Streaming CloudWatch Metrics to Cardinal Cloud

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 6.0"
    }
  }
}
 
variable "cardinal_api_key_secret_arn" {
  description = "ARN of a Secrets Manager secret holding {\"api_key\": \"<Cardinal organization ingest API key>\"}, in this region"
  type        = string
}
 
variable "name" {
  description = "Base name for all resources"
  type        = string
  default     = "cardinal-cwmetrics"
}
 
variable "include_namespaces" {
  description = "CloudWatch namespaces to stream. Empty streams everything except exclude_namespaces."
  type        = list(string)
  default     = ["AWS/EC2", "AWS/RDS", "AWS/ApplicationELB", "AWS/Lambda", "AWS/SQS", "AWS/ECS"]
}
 
variable "exclude_namespaces" {
  description = "Namespaces never to stream. Only used when include_namespaces is empty."
  type        = list(string)
  default     = ["AWS/Usage"]
}
 
locals {
  cardinal_endpoint = "https://awsfirehose-cwmetrics.us-east-2.aws.cardinalhq.io"
}
 
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
 
# IAM role names are account-global, so qualify them with the region. This lets
# the same module be applied once per region without role-name collisions.
locals {
  role_prefix = "${var.name}-${data.aws_region.current.region}"
}
 
# ---------------------------------------------------------------------------
# Backup bucket. Firehose requires one for HTTP endpoint destinations; it only
# receives batches Cardinal rejected after retries, so it stays empty normally.
# ---------------------------------------------------------------------------
resource "aws_s3_bucket" "backup" {
  bucket_prefix = "${var.name}-backup-"
}
 
resource "aws_s3_bucket_public_access_block" "backup" {
  bucket                  = aws_s3_bucket.backup.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}
 
resource "aws_s3_bucket_lifecycle_configuration" "backup" {
  bucket = aws_s3_bucket.backup.id
 
  rule {
    id     = "expire-failed-batches"
    status = "Enabled"
    filter {}
    expiration {
      days = 14
    }
  }
}
 
# ---------------------------------------------------------------------------
# Firehose delivery role: write failures to the backup bucket, log errors.
# ---------------------------------------------------------------------------
resource "aws_cloudwatch_log_group" "firehose" {
  name              = "/aws/kinesisfirehose/${var.name}"
  retention_in_days = 14
}
 
resource "aws_cloudwatch_log_stream" "firehose" {
  name           = "HttpEndpointDelivery"
  log_group_name = aws_cloudwatch_log_group.firehose.name
}
 
data "aws_iam_policy_document" "firehose_assume" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }
}
 
resource "aws_iam_role" "firehose" {
  name               = "${local.role_prefix}-firehose"
  assume_role_policy = data.aws_iam_policy_document.firehose_assume.json
}
 
data "aws_iam_policy_document" "firehose" {
  statement {
    sid = "BackupBucket"
    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
    ]
    resources = [
      aws_s3_bucket.backup.arn,
      "${aws_s3_bucket.backup.arn}/*",
    ]
  }
 
  statement {
    sid       = "ErrorLogs"
    actions   = ["logs:PutLogEvents"]
    resources = ["${aws_cloudwatch_log_group.firehose.arn}:*"]
  }
 
  # Firehose reads the Cardinal API key from Secrets Manager at delivery time.
  # Add kms:Decrypt on the key if the secret uses a customer-managed KMS key.
  statement {
    sid       = "ReadCardinalApiKey"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = [var.cardinal_api_key_secret_arn]
  }
}
 
resource "aws_iam_role_policy" "firehose" {
  name   = "${var.name}-firehose"
  role   = aws_iam_role.firehose.id
  policy = data.aws_iam_policy_document.firehose.json
}
 
# ---------------------------------------------------------------------------
# Firehose stream: HTTP endpoint destination pointed at Cardinal.
# ---------------------------------------------------------------------------
resource "aws_kinesis_firehose_delivery_stream" "cardinal" {
  name        = var.name
  destination = "http_endpoint"
 
  http_endpoint_configuration {
    name     = "Cardinal"
    url      = local.cardinal_endpoint
    role_arn = aws_iam_role.firehose.arn
 
    # Firehose fetches the API key from Secrets Manager, so it never enters
    # Terraform state. The secret must be in the same region as the stream.
    secrets_manager_configuration {
      enabled    = true
      secret_arn = var.cardinal_api_key_secret_arn
      role_arn   = aws_iam_role.firehose.arn
    }
 
    # Fallback for AWS provider versions that lack the block above: declare a
    # sensitive string variable and pass the key directly. It is then stored
    # in plaintext in Terraform state, so protect the state backend as you
    # would the key itself.
    # access_key = var.cardinal_api_key
 
    # Flush every 60 s or 5 MiB, whichever comes first. Keep buffering_size at
    # or below 48: Firehose base64-encodes records into the request body,
    # and Cardinal rejects bodies over 64 MiB with a permanent 413.
    buffering_interval = 60
    buffering_size     = 5
 
    # Retry non-2xx responses for 5 minutes before writing the batch to S3.
    retry_duration = 300
    s3_backup_mode = "FailedDataOnly"
 
    request_configuration {
      content_encoding = "GZIP"
 
      # Optional: cwmetrics is the default, but declaring it is explicit.
      common_attributes {
        name  = "cardinalhq.format"
        value = "cwmetrics"
      }
    }
 
    s3_configuration {
      role_arn            = aws_iam_role.firehose.arn
      bucket_arn          = aws_s3_bucket.backup.arn
      prefix              = "${var.name}/"
      error_output_prefix = "${var.name}-errors/"
      compression_format  = "GZIP"
    }
 
    cloudwatch_logging_options {
      enabled         = true
      log_group_name  = aws_cloudwatch_log_group.firehose.name
      log_stream_name = aws_cloudwatch_log_stream.firehose.name
    }
  }
 
  depends_on = [aws_iam_role_policy.firehose]
}
 
# ---------------------------------------------------------------------------
# Metric stream role: lets CloudWatch write into the Firehose stream.
# ---------------------------------------------------------------------------
data "aws_iam_policy_document" "metric_stream_assume" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["streams.metrics.cloudwatch.amazonaws.com"]
    }
  }
}
 
resource "aws_iam_role" "metric_stream" {
  name               = "${local.role_prefix}-metric-stream"
  assume_role_policy = data.aws_iam_policy_document.metric_stream_assume.json
}
 
data "aws_iam_policy_document" "metric_stream" {
  statement {
    actions   = ["firehose:PutRecord", "firehose:PutRecordBatch"]
    resources = [aws_kinesis_firehose_delivery_stream.cardinal.arn]
  }
}
 
resource "aws_iam_role_policy" "metric_stream" {
  name   = "${var.name}-metric-stream"
  role   = aws_iam_role.metric_stream.id
  policy = data.aws_iam_policy_document.metric_stream.json
}
 
# ---------------------------------------------------------------------------
# Metric stream. Output format MUST be json; Cardinal rejects the
# OpenTelemetry formats.
# ---------------------------------------------------------------------------
resource "aws_cloudwatch_metric_stream" "cardinal" {
  name          = var.name
  role_arn      = aws_iam_role.metric_stream.arn
  firehose_arn  = aws_kinesis_firehose_delivery_stream.cardinal.arn
  output_format = "json"
 
  dynamic "include_filter" {
    for_each = var.include_namespaces
    content {
      namespace = include_filter.value
    }
  }
 
  dynamic "exclude_filter" {
    for_each = length(var.include_namespaces) == 0 ? var.exclude_namespaces : []
    content {
      namespace = exclude_filter.value
    }
  }
 
  depends_on = [aws_iam_role_policy.metric_stream]
}
 
output "firehose_stream_arn" {
  value = aws_kinesis_firehose_delivery_stream.cardinal.arn
}
 
output "metric_stream_arn" {
  value = aws_cloudwatch_metric_stream.cardinal.arn
}

SECRET_ARN="$(aws secretsmanager create-secret \
  --region us-east-1 \
  --name cardinal/org-ingest-api-key \
  --secret-string '{"api_key":"<your Cardinal organization ingest API key>"}' \
  --query ARN --output text)"
terraform apply -var "cardinal_api_key_secret_arn=$SECRET_ARN"

provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}
 
provider "aws" {
  alias  = "eu_west_1"
  region = "eu-west-1"
}
 
module "cardinal_cwmetrics_us_east_1" {
  source                      = "./modules/cardinal-cwmetrics"
  providers                   = { aws = aws.us_east_1 }
  cardinal_api_key_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:cardinal/org-ingest-api-key-AbCdEf"
}
 
module "cardinal_cwmetrics_eu_west_1" {
  source                      = "./modules/cardinal-cwmetrics"
  providers                   = { aws = aws.eu_west_1 }
  cardinal_api_key_secret_arn = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:cardinal/org-ingest-api-key-AbCdEf"
}