FireLens(Fluent Bit)からCloudWatch Logsへログ送信に必要な最小権限のタスクロールを作成し動作検証してみた

AWSTemplateFormatVersion: "2010-09-09"
Description: Create Fargate*1, Firelens*1

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Common Settings
        Parameters:
          - ProjectName
          - Environment
      - Label:
          default: ECS VPC Settings
        Parameters:
          - VPCID
          - PublicSubnet1
          - PublicSubnet2
          - PrivateSubnet1
          - PrivateSubnet2

Parameters:
  ProjectName:
    Description: Project Name
    Type: String
    Default: unnamed
  Environment:
    Description: Environment
    Type: String
    Default: dev
    AllowedValues:
      - prod
      - dev
      - stg
      - test
  VPCID:
    Type: AWS::EC2::VPC::Id
  PublicSubnet1:
    Description: "Web App Subnet 1st"
    Type: AWS::EC2::Subnet::Id
  PublicSubnet2:
    Description: "Web App Subnet 2nd"
    Type: AWS::EC2::Subnet::Id
  PrivateSubnet1:
    Description: "ECS Subnet 1st"
    Type: AWS::EC2::Subnet::Id
  PrivateSubnet2:
    Description: "ECS Subnet 2nd"
    Type: AWS::EC2::Subnet::Id
  DesiredCount:
    Type: Number
    Default: 1
  ClusterName:
    Type: String
    Default: cluster
  AppName:
    Type: String
    Default: webapp
  ServiceName:
    Type: String
    Default: service
  TaskDefinitionName:
    Type: String
    Default: taskdefinition
  ImageNameWebApp:
    Description: "Web Application Repository Name also Need to TagName"
    Type: String
    Default: "public.ecr.aws/nginx/nginx:latest"
  ImageNameFirelens:
    Description: "Firelens Repository Name also Need to TagName"
    Type: String
    Default: "public.ecr.aws/aws-observability/aws-for-fluent-bit:latest"

Resources:
  # --------------------------------------------
  # ELB
  # --------------------------------------------
  ELB1:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: "application"
      Name: !Sub ${ProjectName}-${Environment}-elb
      Scheme: "internet-facing"
      SecurityGroups:
        - !Ref SecurityGroup2
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      IpAddressType: "ipv4"
      Tags:
        - Key: Name
          Value: !Sub ${ProjectName}-${Environment}-elb

  ELBListener1:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref TargetGroup1
          Type: "forward"
      LoadBalancerArn: !Ref ELB1
      Port: 80
      Protocol: "HTTP"

  TargetGroup1:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      VpcId: !Ref VPCID
      Name: !Sub ${ProjectName}-${Environment}-tg
      Protocol: "HTTP"
      HealthCheckPath: "/"
      Port: 80
      TargetType: ip
      HealthCheckIntervalSeconds: 10 # Default is 30.
      HealthyThresholdCount: 2 # Default is 5.
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 2
      TargetGroupAttributes:
        - Key: "stickiness.enabled"
          Value: "false"
        - Key: deregistration_delay.timeout_seconds
          Value: "60" # default is 300.
        - Key: "stickiness.type"
          Value: "lb_cookie"
        - Key: "stickiness.lb_cookie.duration_seconds"
          Value: "86400"
        - Key: "slow_start.duration_seconds"
          Value: "0"
        - Key: "load_balancing.algorithm.type"
          Value: "round_robin"

  # --------------------------------------------
  # CloudWatch Logs Group
  # --------------------------------------------
  # FireLens Stdout
  FireLensLogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      LogGroupName: !Sub "/ecs/logs/${ProjectName}-${Environment}-firelens"

  # --------------------------------------------
  # ECS Fargate
  # --------------------------------------------
  # Cluster
  ECSCluster:
    Type: "AWS::ECS::Cluster"
    Properties:
      ClusterName: !Sub "${ProjectName}-${Environment}-${ClusterName}"
      CapacityProviders:
        - "FARGATE_SPOT"
        - "FARGATE"

  # Service
  ECSService:
    Type: "AWS::ECS::Service"
    Properties:
      ServiceName: !Sub ${ProjectName}-${Environment}-${ServiceName}
      Cluster: !Ref ECSCluster
      LaunchType: "FARGATE"
      PlatformVersion: "1.4.0"
      DesiredCount: !Ref DesiredCount
      LoadBalancers:
        - TargetGroupArn: !Ref TargetGroup1
          ContainerName: !Ref AppName
          ContainerPort: 80
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: "DISABLED"
          SecurityGroups:
            - !Ref SecurityGroup1
          Subnets:
            - !Ref PrivateSubnet1
            - !Ref PrivateSubnet2
      TaskDefinition: !Ref ECSTaskDefinition
    DependsOn: ELBListener1
  # ECS TaskDefinition
  ECSTaskDefinition:
    Type: "AWS::ECS::TaskDefinition"
    Properties:
      Family: !Sub "${ProjectName}-${Environment}-${AppName}-${TaskDefinitionName}"
      TaskRoleArn: !GetAtt ECSTaskRole1.Arn
      ExecutionRoleArn: !GetAtt ECSTaskExecutionRole1.Arn
      NetworkMode: "awsvpc"
      RequiresCompatibilities:
        - "FARGATE"
      Cpu: "256"
      Memory: "512"
      ContainerDefinitions:
        - Essential: true
          Name: !Ref AppName
          Image: !Ref ImageNameWebApp
          LogConfiguration:
            LogDriver: "awsfirelens"
          PortMappings:
            - ContainerPort: 80
              HostPort: 80
              Protocol: "tcp"
        - Essential: true
          Name: "log_router"
          Image: !Ref ImageNameFirelens
          LogConfiguration:
            LogDriver: "awslogs"
            Options:
              awslogs-group: !Ref FireLensLogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: "firelens"
          FirelensConfiguration:
            Type: "fluentbit"
            Options:
              config-file-type: "file"
              config-file-value: "/fluent-bit/etc/extra.conf"
          User: "0"

  # --------------------------------------------
  # Security Group
  # --------------------------------------------
  # Security Group for WebApp
  SecurityGroup1:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${ProjectName}-${Environment}-${AppName}-sg
      GroupDescription: Web App Security Group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref SecurityGroup2
          Description: "Access from ELB"
      VpcId: !Ref VPCID
      Tags:
        - Key: Name
          Value: !Sub ${ProjectName}-${Environment}-${AppName}-sg
  # Security Group for ELB
  SecurityGroup2:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${ProjectName}-${Environment}-elb-sg
      GroupDescription: ELB Security Group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: "0.0.0.0/0"
          Description: "Access from Public"
      VpcId: !Ref VPCID
      Tags:
        - Key: Name
          Value: !Sub ${ProjectName}-${Environment}-elb-sg

  # --------------------------------------------
  # IAM Role
  # --------------------------------------------
  # ECS Task Execution Role
  ECSTaskExecutionRole1:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${ProjectName}-${Environment}-${AppName}-ECSTaskExecutionRole
      Path: "/"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
  # ECS Task Role
  ECSTaskRole1:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      RoleName: !Sub ${ProjectName}-${Environment}-${AppName}-ECSTaskRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Ref ECSExecPolicy
        - !Ref SentCloudWatchLogsPolicy

  # --------------------------------------------
  # IAM Policy
  # --------------------------------------------
  # Allowed ECS Exec for Task Role
  ECSExecPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: !Sub "${ProjectName}-${Environment}-ECSExecPolicy"
      Path: "/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - ssmmessages:CreateControlChannel
              - ssmmessages:CreateDataChannel
              - ssmmessages:OpenControlChannel
              - ssmmessages:OpenDataChannel
            Resource: "*"
  # Sent CloudWatch Logs for Task Role
  SentCloudWatchLogsPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: !Sub "${ProjectName}-${Environment}-SentCloudWatchLogsPolicy"
      Path: "/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:CreateLogGroup
              - logs:DescribeLogStreams
              - logs:PutLogEvents
            Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/ecs/logs/sample-test:*