CloudWatch Log Group - Don't Explicitly Include in CFT when no logRetentionInDays declared
#6.957 geöffnet am 13.11.2019
Repository-Metriken
- Stars
- (46.915 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 1T 15h) (34 gemergte PRs in 30 T)
Beschreibung
Feature Proposal
I propose avoiding including log groups in cloudformation templates unless required, as this is the standard that Amazon uses with their creation of log groups.
Description
The idea here is that it's generally a bad idea to delete existent log groups for the sake of long term audit. Clearly though, if a user declares logRetentionInDays then they do not wish to keep the logs long term and to make such a declaration via cloudformation, you need make an explicit declaration.
For example I would re-write https://github.com/serverless/serverless/blob/master/lib/plugins/aws/package/lib/mergeIamTemplates.js#L21-L42 as:
this.serverless.service.getAllFunctions().forEach(functionName => {
const functionObject = this.serverless.service.getFunction(functionName);
const logGroupLogicalId = this.provider.naming.getLogGroupLogicalId(functionName);
const newLogGroup = {
[logGroupLogicalId]: {
Type: 'AWS::Logs::LogGroup',
Properties: {
LogGroupName: this.provider.naming.getLogGroupName(functionObject.name),
},
},
};
const logRetentionInDays = this.provider.getLogRetentionInDays();
if (logRetentionInDays) {
newLogGroup[logGroupLogicalId].Properties.RetentionInDays = logRetentionInDays;
_.merge(
this.serverless.service.provider.compiledCloudFormationTemplate.Resources,
newLogGroup
);
}
});
Clearly there are a few more locations where such a change would be warranted, but this one is the clear example especially because a standard lambda function creates its own log groups implicitly at creation.