serverless/serverless

CloudWatch Log Group - Don't Explicitly Include in CFT when no logRetentionInDays declared

Offen

#6.957 geöffnet am 13.11.2019

 (5 Kommentare) (3 Reaktionen) (0 zugewiesene Personen)JavaScript (5.734 Forks)batch import
cat/lambdaenhancementhelp wanted

Repository-Metriken

Stars
 (46.915 Sterne)
PR-Merge-Metriken
 (Durchschn. Merge 1T 15h) (34 gemergte PRs in 30 T)

Beschreibung

Feature Proposal

I propose avoiding including log groups in cloudformation templates unless required, as this is the standard that Amazon uses with their creation of log groups.

Description

The idea here is that it's generally a bad idea to delete existent log groups for the sake of long term audit. Clearly though, if a user declares logRetentionInDays then they do not wish to keep the logs long term and to make such a declaration via cloudformation, you need make an explicit declaration.

For example I would re-write https://github.com/serverless/serverless/blob/master/lib/plugins/aws/package/lib/mergeIamTemplates.js#L21-L42 as:

    this.serverless.service.getAllFunctions().forEach(functionName => {
      const functionObject = this.serverless.service.getFunction(functionName);
      const logGroupLogicalId = this.provider.naming.getLogGroupLogicalId(functionName);
      const newLogGroup = {
        [logGroupLogicalId]: {
          Type: 'AWS::Logs::LogGroup',
          Properties: {
            LogGroupName: this.provider.naming.getLogGroupName(functionObject.name),
          },
        },
      };

      const logRetentionInDays = this.provider.getLogRetentionInDays();
      if (logRetentionInDays) {
        newLogGroup[logGroupLogicalId].Properties.RetentionInDays = logRetentionInDays;
        _.merge(
          this.serverless.service.provider.compiledCloudFormationTemplate.Resources,
          newLogGroup
        );
      }
    });

Clearly there are a few more locations where such a change would be warranted, but this one is the clear example especially because a standard lambda function creates its own log groups implicitly at creation.

Contributor Guide