Route logs from Google Cloud Platform

locals {
  // Email address of your Chronosphere Logs tenant-specific principal.
  chronosphere_sa_email = "gcp-logs-TENANT@chronosphere-production-b.iam.gserviceaccount.com"

  // Google Cloud project containing logging data to be ingested into
  // Observability Platform.
  logging_project_id = "PROJECT_ID"

  // Organization ID of the Google Cloud organization containing the project.
  org_id = "ORGANIZATION_ID"
}

// Creates Pub/Sub topic for logging sink.
resource "google_pubsub_topic" "main" {
  name    = "logging_sink"
  project = local.project_id
}

// Creates a new logging sink.
resource "google_logging_organization_sink" "main" {
  org_id           = local.org_id
  name             = "all_logs_sink"
  destination      = "pubsub.googleapis.com/${google_pubsub_topic.main.id}"
  include_children = true
}

// Grants sink permission to roles so they can write to the Pub/Sub topic.
data "google_iam_policy" "topic" {
  binding {
    role = "roles/pubsub.publisher"
    members = [
      google_logging_organization_sink.main.writer_identity,
    ]
  }
}

// Binds the role to a new topic.
resource "google_pubsub_topic_iam_policy" "main" {
  project     = local.project_id
  topic       = google_pubsub_topic.main.name
  policy_data = data.google_iam_policy.topic.policy_data
}

// Creates a new Pub/Sub subscription.
resource "google_pubsub_subscription" "main" {
  name    = "all_logs_sink"
  project = local.project_id
  topic   = google_pubsub_topic.main.name

  message_retention_duration = "23h"
  ack_deadline_seconds = 60

  retry_policy {
    minimum_backoff = "10s"
  }

  enable_message_ordering    = false
  enable_exactly_once_delivery = false
}

// Creates a policy granting the new Chronosphere logs service account access to
// the subscription.
data "google_iam_policy" "subscription" {
  binding {
    role = "roles/pubsub.viewer"
    members = [
      google_service_account.chronosphere_logs.member
    ]
  }

  binding {
    role    = "roles/pubsub.subscriber"
    members = [
      google_service_account.chronosphere_logs.member
    ]
  }
}

// Binds the new policy to the subscription.
resource "google_pubsub_subscription_iam_policy" "main" {
  project      = local.project_id
  subscription = google_pubsub_subscription.main.name
  policy_data  = data.google_iam_policy.subscription.policy_data
}

// Service account that lets an Observability Platform tenant-specific principal
// to impersonate it.
resource "google_service_account" "chronosphere_logs" {
  project    = local.project_id
  account_id = "chronosphere-logs"
}

// The service account provides the Observability Platform tenant-specific principal with
// roles/iam.serviceAccountTokenCreator access so that it can impersonate it. Only
// the Observability Platform tenant-specific principal can perform this
// impersonation.
data "google_iam_policy" "chronosphere_logs" {
  binding {
    role    = "roles/iam.serviceAccountTokenCreator"
    members = ["serviceAccount:${local.chronosphere_sa_email}"]
  }
}

// Assigns the token creator permission to the service account.
resource "google_service_account_iam_policy" "chronosphere_logs" {
  service_account_id = google_service_account.chronosphere_logs.name
  policy_data        = data.google_iam_policy.chronosphere_logs.policy_data
}