import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Manages a project-level logging sink. For more information see: * * * [API documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects.sinks) * * How-to Guides * * [Exporting Logs](https://cloud.google.com/logging/docs/export) * * > You can specify exclusions for log sinks created by terraform by using the exclusions field of `gcp.logging.FolderSink` * * > **Note:** You must have [granted the "Logs Configuration Writer"](https://cloud.google.com/logging/docs/access-control) IAM role (`roles/logging.configWriter`) to the credentials used with this provider. * * > **Note** You must [enable the Cloud Resource Manager API](https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com) * * > **Note:** The `_Default` and `_Required` logging sinks are automatically created for a given project and cannot be deleted. Creating a resource of this type will acquire and update the resource that already exists at the desired location. These sinks cannot be removed so deleting this resource will remove the sink config from your terraform state but will leave the logging sink unchanged. The sinks that are currently automatically created are "_Default" and "_Required". * * ## Example Usage * * ### Basic Sink * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const my_sink = new gcp.logging.ProjectSink("my-sink", { * name: "my-pubsub-instance-sink", * destination: "pubsub.googleapis.com/projects/my-project/topics/instance-activity", * filter: "resource.type = gce_instance AND severity >= WARNING", * uniqueWriterIdentity: true, * }); * ``` * * ### Cloud Storage Bucket Destination * * A more complete example follows: this creates a compute instance, as well as a log sink that logs all activity to a * cloud storage bucket. Because we are using `uniqueWriterIdentity`, we must grant it access to the bucket. * * Note that this grant requires the "Project IAM Admin" IAM role (`roles/resourcemanager.projectIamAdmin`) granted to the * credentials used with Terraform. * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * // Our logged compute instance * const my_logged_instance = new gcp.compute.Instance("my-logged-instance", { * networkInterfaces: [{ * accessConfigs: [{}], * network: "default", * }], * name: "my-instance", * machineType: "e2-medium", * zone: "us-central1-a", * bootDisk: { * initializeParams: { * image: "debian-cloud/debian-11", * }, * }, * }); * // A gcs bucket to store logs in * const gcs_bucket = new gcp.storage.Bucket("gcs-bucket", { * name: "my-unique-logging-bucket", * location: "US", * }); * // Our sink; this logs all activity related to our "my-logged-instance" instance * const instance_sink = new gcp.logging.ProjectSink("instance-sink", { * name: "my-instance-sink", * description: "some explanation on what this is", * destination: pulumi.interpolate`storage.googleapis.com/${gcs_bucket.name}`, * filter: pulumi.interpolate`resource.type = gce_instance AND resource.labels.instance_id = "${my_logged_instance.instanceId}"`, * uniqueWriterIdentity: true, * }); * // Because our sink uses a unique_writer, we must grant that writer access to the bucket. * const gcs_bucket_writer = new gcp.projects.IAMBinding("gcs-bucket-writer", { * project: "your-project-id", * role: "roles/storage.objectCreator", * members: [instance_sink.writerIdentity], * }); * ``` * * ### User-Managed Service Account * * The following example creates a sink that are configured with user-managed service accounts, by specifying * the `customWriterIdentity` field. * * Note that you can only create a sink that uses a user-managed service account when the sink destination * is a log bucket. * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const custom_sa = new gcp.serviceaccount.Account("custom-sa", { * project: "other-project-id", * accountId: "gce-log-bucket-sink", * displayName: "gce-log-bucket-sink", * }); * // Create a sink that uses user-managed service account * const my_sink = new gcp.logging.ProjectSink("my-sink", { * name: "other-project-log-bucket-sink", * destination: "logging.googleapis.com/projects/other-project-id/locations/global/buckets/gce-logs", * filter: "resource.type = gce_instance AND severity >= WARNING", * uniqueWriterIdentity: true, * customWriterIdentity: custom_sa.email, * }); * // grant writer access to the user-managed service account * const custom_sa_logbucket_binding = new gcp.projects.IAMMember("custom-sa-logbucket-binding", { * project: "destination-project-id", * role: "roles/logging.bucketWriter", * member: pulumi.interpolate`serviceAccount:${custom_sa.email}`, * }); * ``` * * The above example will create a log sink that route logs to destination GCP project using * an user-managed service account. * * ### Sink Exclusions * * The following example uses `exclusions` to filter logs that will not be exported. In this example logs are exported to a [log bucket](https://cloud.google.com/logging/docs/buckets) and there are 2 exclusions configured * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const log_bucket = new gcp.logging.ProjectSink("log-bucket", { * name: "my-logging-sink", * destination: "logging.googleapis.com/projects/my-project/locations/global/buckets/_Default", * exclusions: [ * { * name: "nsexcllusion1", * description: "Exclude logs from namespace-1 in k8s", * filter: "resource.type = k8s_container resource.labels.namespace_name=\"namespace-1\" ", * }, * { * name: "nsexcllusion2", * description: "Exclude logs from namespace-2 in k8s", * filter: "resource.type = k8s_container resource.labels.namespace_name=\"namespace-2\" ", * }, * ], * uniqueWriterIdentity: true, * }); * ``` * * ## Import * * Project-level logging sinks can be imported using their URI, e.g. * * * `projects/{{project_id}}/sinks/{{name}}` * * When using the `pulumi import` command, project-level logging sinks can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:logging/projectSink:ProjectSink default projects/{{project_id}}/sinks/{{name}} * ``` */ export declare class ProjectSink extends pulumi.CustomResource { /** * Get an existing ProjectSink resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: ProjectSinkState, opts?: pulumi.CustomResourceOptions): ProjectSink; /** * Returns true if the given object is an instance of ProjectSink. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is ProjectSink; /** * Options that affect sinks exporting data to BigQuery. Structure documented below. */ readonly bigqueryOptions: pulumi.Output; /** * A user managed service account that will be used to write * the log entries. The format must be `serviceAccount:some@email`. This field can only be specified if you are * routing logs to a destination outside this sink's project. If not specified, a Logging service account * will automatically be generated. */ readonly customWriterIdentity: pulumi.Output; /** * A description of this sink. The maximum length of the description is 8000 characters. */ readonly description: pulumi.Output; /** * The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, a BigQuery dataset, a Cloud Logging bucket, or a Google Cloud project. Examples: * * - `storage.googleapis.com/[GCS_BUCKET]` * - `bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]` * - `pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]` * - `logging.googleapis.com/projects/[PROJECT_ID]/locations/global/buckets/[BUCKET_ID]` * - `logging.googleapis.com/projects/[PROJECT_ID]` * * The writer associated with the sink must have access to write to the above resource. */ readonly destination: pulumi.Output; /** * If set to True, then this sink is disabled and it does not export any log entries. */ readonly disabled: pulumi.Output; /** * Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both `filter` and one of `exclusions.filter`, it will not be exported. Can be repeated multiple times for multiple exclusions. Structure is documented below. */ readonly exclusions: pulumi.Output; /** * The filter to apply when exporting logs. Only log entries that match the filter are exported. * See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to * write a filter. */ readonly filter: pulumi.Output; /** * The name of the logging sink. Logging automatically creates two sinks: `_Required` and `_Default`. */ readonly name: pulumi.Output; /** * The ID of the project to create the sink in. If omitted, the project associated with the provider is * used. */ readonly project: pulumi.Output; /** * Whether or not to create a unique identity associated with this sink. If `false`, then the `writerIdentity` used is `serviceAccount:cloud-logs@system.gserviceaccount.com`. If `true` (the default), * then a unique service account is created and used for this sink. If you wish to publish logs across projects or utilize * `bigqueryOptions`, you must set `uniqueWriterIdentity` to true. */ readonly uniqueWriterIdentity: pulumi.Output; /** * The identity associated with this sink. This identity must be granted write access to the * configured `destination`. */ readonly writerIdentity: pulumi.Output; /** * Create a ProjectSink resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: ProjectSinkArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering ProjectSink resources. */ export interface ProjectSinkState { /** * Options that affect sinks exporting data to BigQuery. Structure documented below. */ bigqueryOptions?: pulumi.Input; /** * A user managed service account that will be used to write * the log entries. The format must be `serviceAccount:some@email`. This field can only be specified if you are * routing logs to a destination outside this sink's project. If not specified, a Logging service account * will automatically be generated. */ customWriterIdentity?: pulumi.Input; /** * A description of this sink. The maximum length of the description is 8000 characters. */ description?: pulumi.Input; /** * The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, a BigQuery dataset, a Cloud Logging bucket, or a Google Cloud project. Examples: * * - `storage.googleapis.com/[GCS_BUCKET]` * - `bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]` * - `pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]` * - `logging.googleapis.com/projects/[PROJECT_ID]/locations/global/buckets/[BUCKET_ID]` * - `logging.googleapis.com/projects/[PROJECT_ID]` * * The writer associated with the sink must have access to write to the above resource. */ destination?: pulumi.Input; /** * If set to True, then this sink is disabled and it does not export any log entries. */ disabled?: pulumi.Input; /** * Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both `filter` and one of `exclusions.filter`, it will not be exported. Can be repeated multiple times for multiple exclusions. Structure is documented below. */ exclusions?: pulumi.Input[]>; /** * The filter to apply when exporting logs. Only log entries that match the filter are exported. * See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to * write a filter. */ filter?: pulumi.Input; /** * The name of the logging sink. Logging automatically creates two sinks: `_Required` and `_Default`. */ name?: pulumi.Input; /** * The ID of the project to create the sink in. If omitted, the project associated with the provider is * used. */ project?: pulumi.Input; /** * Whether or not to create a unique identity associated with this sink. If `false`, then the `writerIdentity` used is `serviceAccount:cloud-logs@system.gserviceaccount.com`. If `true` (the default), * then a unique service account is created and used for this sink. If you wish to publish logs across projects or utilize * `bigqueryOptions`, you must set `uniqueWriterIdentity` to true. */ uniqueWriterIdentity?: pulumi.Input; /** * The identity associated with this sink. This identity must be granted write access to the * configured `destination`. */ writerIdentity?: pulumi.Input; } /** * The set of arguments for constructing a ProjectSink resource. */ export interface ProjectSinkArgs { /** * Options that affect sinks exporting data to BigQuery. Structure documented below. */ bigqueryOptions?: pulumi.Input; /** * A user managed service account that will be used to write * the log entries. The format must be `serviceAccount:some@email`. This field can only be specified if you are * routing logs to a destination outside this sink's project. If not specified, a Logging service account * will automatically be generated. */ customWriterIdentity?: pulumi.Input; /** * A description of this sink. The maximum length of the description is 8000 characters. */ description?: pulumi.Input; /** * The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, a BigQuery dataset, a Cloud Logging bucket, or a Google Cloud project. Examples: * * - `storage.googleapis.com/[GCS_BUCKET]` * - `bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]` * - `pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]` * - `logging.googleapis.com/projects/[PROJECT_ID]/locations/global/buckets/[BUCKET_ID]` * - `logging.googleapis.com/projects/[PROJECT_ID]` * * The writer associated with the sink must have access to write to the above resource. */ destination: pulumi.Input; /** * If set to True, then this sink is disabled and it does not export any log entries. */ disabled?: pulumi.Input; /** * Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both `filter` and one of `exclusions.filter`, it will not be exported. Can be repeated multiple times for multiple exclusions. Structure is documented below. */ exclusions?: pulumi.Input[]>; /** * The filter to apply when exporting logs. Only log entries that match the filter are exported. * See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to * write a filter. */ filter?: pulumi.Input; /** * The name of the logging sink. Logging automatically creates two sinks: `_Required` and `_Default`. */ name?: pulumi.Input; /** * The ID of the project to create the sink in. If omitted, the project associated with the provider is * used. */ project?: pulumi.Input; /** * Whether or not to create a unique identity associated with this sink. If `false`, then the `writerIdentity` used is `serviceAccount:cloud-logs@system.gserviceaccount.com`. If `true` (the default), * then a unique service account is created and used for this sink. If you wish to publish logs across projects or utilize * `bigqueryOptions`, you must set `uniqueWriterIdentity` to true. */ uniqueWriterIdentity?: pulumi.Input; }