Adding-CF-S3-logging

roles/aws/aws_ami_asg_cleanup/tasks/main.yml

@@ -29,9 +29,9 @@
     dest: "{{ _ce_provision_build_dir }}/clean_up_ami.zip"
     format: zip
 
-- name: Sleep for 100 seconds for IAM before Lambda creation
+- name: Sleep for 30 seconds for IAM before Lambda creation
   ansible.builtin.wait_for:
-    timeout: 100
+    timeout: 30
 
 - name: Create Lambda function
   amazon.aws.lambda:

roles/aws/aws_cloudfront_distribution/defaults/main.yml

@@ -1,30 +1,4 @@
 ---
-# Uncomment cf_acl to create firewall rules for Cloudfront distro
-#rate_limit: 600 # rate_limit needs to be standalone variable to avoid casting issues (it will be considrate as string instead of int)
-#cf_acl:
-#  acl_name: "dummy_master_acl"
-#  scope: "CLOUDFRONT" # Can be "REGIONAL"
-#  region: "us-east-1" # If scope is set to CLOUDFRONT, region must be us-east-1, even though docs say it will be skipped
-#
-#  ip_allow
-#    name: "Allowed-ips"
-#    list:
-#    - 1.1.1.1/32
-#    - 2.2.2.2/32
-#    - 3.3.3.3/32
-#
-#  ip_block:
-#    name: "Blocked-ips"
-#    list:
-#    - 4.4.4.4/32
-#    - 5.5.5.5/32
-#    - 6.6.6.6/32
-#
-#  cc_block_list:
-#    - BY # Belarus
-#    - CN # China
-#    - IR # Iran
-#    - SA # Saudi Arabia
 aws_cloudfront_distribution:
   aws_profile: "{{ _aws_profile }}"
   region: "{{ _aws_region }}"
@@ -87,8 +61,3 @@ aws_cloudfront_distribution:
   cache_behaviors: [] # A list of cache behaviors same as default_cache_behavior with additional path_pattern var required.
   enabled: true
   purge_existing: true # Set to false to append entries instead of replacing them.
-#  logging:
-#    bucket: "" # URL of S3 bucket to store logs
-#    enabled: false # Set true to allow logging
-#    include_cookies: false # Set true to add cookies in logs
-#    prefix: "" # Prefix for S3 object names

roles/aws/aws_cloudfront_distribution/tasks/main.yml

@@ -6,6 +6,27 @@
     - aws_acl is defined
     - aws_acl.scope == 'CLOUDFRONT'
 
+# Creating bucket for CF logging
+- name: Create S3 bucket if it does not exist
+  amazon.aws.s3_bucket:
+    name: "{{ _domain_name }}-cf-log"
+    state: present
+    object_ownership: "BucketOwnerPreferred"
+
+- name: Create S3 bucket prefix
+  amazon.aws.s3_object:
+    bucket: "{{ _domain_name }}-cf-log"
+    object: "cf-logging/"
+    mode: "create"
+
+- name: Creating dictionary for CF logging
+  ansible.builtin.set_fact:
+    _cf_s3_log:
+      bucket: "{{ _domain_name }}-cf-log.s3.amazonaws.com" # URL of S3 bucket to store logs
+      enabled: true # Set true to allow logging
+      include_cookies: false # Set true to add cookies in logs
+      prefix: "cf-logging/" # Prefix for S3 object names
+
 - name: Create a CloudFront distribution.
   community.aws.cloudfront_distribution:
     profile: "{{ aws_cloudfront_distribution.aws_profile }}"
@@ -22,7 +43,7 @@
     purge_origins: "{{ aws_cloudfront_distribution.purge_existing }}"
     purge_aliases: "{{ aws_cloudfront_distribution.purge_existing }}"
     purge_tags: "{{ aws_cloudfront_distribution.purge_existing }}"
-    logging: "{{ aws_cloudfront_distribution.logging | default(omit) }}"
+    logging: "{{ _cf_s3_log }}"
     purge_cache_behaviors: "{{ aws_cloudfront_distribution.purge_existing }}"
     enabled: "{{ aws_cloudfront_distribution.enabled }}"
-  register: _aws_cloudfront_distribution
+  register: _aws_cloudfront_distribution