feat(collection): export log groups (#104)

* fix(subscriber): correct ARN validation for IAM role

Our logic was busted. It was passing tests because the test fixture had
a lambda ARN instead. Provide fix and add a new test for the happy path
of a firehose ARN alongside the role ARN.

* feat(collection): export log groups

Add static subscriptions for the log groups we do create. This should
not clash with the subscriber module since the filter name is set to
match (`observe-logs-subscription`).

apps/collection/template.yaml

@@ -213,7 +213,6 @@ Resources:
         TopicARN: !Ref Topic
   Firehose:
     Type: AWS::Serverless::Application
-    Condition: EnableSubscriber
     Properties:
       Location: ../firehose/template.yaml
       NotificationARNs:
@@ -223,6 +222,34 @@ Resources:
         Prefix: "cloudwatchlogs/"
         WriterRoleService: "logs.amazonaws.com"
         NameOverride: !Ref NameOverride
+  ForwarderLogGroupSubscription:
+    Type: AWS::Logs::SubscriptionFilter
+    Properties:
+      DestinationArn: !GetAtt
+        - Firehose
+        - Outputs.Firehose
+      FilterName: 'observe-logs-subscription'
+      FilterPattern: ''
+      LogGroupName: !GetAtt
+        - Forwarder
+        - Outputs.LogGroupName
+      RoleArn: !GetAtt
+        - Firehose
+        - Outputs.WriterRole
+  FirehoseLogGroupSubscription:
+    Type: AWS::Logs::SubscriptionFilter
+    Properties:
+      DestinationArn: !GetAtt
+        - Firehose
+        - Outputs.Firehose
+      FilterName: 'observe-logs-subscription'
+      FilterPattern: ''
+      LogGroupName: !GetAtt
+        - Firehose
+        - Outputs.LogGroupName
+      RoleArn: !GetAtt
+        - Firehose
+        - Outputs.WriterRole
   Subscriber:
     Type: AWS::Serverless::Application
     Condition: EnableSubscriber
@@ -241,6 +268,22 @@ Resources:
         LogGroupNamePrefixes: !Join [",", !Ref LogGroupNamePrefixes]
         LogGroupNamePatterns: !Join [",", !Ref LogGroupNamePatterns]
         NameOverride: !Ref NameOverride
+  SubscriberLogGroupSubscription:
+    Type: AWS::Logs::SubscriptionFilter
+    Condition: EnableSubscriber
+    Properties:
+      DestinationArn: !GetAtt
+        - Firehose
+        - Outputs.Firehose
+      FilterName: 'observe-logs-subscription'
+      FilterPattern: ''
+      LogGroupName: !GetAtt
+        - Subscriber
+        - Outputs.LogGroupName
+      RoleArn: !GetAtt
+        - Firehose
+        - Outputs.WriterRole
+
 Outputs:
   Bucket:
     Description: "S3 Bucket Name"

apps/firehose/template.yaml

@@ -172,3 +172,6 @@ Outputs:
       - CreateWriterRole
       - !GetAtt 'WriterRole.Arn'
       - ''
+  LogGroupName:
+    Description: "Log Group Name"
+    Value: !Ref LogGroup

apps/forwarder/template.yaml

@@ -290,3 +290,6 @@ Outputs:
   Role:
     Description: "IAM Role ARN"
     Value: !GetAtt Role.Arn
+  LogGroupName:
+    Description: "Log Group Name"
+    Value: !Ref LogGroup

apps/subscriber/template.yaml

@@ -212,3 +212,6 @@ Outputs:
   Function:
     Description: "Lambda Function ARN"
     Value: !GetAtt Subscriber.Arn
+  LogGroupName:
+    Description: "Log Group Name"
+    Value: !Ref LogGroup