HCP audit log streaming

• Terraform v1.1.5 or later. For the best experience, we recommend using the latest release
• HashiCorp Cloud Platform (HCP) Provider version 0.83.0 or higher

• Terraform v1.1.5 or later. For the best experience, we recommend using the latest release
• HashiCorp Cloud Platform (HCP) Provider version 0.86.0 or higher

• Terraform v1.1.5 or later. For the best experience, we recommend using the latest release
• HashiCorp Cloud Platform (HCP) Provider version 0.80.0 or higher

1. Create an AWS IAM role for HCP to stream to your Cloudwatch account.
2. Add an inline policy to the role with the required permissions.
3. Configure the hcp_log_streaming_destination resource in Terraform.
4. Update your infrastructure with Terraform.

To view the audit logs in AWS, go to the Cloudwatch service page. Click Log groups and then select /hashicorp/hcp/audit-logs/. Audit log entries appear in Cloudwatch after they occur on the HCP platform.

1. Create an API and optional application key.
2. Configure the hcp_log_streaming_destination resource in Terraform.
3. Update your infrastructure with Terraform.

To view the audit logs in Datadog, search service=HCP. Audit log entries appear in Datadog after they occur on the HCP platform.

1. Create an index named hcp-audit-logs.
2. Create and retrieve an HTTP Event Collector (HEC token).
3. Configure the hcp_log_streaming_destination resource in Terraform.
4. Update your infrastructure with Terraform.

To view the audit logs in Splunk Cloud, search "index=hcp-audit-logs". Audit log entries appear in Splunk after they occur on the HCP platform.

Create an IAM role for the audit logs with Terraform

To enable audit log streaming to Cloudwatch, you must create an IAM role in your AWS account that allows HashiCorp to stream audit logs to your account’s Cloudwatch service. You can create a role and attach a policy manually in the AWS Console, or you can create the resources with Terraform.

To create the role and policy with Terraform, add the following resources to your configuration:

resource "aws_iam_role" "cloudwatch_hcp_audit_logs" {
  name = "cloudwatch-hcp-audit-logs"
 assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::711430482607:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "hcp-log-stream"
        }
      }
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "hcp_log_streaming_policy" {
  name = "hcp_log_streaming_policy"
  role = aws_iam_role.cloudwatch_hcp_audit_logs.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "HCPLogStreaming",
      "Effect": "Allow",
      "Action": [
        "logs:PutLogEvents",
        "logs:DescribeLogStreams",
        "logs:DescribeLogGroups",
        "logs:CreateLogStream",
        "logs:CreateLogGroup"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

Run the following command to target these resources and apply them to your infrastructure with Terraform:

$ terraform apply -target "aws_iam_role.cloudwatch_hcp_audit_logs" -target "aws_iam_role_policy.hcp_log_streaming_policy"

Configure the hcp_log_streaming_destination resource

For your HCP organization, configure the hcp_log_streaming_destination resource with the ARN of the role you created and your external ID. If the log group you specify does not exist, Terraform will create it when the first log streams to Cloudwatch.

The following example demonstrates how to configure this resource:

resource "hcp_log_streaming_destination" "aws_cloudwatch" {
  name = "<cloudwatch-prod>"
  cloudwatch = {
    external_id       = "hcp-log-stream"
    region                  = "us-east-1"
    role_arn              = "arn:aws:iam::111111111:role/cloudwatch-hcp-audit-logs"
    log_group_name = "/hashicorp/hcp/audit-logs/"
  }
}

For more information about how to use role ARNs and log groups, refer to IAM identifiers and Working with log groups and streams in the AWS documentation.

Update your infrastructure with Terraform

After you configure the resource, run terraform apply to update your deployment. To target the resource you just created, run the following command:

$ terraform apply -target "aws_iam_role.cloudwatch_hcp_audit_logs" -target "aws_iam_role_policy.hcp_log_streaming_policy" -target "hcp_log_streaming_destination.aws_cloudwatch"

To view the audit logs, go to the Cloudwatch AWS service page. Click Log groups. Click /hashicorp/hcp/audit-logs/, and then click the log stream. Logs appear after you generate them.

Create an API or application key

To enable audit log streaming to Datadog, you must configure the Terraform provider with an API key and optional application key that identifies your unique Datadog organization. You can create these keys in "Organization settings" in Datadog.

Refer to API and Application Keys in the Datadog documentation for more information.

Configure the hcp_log_streaming_destination resource

For your HCP organization, configure the hcp_log_streaming_destination resource with the Datadog endpoint and your Datadog API key. The following example demonstrates this configuration:

resource "hcp_log_streaming_destination" "datadog" {
  name = "<datadog-prod>"
  datadog = {
    endpoint        = "https://http-intake.logs.datadoghq.com/api/v2/logs"
    api_key         = "<API_KEY_VALUE>"
  }
}

This example configures the Datadog endpoint with a Datadog endpoint for the US. For more information about formatting the Datadog endpoint for your specific region, refer to Access the Datadog site in the Datadog documentation.

Update your infrastructure with Terraform

After you configure the resource, run terraform apply to update your deployment. To target the resource you just created, run the following command:

$ terraform apply -target "hcp_log_streaming_destination.datadog"

To view audit logs, visit the Log Explorer on Datadog. You can search and filter logs from the HCP service. You can also apply filters by HCP organization or product. Logs appear after you generate them.

Create an audit log index

To enable audit log streaming to Splunk Cloud, you must assign an index to stream the logs to. If you do not have an index already, complete the following steps:

1. Click Settings and then Indexes.
2. At the top right, click New index.
3. Next to "Name," enter hcp-audit-logs.
4. Next to "Index Data Type," select Events.
5. Click Save.

Create and retrieve an HTTP Event Collector (HEC) token

Create an HEC token to use in the HCP Provider. Refer to Set up and use HTTP Event Collector in Splunk Web in the Splunk documentation for additional details and guidance.

1. Click Settings and then Data inputs.
2. Next to "HTTP Event Collector" click Add new.
3. Enter a name for your HEC token, such as hcp-log-stream. Then, click Next.
4. Assign the hcp-audit-logs index you created to your token. Then, click Review.
5. Click Submit to begin the token creation process. Wait until the page reloads for the token to be available.

To retrieve the token:

1. Click Settings and then Data inputs.
2. Click HTTP Event Collector.
3. Next to hcp-audit-logs, copy the alphanumeric string under Token value.

Configure the hcp_log_streaming_destination resource

For your HCP organization, configure the hcp_log_streaming_destination resource with the HEC token and your Splunk endpoint. The following example demonstrates this configuration:

resource "hcp_log_streaming_destination" "my_splunk_cloud" {
  name = "<splunk-cloud-prod>"
  splunk_cloud = {
  endpoint =   "<https://http-inputs-<tenant>.splunkcloud.com/services/collector/event>"
  token    = "<HEC-Token-Value>"
  }
}

For more information about how to format the URI for the HEC’s endpoint, refer to Send data to HTTP Event Collector in the Splunk documentation.

Update your infrastructure with Terraform

After you configure the resource, run terraform apply to update your deployment. To target the resource you just created, run the following command:

$ terraform apply -target "hcp_log_streaming_destination.my_splunk_cloud"

To view audit logs, search for your index on Splunk Cloud: hcp-audit-logs. Logs appear after you generate them.