CloudWatchLogGroupsログのS3へのバックアップをAWS CDKで実装してみた

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as kinesisfirehose from "aws-cdk-lib/aws-kinesisfirehose";
import * as iam from "aws-cdk-lib/aws-iam";
import * as logs from "aws-cdk-lib/aws-logs";

// 作成したロググループリストの読み込み
import logGroups from './constructors/loglist.json';

export class CloudWatchLogsBkupStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    // 任意の識別子を付与してください
    const environmentName = "test-logbackup";

    // 保存先のS3 bucket
    const logBackupBucket = new s3.Bucket(this, 'logBackupBucket', {
        bucketName: `all-log-backup`,
        autoDeleteObjects: false,
        removalPolicy: cdk.RemovalPolicy.RETAIN,
        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
        objectLockEnabled: true,
        enforceSSL: true,
        versioned: true,
        lifecycleRules:[
            {
                id:`lifecycle-rule`,
                // 保持期間90日経過したものはGLACIER
                transitions: [{
                    storageClass: s3.StorageClass.GLACIER,
                    transitionAfter: cdk.Duration.days(90),
                }],
                // 1年経過したものは削除
                expiration: cdk.Duration.days(365),
                noncurrentVersionExpiration: cdk.Duration.days(1)
            }
        ]
    });

    // 必要となるRoleの準備
    // Firehorse to S3
    const destinationRole = new iam.Role(this, 'Destination Role', {
      roleName:`DestinationRole`,
      assumedBy: new iam.ServicePrincipal('firehose.amazonaws.com'),
    });
    destinationRole.attachInlinePolicy(
      new iam.Policy(this, 'S3Permission', {
        statements: [
          new iam.PolicyStatement({
            actions: [
              's3:AbortMultipartUpload',
              's3:GetBucketLocation',
              's3:GetObject',
              's3:ListBucket',
              's3:ListBucketMultipartUploads',
              's3:PutObject'
            ],
            resources: [logBackupBucket.bucketArn, logBackupBucket.arnForObjects('*')],
          }),
        ],
      }),
    );

    // CW Logs to Firehorse
    const cwLogIngestionRole = new iam.Role(this, 'cwlogIngestionRole', {
      roleName:`cwlogIngestionRole`,
      assumedBy: new iam.ServicePrincipal('logs.' + cdk.Stack.of(this).region + '.amazonaws.com'),
    });
    cwLogIngestionRole.attachInlinePolicy(
        new iam.Policy(this, 'putLogsPermission', {
            statements: [
            new iam.PolicyStatement({
                actions: ['firehose:*'],
                resources: ['arn:aws:firehose:' + cdk.Stack.of(this).region + ':' + cdk.Stack.of(this).account + ':*'],
            }),
            ],
        }),
        );

    // 配信先Firehoseの作成
    const firehoseDeliveryStream = new kinesisfirehose.CfnDeliveryStream(this, 'FirehoseDeliveryStream', {
        deliveryStreamName: `Firehose`,
        extendedS3DestinationConfiguration: {
            bucketArn: logBackupBucket.bucketArn,
            roleArn: destinationRole.roleArn,
            errorOutputPrefix: `${environmentName}/error/`,
            prefix: `${environmentName}/`,
            bufferingHints: {
            intervalInSeconds: 300,
            sizeInMBs: 5,
            },
        },
    });

    // 取得したログリストを用いた作業
    logGroups.forEach(loglist=>{
        // ログ名から"/"を削除する
        // 先頭の / を削除
        const tmpLogList = loglist.startsWith('/') ? loglist.slice(1) : loglist;
        // その後、/ を - に変換
        const replacedLogList = tmpLogList.replace(/\//g, '-');
        // loglistを指定して取得
        const myLogGroup = logs.LogGroup.fromLogGroupName(this,
            `${replacedLogList}-LogGroup`,
            loglist
            );
        new logs.LogStream(this, `${replacedLogList}-LogStream`, {
            logStreamName: `${replacedLogList}-LogStream`,
            logGroup: myLogGroup,
            removalPolicy: cdk.RemovalPolicy.DESTROY
        });
        // 各ログに対してサブスクリプションフィルターを作成する
        new logs.CfnSubscriptionFilter(this, `${replacedLogList}-LogGroupSubscription`, {
            filterName: `${replacedLogList}-LogGroupSubscription`,
            destinationArn: firehoseDeliveryStream.attrArn,
            filterPattern: "",
            logGroupName: myLogGroup.logGroupName,
            roleArn: cwLogIngestionRole.roleArn,
        });
    });
  }
}