43 lines
1.5 KiB
Terraform
43 lines
1.5 KiB
Terraform
# =============================================================================
|
|
# CLOUDFLARE : Insights : Logs : Logpush
|
|
# =============================================================================
|
|
# BRIQUE LOGPUSH : export continu des logs Gateway vers un stockage externe
|
|
# (S3, R2, ou un SIEM type Elastic/Splunk/Datadog) pour l'audit long terme.
|
|
# Le dashboard ne conserve les logs que quelques jours : Logpush est la
|
|
# réponse "entreprise" à la rétention et à la corrélation SIEM.
|
|
#
|
|
# La brique est inerte tant que logpush_enabled = false.
|
|
#
|
|
# ACTIONS EXTERNES (voir ACTIONS_EXTERNES.md) :
|
|
# 1. Créer le bucket de destination (ex : R2 "gateway-logs", ou S3)
|
|
# 2. Renseigner logpush_destination_conf dans variables.auto.tfvars, ex :
|
|
# S3 : "s3://mon-bucket/gateway?region=eu-north-1"
|
|
# R2 : "r2://gateway-logs/{DATE}?account-id=<account>&access-key-id=...&secret-access-key=..."
|
|
# 3. Passer logpush_enabled = true
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_logpush_job" "gateway_http" {
|
|
count = var.logpush_enabled ? 1 : 0
|
|
|
|
account_id = local.cloudflare_account_id
|
|
name = "gateway-http-logs"
|
|
dataset = "gateway_http"
|
|
destination_conf = var.logpush_destination_conf
|
|
enabled = true
|
|
|
|
output_options = {
|
|
field_names = [
|
|
"Datetime",
|
|
"Email",
|
|
"Action",
|
|
"URL",
|
|
"HTTPHost",
|
|
"HTTPMethod",
|
|
"HTTPStatusCode",
|
|
"DeviceName",
|
|
"PolicyName",
|
|
]
|
|
timestamp_format = "rfc3339"
|
|
}
|
|
}
|