CF-DatadogCWLogsforwarder.yaml

AWSTemplateFormatVersion: 2010-09-09
Metadata:
  'AWS::CloudFormation::Designer':
    f4584f57-70c6-4f93-912b-8035bca539de:
      size:
        width: 60
        height: 60
      position:
        x: 420
        'y': 110
      z: 0
      embeds: []
    3969c1f9-dd96-4022-94f1-77e948f375f4:
      size:
        width: 60
        height: 60
      position:
        x: 280
        'y': 110
      z: 0
Resources:
  SubscriptionFilter1:
    Type: 'AWS::Logs::SubscriptionFilter'
    Properties:
      DestinationArn: !Sub 
        - 'arn:aws:firehose:${Region}:${AccountId}:deliverystream/${Name}'
        - Region: !Ref 'AWS::Region'
          AccountId: !Ref 'AWS::AccountId'
          Name: !Ref DeliveryStreamName
      FilterPattern: !Ref FilterPattern
      LogGroupName: !Ref LogGroupName1
      RoleArn: !Sub 
        - 'arn:aws:iam::${AccountId}:role/CWLtoKinesisFirehoseRole'
        - AccountId: !Ref 'AWS::AccountId'
    DependsOn: IAMRole
    Metadata:
      'AWS::CloudFormation::Designer':
        id: f4584f57-70c6-4f93-912b-8035bca539de
  IAMRole:
    Type: 'AWS::IAM::Role'
    Condition: CreateIAMRole
    Properties:
      RoleName: CWLtoKinesisFirehoseRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - logs.ap-northeast-1.amazonaws.com
                - logs.us-east-1.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: Permissions-Policy-For-CWL
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 'firehose:*'
                Resource: 
                  - !Sub 
                    - 'arn:aws:firehose:${Region}:${AccountId}:*'
                    - Region: !Ref 'AWS::Region'
                      AccountId: !Ref 'AWS::AccountId'
      Path: /
      Description: >-
        Allows Kinesis Firehose to transform and deliver data to your
        destinations using CloudWatch Logs, Lambda, and S3 on your behalf.
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 3969c1f9-dd96-4022-94f1-77e948f375f4
Parameters:
  IAMRoleIsExists:
    Type: String
    AllowedValues:
      - 'Yes'
      - 'No'
    Default: 'No'
  DeliveryStreamName:
    Type: String
    Default: DatadogCWLogsforwarder
  LogGroupName1:
    Type: String
  FilterPattern:
    Type: String
    Default: ''
Conditions:
  CreateIAMRole: !Equals 
    - !Ref IAMRoleIsExists
    - 'No'