cwlogs.tf

resource "aws_cloudwatch_log_group" "debug" {
  name              = "API-Gateway-Execution-Logs_${aws_api_gateway_rest_api.stats.id}/${var.stage_name}"
  retention_in_days = 1
}

resource "aws_iam_role" "apig_cw" {
  name = "stats-apig-cloudwatch-logger"
  assume_role_policy = <<-EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Service": "apigateway.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  EOF
}

data "aws_iam_policy_document" "apig_cw" {
  statement {
    sid = "LogGroups"
    actions = [
      "logs:DescribeLogGroups",
    ]
    effect = "Allow"
    resources = ["*"]
  }

  statement {
    sid = "LogStreams"
    actions = [
      "logs:CreateLogStream",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
      "logs:GetLogEvents"
    ]
    effect = "Allow"
    resources = [
    "${aws_cloudwatch_log_group.debug.arn}:log-stream:*"
    ]
  }
}

resource "aws_iam_policy" "apig_cw" {
  name   = "stats-api-cw"
  path   = "/"
  policy = data.aws_iam_policy_document.apig_cw.json
}

resource "aws_iam_role_policy_attachment" "apig_cw" {
  role       = aws_iam_role.apig_cw.name
  policy_arn = aws_iam_policy.apig_cw.arn
}