googleLoggingProjectBucketConfig

Manages a project-level logging bucket config. For more information see the official logging documentation and Storing Logs.

\~> Note: Logging buckets are automatically created for a given folder, project, organization, billingAccount and cannot be deleted. Creating a resource of this type will acquire and update the resource that already exists at the desired location. These buckets cannot be removed so deleting this resource will remove the bucket config from your terraform state but will leave the logging bucket unchanged. The buckets that are currently automatically created are "_Default" and "_Required".

Example Usage

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleProjectDefault = new google.project.Project(this, "default", {
  name: "your-project-id",
  org_id: "123456789",
  project_id: "your-project-id",
});
new google.loggingProjectBucketConfig.LoggingProjectBucketConfig(
  this,
  "basic",
  {
    bucket_id: "_Default",
    location: "global",
    project: googleProjectDefault.id,
    retention_days: 30,
  }
);

Create logging bucket with customId

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.loggingProjectBucketConfig.LoggingProjectBucketConfig(
  this,
  "basic",
  {
    bucket_id: "custom-bucket",
    location: "global",
    project: "project_id",
    retention_days: 30,
  }
);

Create logging bucket with Log Analytics enabled

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.loggingProjectBucketConfig.LoggingProjectBucketConfig(
  this,
  "analytics-enabled-bucket",
  {
    bucket_id: "custom-bucket",
    enable_analytics: true,
    location: "global",
    project: "project_id",
    retention_days: 30,
  }
);

Create logging bucket with customId and cmekSettings

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleKmsKeyRingKeyring = new google.kmsKeyRing.KmsKeyRing(
  this,
  "keyring",
  {
    location: "us-central1",
    name: "keyring-example",
  }
);
const dataGoogleLoggingProjectCmekSettingsCmekSettings =
  new google.dataGoogleLoggingProjectCmekSettings.DataGoogleLoggingProjectCmekSettings(
    this,
    "cmek_settings",
    {
      project: "project_id",
    }
  );
const googleKmsCryptoKeyKey = new google.kmsCryptoKey.KmsCryptoKey(
  this,
  "key",
  {
    key_ring: googleKmsKeyRingKeyring.id,
    name: "crypto-key-example",
    rotation_period: "100000s",
  }
);
const googleKmsCryptoKeyIamBindingCryptoKeyBinding =
  new google.kmsCryptoKeyIamBinding.KmsCryptoKeyIamBinding(
    this,
    "crypto_key_binding",
    {
      crypto_key_id: googleKmsCryptoKeyKey.id,
      members: [
        `serviceAccount:\${${dataGoogleLoggingProjectCmekSettingsCmekSettings.serviceAccountId}}`,
      ],
      role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
    }
  );
new google.loggingProjectBucketConfig.LoggingProjectBucketConfig(
  this,
  "example-project-bucket-cmek-settings",
  {
    bucket_id: "custom-bucket",
    cmek_settings: [
      {
        kms_key_name: googleKmsCryptoKeyKey.id,
      },
    ],
    depends_on: [`\${${googleKmsCryptoKeyIamBindingCryptoKeyBinding.fqn}}`],
    location: "us-central1",
    project: "project_id",
    retention_days: 30,
  }
);

Argument Reference

The following arguments are supported:

project - (Required) The parent resource that contains the logging bucket.
location - (Required) The location of the bucket.
bucketId - (Required) The name of the logging bucket. Logging automatically creates two log buckets: required and default.
description - (Optional) Describes this bucket.
retentionDays - (Optional) Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used.
enableAnalytics - (Optional) Whether or not Log Analytics is enabled. Logs for buckets with Log Analytics enabled can be queried in the Log Analytics page using SQL queries. Cannot be disabled once enabled.
cmekSettings - (Optional) The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. Structure is documented below.

The cmekSettings block supports:

name - The resource name of the CMEK settings.
kmsKeyName - The resource name for the configured Cloud KMS key. KMS key name format: 'projects/[projectId]/locations/[location]/keyRings/[keyring]/cryptoKeys/[key]' To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked. See Enabling CMEK for Logging Buckets for more information.
kmsKeyVersionName - The CryptoKeyVersion resource name for the configured Cloud KMS key. KMS key name format: 'projects/[projectId]/locations/[location]/keyRings/[keyring]/cryptoKeys/[key]/cryptoKeyVersions/[version]' For example: "projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1" This is a read-only field used to convey the specific configured CryptoKeyVersion of kms_key that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version.
serviceAccountId - The service account associated with a project for which CMEK will apply. Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use v2.getCmekSettings to obtain the service account ID. See Enabling CMEK for Logging Buckets for more information.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

id - an identifier for the resource with format projects/{{project}}/locations/{{location}}/buckets/{{bucketId}}
name - The resource name of the bucket. For example: "projects/my-project-id/locations/my-location/buckets/my-bucket-id"
lifecycleState - The bucket's lifecycle such as active or deleted. See LifecycleState.

Import

This resource can be imported using the following format:

$ terraform import google_logging_project_bucket_config.default projects/{{project}}/locations/{{location}}/buckets/{{bucket_id}}