Skip to content

P1 BAA logging stack — DRAFT for review. Wire into stacks/api/main.tf when approved.

New module: infra/modules/compliance-logging/

Creates: - KMS key for audit log encryption - S3 bucket ${name_prefix}-audit-logs-${account_id} (versioned, KMS SSE, 7-year lifecycle) - CloudTrail multi-region trail with log file validation + S3 data events on audit bucket - VPC Flow Logs → CloudWatch /vpc/${name_prefix}-flow-logs (2190-day retention)

Changes to infra/stacks/api/main.tf (add after compute module)

module "compliance_logging" {
  source = "../../modules/compliance-logging"

  name_prefix = local.name_prefix
  aws_region  = var.aws_region
  vpc_id      = module.network.vpc_id
  alb_arn     = module.compute.alb_arn
}

Changes to infra/modules/compute/main.tf

  1. ECS log retention — change retention_in_days = 30 → 2190 (~6 years)

  2. ALB access logs — add to aws_lb.this:

access_logs {
  bucket  = var.audit_logs_bucket
  prefix  = "alb"
  enabled = true
}

Add variable audit_logs_bucket (default "", set from compliance_logging output).

Changes to infra/modules/database/main.tf

  1. Parameter group — add to aws_db_parameter_group.this:
parameter {
  name         = "shared_preload_libraries"
  value        = "pg_stat_statements,pgaudit,pg_tle"
  apply_method = "pending-reboot"
}

parameter {
  name         = "pgaudit.log"
  value        = "all"
  apply_method = "pending-reboot"
}

parameter {
  name         = "log_statement"
  value        = "ddl"
  apply_method = "immediate"
}

parameter {
  name         = "log_connections"
  value        = "1"
  apply_method = "immediate"
}

parameter {
  name         = "log_disconnections"
  value        = "1"
  apply_method = "immediate"
}
  1. RDS instance — add:
enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
  1. CloudWatch log group for RDS exports with retention_in_days = 2190

Note: shared_preload_libraries change requires RDS reboot (maintenance window).

Estimated monthly cost impact

  • CloudTrail management events: low at current volume
  • VPC Flow Logs: ~$0.50/GB ingested
  • ALB access logs S3 storage: minimal at current traffic
  • CloudWatch 6-year retention on ECS + VPC + RDS logs: dominant cost driver vs today

Apply order (when approved)

  1. terraform apply compliance_logging module
  2. terraform apply compute (ALB access logs + ECS retention)
  3. terraform apply database (pgaudit + log exports) — schedule maintenance reboot
  4. Verify CloudTrail IsLogging=true, flow logs active, ALB logs landing in S3