{ "//": { "metadata": { "backend": "local", "stackName": "CloudCollectorV3Stack", "version": "0.23.3" }, "outputs": {} }, "data": { "aws_caller_identity": { "operata_cfl_account_main_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_account_main_prod", "uniqueId": "operata_cfl_account_main_prod" } } } }, "aws_iam_policy_document": { "operata_cfl_decoder_lambda_assumerole_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_decoder_lambda_assumerole_prod", "uniqueId": "operata_cfl_decoder_lambda_assumerole_prod" } }, "statement": [ { "actions": [ "sts:AssumeRole" ], "effect": "Allow", "principals": [ { "identifiers": [ "lambda.amazonaws.com" ], "type": "Service" } ] } ] }, "operata_cfl_logs_to_kinesis_assumerole_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_logs_to_kinesis_assumerole_prod", "uniqueId": "operata_cfl_logs_to_kinesis_assumerole_prod" } }, "statement": [ { "actions": [ "sts:AssumeRole" ], "effect": "Allow", "principals": [ { "identifiers": [ "logs.${var.aws_region}.amazonaws.com" ], "type": "Service" } ] } ] } } }, "provider": { "aws": [ { "region": "${var.aws_region}" } ] }, "resource": { "aws_cloudwatch_event_api_destination": { "operata_cfl_api_destination_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_api_destination_prod", "uniqueId": "operata_cfl_api_destination_prod" } }, "connection_arn": "${aws_cloudwatch_event_connection.operata_cfl_connection_prod.arn}", "description": "API destination for sending CFL data to Operata for the ${var.connect_instance_friendly_name} Amazon Connect instance", "http_method": "POST", "invocation_endpoint": "https://api.operata.io/v2/raw/cflogs", "name": "operataCFLEndpointGroup-${var.operata_group_id}" } }, "aws_cloudwatch_event_connection": { "operata_cfl_connection_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_connection_prod", "uniqueId": "operata_cfl_connection_prod" } }, "auth_parameters": { "api_key": { "key": "Operata-API-Key", "value": "${aws_secretsmanager_secret_version.operata_api_key_secret_version_prod.secret_string}" }, "invocation_http_parameters": { "header": [ { "is_value_secret": false, "key": "Operata-Group-Id", "value": "${var.operata_group_id}" } ] } }, "authorization_type": "API_KEY", "description": "EventBridge connection for transmitting CFL events to Operata for the ${var.connect_instance_friendly_name} Amazon Connect instance", "name": "operataCFLAPIgroup-${var.operata_group_id}" } }, "aws_cloudwatch_log_group": { "operata_cfl_pipe_log_group_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_log_group_prod", "uniqueId": "operata_cfl_pipe_log_group_prod" } }, "name": "/aws/pipes/OperataEventsPipe-${var.connect_instance_friendly_name}-ContactFlowLogs", "retention_in_days": 7 } }, "aws_cloudwatch_log_subscription_filter": { "operata_cfl_subscription_filter_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_subscription_filter_prod", "uniqueId": "operata_cfl_subscription_filter_prod" } }, "destination_arn": "${aws_kinesis_stream.operata_cfl_kinesis_stream_prod.arn}", "filter_pattern": "", "log_group_name": "${var.cf_log_group}", "name": "operata_cfl_subscription_filter_prod", "role_arn": "${aws_iam_role.operata_cfl_logs_to_kinesis_role_prod.arn}" } }, "aws_iam_role": { "operata_cfl_decoder_lambda_role_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_decoder_lambda_role_prod", "uniqueId": "operata_cfl_decoder_lambda_role_prod" } }, "assume_role_policy": "${data.aws_iam_policy_document.operata_cfl_decoder_lambda_assumerole_prod.json}", "inline_policy": [ { "name": "operata_cfl_decoder_lambda_policy_prod", "policy": "${jsonencode({\"Statement\" = [{\"Effect\" = \"Allow\", \"Action\" = [\"logs:CreateLogGroup\", \"logs:CreateLogStream\", \"logs:PutLogEvents\"], \"Resource\" = \"*\"}, {\"Effect\" = \"Allow\", \"Action\" = [\"secretsmanager:GetSecretValue\"], \"Resource\" = aws_secretsmanager_secret_version.operata_api_key_secret_version_prod.arn}, {\"Effect\" = \"Allow\", \"Action\" = [\"secretsmanager:GetSecretValue\", \"secretsmanager:PutSecretValue\", \"secretsmanager:DescribeSecret\"], \"Resource\" = aws_secretsmanager_secret_version.redaction_policy_cache_secret_version_prod.arn}], \"Version\" = \"2012-10-17\"})}" } ], "name": "operata_cfl_decoder_lambda_role_prod" }, "operata_cfl_event_bridge_pipe_role_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_event_bridge_pipe_role_prod", "uniqueId": "operata_cfl_event_bridge_pipe_role_prod" } }, "assume_role_policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"sts:AssumeRole\", \"Condition\" = {\"StringEquals\" = {\"aws:SourceAccount\" = data.aws_caller_identity.operata_cfl_account_main_prod.account_id}}, \"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"pipes.amazonaws.com\"}}], \"Version\" = \"2012-10-17\"})}" }, "operata_cfl_logs_to_kinesis_role_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_logs_to_kinesis_role_prod", "uniqueId": "operata_cfl_logs_to_kinesis_role_prod" } }, "assume_role_policy": "${data.aws_iam_policy_document.operata_cfl_logs_to_kinesis_assumerole_prod.json}", "description": "Role for CloudWatch Logs to write Contact Flow Logs to Kinesis stream", "name": "operata_cfl_logs_to_kinesis_role_prod" } }, "aws_iam_role_policy": { "operata_cfl_logs_to_kinesis_policy_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_logs_to_kinesis_policy_prod", "uniqueId": "operata_cfl_logs_to_kinesis_policy_prod" } }, "name": "operata_cfl_logs_to_kinesis_policy_prod", "policy": "${jsonencode({\"Statement\" = [{\"Action\" = [\"kinesis:PutRecord\", \"kinesis:PutRecords\", \"kinesis:DescribeStream\"], \"Effect\" = \"Allow\", \"Resource\" = aws_kinesis_stream.operata_cfl_kinesis_stream_prod.arn}], \"Version\" = \"2012-10-17\"})}", "role": "${aws_iam_role.operata_cfl_logs_to_kinesis_role_prod.id}" }, "operata_cfl_pipe_api_destination_policy_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_api_destination_policy_prod", "uniqueId": "operata_cfl_pipe_api_destination_policy_prod" } }, "name": "APIDestinationPolicy-Operata-CFL-GroupId-${var.operata_group_id}", "policy": "${jsonencode({\"Statement\" = [{\"Action\" = [\"events:InvokeApiDestination\"], \"Effect\" = \"Allow\", \"Resource\" = aws_cloudwatch_event_api_destination.operata_cfl_api_destination_prod.arn}], \"Version\" = \"2012-10-17\"})}", "role": "${aws_iam_role.operata_cfl_event_bridge_pipe_role_prod.id}" }, "operata_cfl_pipe_kinesis_source_policy_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_kinesis_source_policy_prod", "uniqueId": "operata_cfl_pipe_kinesis_source_policy_prod" } }, "name": "KinesisPipeSourcePolicy-Operata-CFL-GroupId-${var.operata_group_id}", "policy": "${jsonencode({\"Statement\" = [{\"Action\" = [\"kinesis:DescribeStream\", \"kinesis:DescribeStreamSummary\", \"kinesis:GetRecords\", \"kinesis:GetShardIterator\", \"kinesis:ListStreams\", \"kinesis:ListShards\"], \"Effect\" = \"Allow\", \"Resource\" = aws_kinesis_stream.operata_cfl_kinesis_stream_prod.arn}], \"Version\" = \"2012-10-17\"})}", "role": "${aws_iam_role.operata_cfl_event_bridge_pipe_role_prod.id}" }, "operata_cfl_pipe_lambda_policy_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_lambda_policy_prod", "uniqueId": "operata_cfl_pipe_lambda_policy_prod" } }, "name": "LambdaEnrichmentPolicy-Operata-CFL-GroupId-${var.operata_group_id}", "policy": "${jsonencode({\"Statement\" = [{\"Action\" = [\"lambda:InvokeFunction\"], \"Effect\" = \"Allow\", \"Resource\" = aws_lambda_function.operata_cfl_decoder_lambda_prod.arn}], \"Version\" = \"2012-10-17\"})}", "role": "${aws_iam_role.operata_cfl_event_bridge_pipe_role_prod.id}" }, "operata_cfl_pipe_logs_policy_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_logs_policy_prod", "uniqueId": "operata_cfl_pipe_logs_policy_prod" } }, "name": "PipeLogsPolicy-Operata-CFL-GroupId-${var.operata_group_id}", "policy": "${jsonencode({\"Statement\" = [{\"Action\" = [\"logs:CreateLogStream\", \"logs:PutLogEvents\"], \"Effect\" = \"Allow\", \"Resource\" = aws_cloudwatch_log_group.operata_cfl_pipe_log_group_prod.arn}], \"Version\" = \"2012-10-17\"})}", "role": "${aws_iam_role.operata_cfl_event_bridge_pipe_role_prod.id}" } }, "aws_kinesis_stream": { "operata_cfl_kinesis_stream_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_kinesis_stream_prod", "uniqueId": "operata_cfl_kinesis_stream_prod" } }, "encryption_type": "KMS", "kms_key_id": "alias/aws/kinesis", "name": "operata_cfl_kinesis_stream_prod", "stream_mode_details": { "stream_mode": "ON_DEMAND" } } }, "aws_lambda_function": { "operata_cfl_decoder_lambda_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_decoder_lambda_prod", "uniqueId": "operata_cfl_decoder_lambda_prod" } }, "description": "Lambda function to decompress gzip-compressed CloudWatch Logs data from Kinesis for the ${var.connect_instance_friendly_name} environment", "environment": { "variables": { "BUILD_VERSION": "v1.2.6", "LOG_LEVEL": "INFO", "OPERATA_API_KEY": "${aws_secretsmanager_secret_version.operata_api_key_secret_version_prod.arn}", "OPERATA_API_URL": "https://api.operata.io", "OPERATA_GROUP_ID": "${var.operata_group_id}", "OPERATA_REDACTION_CACHE_SECRET_ARN": "${aws_secretsmanager_secret_version.redaction_policy_cache_secret_version_prod.arn}" } }, "function_name": "operata_cfl_decoder_lambda_prod", "handler": "index.lambda_handler", "memory_size": 256, "role": "${aws_iam_role.operata_cfl_decoder_lambda_role_prod.arn}", "runtime": "python3.13", "s3_bucket": "${var.aws_region}-operata-shared-assets-prod", "s3_key": "ccv3-lambdas/v1.2.6/cloud-collector-v3-contact-flow-logs.zip", "timeout": 30 } }, "aws_lambda_permission": { "operata_cfl_pipe_lambda_invoke_permission_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_lambda_invoke_permission_prod", "uniqueId": "operata_cfl_pipe_lambda_invoke_permission_prod" } }, "action": "lambda:InvokeFunction", "function_name": "${aws_lambda_function.operata_cfl_decoder_lambda_prod.function_name}", "principal": "pipes.amazonaws.com", "statement_id": "AllowEventBridgePipeInvoke" } }, "aws_pipes_pipe": { "operata_cfl_pipe_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_cfl_pipe_prod", "uniqueId": "operata_cfl_pipe_prod" } }, "description": "Pipe for sending CFL records to Operata (group ID: ${var.operata_group_id}) from the ${var.connect_instance_friendly_name} environment in ${var.aws_region}", "enrichment": "${aws_lambda_function.operata_cfl_decoder_lambda_prod.arn}", "enrichment_parameters": { "input_template": "{\"data\": <$.data>}" }, "log_configuration": { "cloudwatch_logs_log_destination": { "log_group_arn": "${aws_cloudwatch_log_group.operata_cfl_pipe_log_group_prod.arn}" }, "include_execution_data": [ "ALL" ], "level": "ERROR" }, "name": "OperataEventsPipe-${var.connect_instance_friendly_name}-ContactFlowLogs", "role_arn": "${aws_iam_role.operata_cfl_event_bridge_pipe_role_prod.arn}", "source": "${aws_kinesis_stream.operata_cfl_kinesis_stream_prod.arn}", "source_parameters": { "kinesis_stream_parameters": { "batch_size": 1, "maximum_record_age_in_seconds": -1, "maximum_retry_attempts": -1, "starting_position": "LATEST" } }, "target": "${aws_cloudwatch_event_api_destination.operata_cfl_api_destination_prod.arn}" } }, "aws_secretsmanager_secret": { "operata_api_key_secret_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_api_key_secret_prod", "uniqueId": "operata_api_key_secret_prod" } }, "description": "Operata API token for CFL Lambda (redaction config fetch)", "name": "/cloud-collector-v3/cfl/apiToken-prod" }, "redaction_policy_cache_secret_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/redaction_policy_cache_secret_prod", "uniqueId": "redaction_policy_cache_secret_prod" } }, "description": "Raw redaction policy response from the Operata API; used as a fallback when the API is unavailable", "name": "/cloud-collector-v3/cfl/redactionPolicyCache-prod" } }, "aws_secretsmanager_secret_version": { "operata_api_key_secret_version_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/operata_api_key_secret_version_prod", "uniqueId": "operata_api_key_secret_version_prod" } }, "secret_id": "${aws_secretsmanager_secret.operata_api_key_secret_prod.id}", "secret_string": "${var.operata_api_key}" }, "redaction_policy_cache_secret_version_prod": { "//": { "metadata": { "path": "CloudCollectorV3Stack/redaction_policy_cache_secret_version_prod", "uniqueId": "redaction_policy_cache_secret_version_prod" } }, "secret_id": "${aws_secretsmanager_secret.redaction_policy_cache_secret_prod.id}", "secret_string": "{}" } } }, "terraform": { "backend": { "local": { "path": "terraform.CloudCollectorV3Stack.tfstate" } }, "required_providers": { "aws": { "source": "aws", "version": "5.100.0" } } }, "variable": { "aws_region": { "description": "AWS Region where this stack will be created", "type": "string" }, "cf_log_group": { "description": "CloudWatch Log group on which a Kinesis subscription filter is added by this stack", "type": "string" }, "connect_instance_friendly_name": { "description": "The friendly name of your Amazon Connect instance for ease of reference (i.e. Dev, Prod, UAT). Alphanumeric, no spaces.", "type": "string" }, "operata_api_key": { "description": "API key generated in the Operata console", "sensitive": true, "type": "string" }, "operata_group_id": { "description": "Operata Group ID provided by Operata", "type": "string" } } }