   The following sample code provides configuration examples. For more information about the parameters, see alicloud_log_audit.

   • Single-account logging

     resource "alicloud_log_audit" "example" {
       display_name = "tf-audit-test"
       aliuid       = "1379186349****"
       variable_map = {
         "actiontrail_enabled" = "true",
         "actiontrail_ttl" = "180"
       }
     }

   • Multi-account logging

     You can configure the multi-account logging feature in custom authentication mode or resource directory mode. In custom authentication mode, the central account is an Alibaba Cloud account. In resource directory mode, the central account must be a management account or a delegated administrator account of Resource Directory. For more information, see Configure multi-account collection.

     • Custom authentication mode

       resource "alicloud_log_audit" "example" {
         display_name = "tf-audit-test"
         aliuid     = "1379186349****"
         variable_map = {
           "actiontrail_enabled" = "true",
           "actiontrail_ttl" = "180"
         }
         multi_account = ["1257918632****", "1324567349****"]
       
       }

     • Custom mode in resource directory mode

       resource "alicloud_log_audit" "example" {
         display_name = "tf-audit-test"
         aliuid    = "1379186349****"
         variable_map = {
           "actiontrail_enabled" = "true",
           "actiontrail_ttl" = "180"
         }
         multi_account = ["1257918632****", "1324567349****"]
       resource_directory_type="custom"
       }

     • All Members mode in resource directory mode

       resource "alicloud_log_audit" "example" {
         display_name = "tf-audit-test"
         aliuid       = "1379186349****"
         variable_map = {
           "actiontrail_enabled" = "true",
           "actiontrail_ttl" = "180"
         }
       resource_directory_type="all"
       }

   The following table describes the parameters.

   Parameter	Description
   multi_account	If you configure multi-account logging in custom authentication mode or by using the Custom mode in resource directory mode, you must configure the multi_account parameter. Note The custom authentication mode requires complex configurations. We recommend that you configure multi-account logging in resource directory mode. If you use the custom authentication mode, the resource_directory_type parameter is unavailable, and you must set the multi_account parameter to the ID of an Alibaba Cloud account. If you use the Custom mode in resource directory mode, the resource_directory_type parameter is set to custom, and you must set the multi_account parameter to a member in your resource directory.
   resource_directory_type	If you configure multi-account logging in resource directory mode, you must configure the resource_directory_type parameter. Valid values: all: The All Members mode in resource directory mode is used. custom: The Custom mode in resource directory mode is used. Note If you use the custom authentication mode, you do not need to configure the resource_directory_type parameter.
   variable_map	Specifies the objects to collect, whether to collect specific data, and the retention period of the objects. For information about the parameters in the variable_map parameter, see Appendix: parameters in variable_map.

5. Apply the configurations in the terraform.tf file.
   1. Run the following command:

      terraform apply

   2. Enter yes.

      If the command output contains Apply complete!, the configurations take effect, and Log Audit Service collects and stores logs based on the configurations.

      

What to do next

You can use Terraform to perform the following operations:

• Import existing collection configurations.

  terraform import alicloud_log_audit.example tf-audit-test

  You must replace example and tf-audit-test with actual values.

  

  After the command is run, you can view the content of the terraform.tfstate file in the Terraform directory. The terraform.tfstate file contains the imported collection configurations.

  Notice

  • If you want to migrate the imported collection configurations to the terraform.tf file, you must copy the configurations and adjust the format of the configurations to meet the format requirements of the terraform.tf file.
  • If you run the terrraform apply or terraform import command once in the Terraform directory, the next execution of the terraform import command fails. Before you can run the terraform import command again, you must delete the terraform.tfstate file from the directory.
• View the current collection configurations.

  terraform show

  
• View the differences between the terraform.tf file in the Terraform directory and the collection configurations that are in effect.

  terraform plan

  

Appendix: parameters in variable_map