Skip to content

Commit e622a04

Browse files
committed
feat(logging): add log_class parameter to all CloudWatch log groups
Extends the log_class parameter to all CloudWatch log groups managed by the module, allowing users to set INFREQUENT_ACCESS class to reduce costs. Log groups updated: - runner-binaries-syncer (syncer) - ami-housekeeper - runners (scale-down, scale-up, ssm-housekeeper) - runners/pool - webhook/direct - webhook/eventbridge (webhook, dispatcher) - lambda module (shared) - termination-watcher - multi-runner (passthrough to all submodules) Defaults to STANDARD for backward compatibility.
1 parent 17f3de3 commit e622a04

40 files changed

+107
-5
lines changed

README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ Join our discord community via [this invite link](https://discord.gg/bxgXW8jJGh)
157157
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
158158
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
159159
| <a name="input_lambda_tags"></a> [lambda\_tags](#input\_lambda\_tags) | Map of tags that will be added to all the lambda function resources. Note these are additional tags to the default tags. | `map(string)` | `{}` | no |
160+
| <a name="input_log_class"></a> [log\_class](#input\_log\_class) | The log class of the CloudWatch log groups. Valid values are `STANDARD` or `INFREQUENT_ACCESS`. | `string` | `"STANDARD"` | no |
160161
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
161162
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with. | `string` | `null` | no |
162163
| <a name="input_logging_retention_in_days"></a> [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no |

main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ module "webhook" {
136136
tracing_config = var.tracing_config
137137
logging_retention_in_days = var.logging_retention_in_days
138138
logging_kms_key_id = var.logging_kms_key_id
139+
log_class = var.log_class
139140

140141
role_path = var.role_path
141142
role_permissions_boundary = var.role_permissions_boundary
@@ -227,6 +228,7 @@ module "runners" {
227228
tracing_config = var.tracing_config
228229
logging_retention_in_days = var.logging_retention_in_days
229230
logging_kms_key_id = var.logging_kms_key_id
231+
log_class = var.log_class
230232
enable_cloudwatch_agent = var.enable_cloudwatch_agent
231233
cloudwatch_config = var.cloudwatch_config
232234
runner_log_files = var.runner_log_files
@@ -306,6 +308,7 @@ module "runner_binaries" {
306308
tracing_config = var.tracing_config
307309
logging_retention_in_days = var.logging_retention_in_days
308310
logging_kms_key_id = var.logging_kms_key_id
311+
log_class = var.log_class
309312

310313
state_event_rule_binaries_syncer = var.state_event_rule_binaries_syncer
311314
server_side_encryption_configuration = var.runner_binaries_s3_sse_configuration
@@ -348,6 +351,7 @@ module "ami_housekeeper" {
348351

349352
logging_retention_in_days = var.logging_retention_in_days
350353
logging_kms_key_id = var.logging_kms_key_id
354+
log_class = var.log_class
351355
log_level = var.log_level
352356

353357
role_path = var.role_path
@@ -369,6 +373,7 @@ locals {
369373
subnet_ids = var.lambda_subnet_ids
370374
lambda_tags = var.lambda_tags
371375
log_level = var.log_level
376+
log_class = var.log_class
372377
logging_kms_key_id = var.logging_kms_key_id
373378
logging_retention_in_days = var.logging_retention_in_days
374379
role_path = var.role_path

modules/ami-housekeeper/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ No modules.
115115
| <a name="input_lambda_tags"></a> [lambda\_tags](#input\_lambda\_tags) | Map of tags that will be added to all the lambda function resources. Note these are additional tags to the default tags. | `map(string)` | `{}` | no |
116116
| <a name="input_lambda_timeout"></a> [lambda\_timeout](#input\_lambda\_timeout) | Time out of the lambda in seconds. | `number` | `60` | no |
117117
| <a name="input_lambda_zip"></a> [lambda\_zip](#input\_lambda\_zip) | File location of the lambda zip file. | `string` | `null` | no |
118+
| <a name="input_log_class"></a> [log\_class](#input\_log\_class) | The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`. | `string` | `"STANDARD"` | no |
118119
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
119120
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no |
120121
| <a name="input_logging_retention_in_days"></a> [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no |

modules/ami-housekeeper/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ resource "aws_cloudwatch_log_group" "ami_housekeeper" {
5151
name = "/aws/lambda/${aws_lambda_function.ami_housekeeper.function_name}"
5252
retention_in_days = var.logging_retention_in_days
5353
kms_key_id = var.logging_kms_key_id
54+
log_group_class = var.log_class
5455
tags = var.tags
5556
}
5657

modules/ami-housekeeper/variables.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,17 @@ variable "logging_kms_key_id" {
5454
default = null
5555
}
5656

57+
variable "log_class" {
58+
description = "The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
59+
type = string
60+
default = "STANDARD"
61+
62+
validation {
63+
condition = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
64+
error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
65+
}
66+
}
67+
5768
variable "lambda_subnet_ids" {
5869
description = "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`."
5970
type = list(string)

modules/lambda/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ No modules.
3939

4040
| Name | Description | Type | Default | Required |
4141
|------|-------------|------|---------|:--------:|
42-
| <a name="input_lambda"></a> [lambda](#input\_lambda) | Configuration for the lambda function.<br/><br/>`aws_partition`: Partition for the base arn if not 'aws'<br/>`architecture`: AWS Lambda architecture. Lambda functions using Graviton processors ('arm64') tend to have better price/performance than 'x86\_64' functions.<br/>`environment_variables`: Environment variables for the lambda.<br/>`handler`: The entrypoint for the lambda.<br/>`principals`: Add extra principals to the role created for execution of the lambda, e.g. for local testing.<br/>`lambda_tags`: Map of tags that will be added to created resources. By default resources will be tagged with name and environment.<br/>`log_level`: Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'.<br/>`logging_kms_key_id`: Specifies the kms key id to encrypt the logs with<br/>`logging_retention_in_days`: Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.<br/>`memory_size`: Memory size limit in MB of the lambda.<br/>`metrics_namespace`: Namespace for the metrics emitted by the lambda.<br/>`name`: The name of the lambda function.<br/>`prefix`: The prefix used for naming resources.<br/>`role_path`: The path that will be added to the role, if not set the environment name will be used.<br/>`role_permissions_boundary`: Permissions boundary that will be added to the created role for the lambda.<br/>`runtime`: AWS Lambda runtime.<br/>`s3_bucket`: S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly.<br/>`s3_key`: S3 key for syncer lambda function. Required if using S3 bucket to specify lambdas.<br/>`s3_object_version`: S3 object version for syncer lambda function. Useful if S3 versioning is enabled on source bucket.<br/>`security_group_ids`: List of security group IDs associated with the Lambda function.<br/>`subnet_ids`: List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`.<br/>`tags`: Map of tags that will be added to created resources. By default resources will be tagged with name and environment.<br/>`timeout`: Time out of the lambda in seconds.<br/>`tracing_config`: Configuration for lambda tracing.<br/>`zip`: File location of the lambda zip file. | <pre>object({<br/> aws_partition = optional(string, "aws")<br/> architecture = optional(string, "arm64")<br/> environment_variables = optional(map(string), {})<br/> handler = string<br/> lambda_tags = optional(map(string), {})<br/> log_level = optional(string, "info")<br/> logging_kms_key_id = optional(string, null)<br/> logging_retention_in_days = optional(number, 180)<br/> memory_size = optional(number, 256)<br/> metrics_namespace = optional(string, "GitHub Runners")<br/> name = string<br/> prefix = optional(string, null)<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })), [])<br/> role_path = optional(string, null)<br/> role_permissions_boundary = optional(string, null)<br/> runtime = optional(string, "nodejs24.x")<br/> s3_bucket = optional(string, null)<br/> s3_key = optional(string, null)<br/> s3_object_version = optional(string, null)<br/> security_group_ids = optional(list(string), [])<br/> subnet_ids = optional(list(string), [])<br/> tags = optional(map(string), {})<br/> timeout = optional(number, 60)<br/> tracing_config = optional(object({<br/> mode = optional(string, null)<br/> capture_http_requests = optional(bool, false)<br/> capture_error = optional(bool, false)<br/> }), {})<br/> zip = optional(string, null)<br/> })</pre> | n/a | yes |
42+
| <a name="input_lambda"></a> [lambda](#input\_lambda) | Configuration for the lambda function.<br/><br/>`aws_partition`: Partition for the base arn if not 'aws'<br/>`architecture`: AWS Lambda architecture. Lambda functions using Graviton processors ('arm64') tend to have better price/performance than 'x86\_64' functions.<br/>`environment_variables`: Environment variables for the lambda.<br/>`handler`: The entrypoint for the lambda.<br/>`principals`: Add extra principals to the role created for execution of the lambda, e.g. for local testing.<br/>`lambda_tags`: Map of tags that will be added to created resources. By default resources will be tagged with name and environment.<br/>`log_level`: Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'.<br/>`logging_kms_key_id`: Specifies the kms key id to encrypt the logs with<br/>`logging_retention_in_days`: Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.<br/>`log_class`: The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`.<br/>`memory_size`: Memory size limit in MB of the lambda.<br/>`metrics_namespace`: Namespace for the metrics emitted by the lambda.<br/>`name`: The name of the lambda function.<br/>`prefix`: The prefix used for naming resources.<br/>`role_path`: The path that will be added to the role, if not set the environment name will be used.<br/>`role_permissions_boundary`: Permissions boundary that will be added to the created role for the lambda.<br/>`runtime`: AWS Lambda runtime.<br/>`s3_bucket`: S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly.<br/>`s3_key`: S3 key for syncer lambda function. Required if using S3 bucket to specify lambdas.<br/>`s3_object_version`: S3 object version for syncer lambda function. Useful if S3 versioning is enabled on source bucket.<br/>`security_group_ids`: List of security group IDs associated with the Lambda function.<br/>`subnet_ids`: List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`.<br/>`tags`: Map of tags that will be added to created resources. By default resources will be tagged with name and environment.<br/>`timeout`: Time out of the lambda in seconds.<br/>`tracing_config`: Configuration for lambda tracing.<br/>`zip`: File location of the lambda zip file. | <pre>object({<br/> aws_partition = optional(string, "aws")<br/> architecture = optional(string, "arm64")<br/> environment_variables = optional(map(string), {})<br/> handler = string<br/> lambda_tags = optional(map(string), {})<br/> log_level = optional(string, "info")<br/> log_class = optional(string, "STANDARD")<br/> logging_kms_key_id = optional(string, null)<br/> logging_retention_in_days = optional(number, 180)<br/> memory_size = optional(number, 256)<br/> metrics_namespace = optional(string, "GitHub Runners")<br/> name = string<br/> prefix = optional(string, null)<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })), [])<br/> role_path = optional(string, null)<br/> role_permissions_boundary = optional(string, null)<br/> runtime = optional(string, "nodejs24.x")<br/> s3_bucket = optional(string, null)<br/> s3_key = optional(string, null)<br/> s3_object_version = optional(string, null)<br/> security_group_ids = optional(list(string), [])<br/> subnet_ids = optional(list(string), [])<br/> tags = optional(map(string), {})<br/> timeout = optional(number, 60)<br/> tracing_config = optional(object({<br/> mode = optional(string, null)<br/> capture_http_requests = optional(bool, false)<br/> capture_error = optional(bool, false)<br/> }), {})<br/> zip = optional(string, null)<br/> })</pre> | n/a | yes |
4343

4444
## Outputs
4545

modules/lambda/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ resource "aws_cloudwatch_log_group" "main" {
5656
name = "/aws/lambda/${aws_lambda_function.main.function_name}"
5757
retention_in_days = var.lambda.logging_retention_in_days
5858
kms_key_id = var.lambda.logging_kms_key_id
59+
log_group_class = var.lambda.log_class
5960
tags = var.lambda.tags
6061
}
6162

modules/lambda/variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ variable "lambda" {
1111
`log_level`: Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'.
1212
`logging_kms_key_id`: Specifies the kms key id to encrypt the logs with
1313
`logging_retention_in_days`: Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.
14+
`log_class`: The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`.
1415
`memory_size`: Memory size limit in MB of the lambda.
1516
`metrics_namespace`: Namespace for the metrics emitted by the lambda.
1617
`name`: The name of the lambda function.
@@ -35,6 +36,7 @@ variable "lambda" {
3536
handler = string
3637
lambda_tags = optional(map(string), {})
3738
log_level = optional(string, "info")
39+
log_class = optional(string, "STANDARD")
3840
logging_kms_key_id = optional(string, null)
3941
logging_retention_in_days = optional(number, 180)
4042
memory_size = optional(number, 256)

modules/multi-runner/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ module "multi-runner" {
145145
| <a name="input_lambda_security_group_ids"></a> [lambda\_security\_group\_ids](#input\_lambda\_security\_group\_ids) | List of security group IDs associated with the Lambda function. | `list(string)` | `[]` | no |
146146
| <a name="input_lambda_subnet_ids"></a> [lambda\_subnet\_ids](#input\_lambda\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
147147
| <a name="input_lambda_tags"></a> [lambda\_tags](#input\_lambda\_tags) | Map of tags that will be added to all the lambda function resources. Note these are additional tags to the default tags. | `map(string)` | `{}` | no |
148+
| <a name="input_log_class"></a> [log\_class](#input\_log\_class) | The log class of the CloudWatch log groups. Valid values are `STANDARD` or `INFREQUENT_ACCESS`. | `string` | `"STANDARD"` | no |
148149
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. | `string` | `"info"` | no |
149150
| <a name="input_logging_kms_key_id"></a> [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no |
150151
| <a name="input_logging_retention_in_days"></a> [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no |

modules/multi-runner/ami-housekeeper.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ module "ami_housekeeper" {
2424

2525
logging_retention_in_days = var.logging_retention_in_days
2626
logging_kms_key_id = var.logging_kms_key_id
27+
log_class = var.log_class
2728
log_level = var.log_level
2829

2930
role_path = var.role_path

0 commit comments

Comments
 (0)