|
1 | 1 | import * as cdk from "aws-cdk-lib"; |
2 | 2 | import * as dynamodb from "aws-cdk-lib/aws-dynamodb"; |
3 | | -import * as cloudtrail from "aws-cdk-lib/aws-cloudtrail"; |
4 | | -import * as iam from "aws-cdk-lib/aws-iam"; |
5 | | -import * as s3 from "aws-cdk-lib/aws-s3"; |
6 | 3 | import { Construct } from "constructs"; |
7 | 4 |
|
8 | 5 | interface DatabaseProps extends cdk.NestedStackProps { |
@@ -78,89 +75,6 @@ export class Database extends cdk.NestedStack { |
78 | 75 | pointInTimeRecovery: true, |
79 | 76 | }); |
80 | 77 |
|
81 | | - /* |
82 | | - // S3 Bucket for DynamoDB Data Events CloudTrail Logging |
83 | | - const s3BucketDynamoDBCloudTrailLogging = new s3.Bucket( |
84 | | - this, |
85 | | - "s3BucketDynamoDBCloudTrailLogging", |
86 | | - { |
87 | | - encryption: s3.BucketEncryption.S3_MANAGED, |
88 | | - blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, |
89 | | - enforceSSL: true, |
90 | | - autoDeleteObjects: true, |
91 | | - removalPolicy: cdk.RemovalPolicy.DESTROY, |
92 | | - } |
93 | | - ); |
94 | | -
|
95 | | - const trailName = "ChatModeration-DynamoDB-DataEvents-Trail"; |
96 | | -
|
97 | | - const cloudTrailPrincipal = new iam.ServicePrincipal( |
98 | | - "cloudtrail.amazonaws.com" |
99 | | - ); |
100 | | -
|
101 | | - s3BucketDynamoDBCloudTrailLogging.addToResourcePolicy( |
102 | | - new iam.PolicyStatement({ |
103 | | - sid: "AllowGetBucketAcl", |
104 | | - effect: iam.Effect.ALLOW, |
105 | | - principals: [cloudTrailPrincipal], |
106 | | - actions: ["s3:GetBucketAcl"], |
107 | | - resources: [s3BucketDynamoDBCloudTrailLogging.bucketArn], |
108 | | - conditions: { |
109 | | - StringEquals: { |
110 | | - "AWS:SourceArn": `arn:aws:cloudtrail:${this.region}:${this.account}:trail/${trailName}`, |
111 | | - }, |
112 | | - }, |
113 | | - }) |
114 | | - ); |
115 | | -
|
116 | | - s3BucketDynamoDBCloudTrailLogging.addToResourcePolicy( |
117 | | - new iam.PolicyStatement({ |
118 | | - sid: "AllowPutObject", |
119 | | - effect: iam.Effect.ALLOW, |
120 | | - principals: [cloudTrailPrincipal], |
121 | | - actions: ["s3:PutObject"], |
122 | | - resources: [ |
123 | | - `arn:aws:s3:::${s3BucketDynamoDBCloudTrailLogging.bucketName}/AWSLogs/${this.account}/*`, |
124 | | - ], |
125 | | - conditions: { |
126 | | - StringEquals: { |
127 | | - "s3:x-amz-acl": "bucket-owner-full-control", |
128 | | - "AWS:SourceArn": `arn:aws:cloudtrail:${this.region}:${this.account}:trail/${trailName}`, |
129 | | - }, |
130 | | - }, |
131 | | - }) |
132 | | - ); |
133 | | -
|
134 | | - const cfnTrail = new cloudtrail.CfnTrail(this, "DynamoDBDataEventsTrail", { |
135 | | - isLogging: true, |
136 | | - s3BucketName: s3BucketDynamoDBCloudTrailLogging.bucketName, |
137 | | - trailName: trailName, |
138 | | - isMultiRegionTrail: false, |
139 | | - includeGlobalServiceEvents: false, |
140 | | - eventSelectors: [ |
141 | | - { |
142 | | - dataResources: [ |
143 | | - { |
144 | | - type: "AWS::DynamoDB::Table", |
145 | | - values: [ |
146 | | - approvedMessagesTable.tableArn, |
147 | | - unapprovedMessagesTable.tableArn, |
148 | | - hallucinationsTable.tableArn, |
149 | | - promptStoreTable.tableArn, |
150 | | - ], |
151 | | - }, |
152 | | - ], |
153 | | - includeManagementEvents: false, |
154 | | - readWriteType: "All", |
155 | | - }, |
156 | | - ], |
157 | | - }); |
158 | | -
|
159 | | - cfnTrail.addDependency( |
160 | | - s3BucketDynamoDBCloudTrailLogging.node.defaultChild as cdk.CfnResource |
161 | | - ); |
162 | | - */ |
163 | | - |
164 | 78 | // Outputs |
165 | 79 | this.approvedMessagesTableName = approvedMessagesTable.tableName; |
166 | 80 | new cdk.CfnOutput(this, "ApprovedMessagesTableName", { |
|
0 commit comments