Manage global CloudWatch logs for Lambda@Edge

[ofhouse]

Motivation

Lambda@Edge creates new CloudWatch LogGroups in each region where it is deployed to.
But Terraform only creates a single LogGroup in the main region.
So no retention policy is assigned to all but the initial region where Terraform is run from.

Idea

Since it requires a lot of configuration overhead to perform resource creation across multiple AWS regions in Terraform, we should use a hybrid solution for this.
CloudFormation Stacks are capable of replicate resources across different AWS regions:

• Create CloudFormation template that contains the original CloudWatch Log Group
• Use CloudFormation Stacks to replicate the CloudWatch LogGroup (+Settings) across multiple regions.
• Provide preselection of regionsÏ based on the CloudFront PriceClass property (Price Class All ,Price Class 100, Price Class 200)

Goals

• Pre create CloudWatch Log Groups in different AWS regions for Lambda@Edge
• Destroy all created CloudWatch Log Groups in different regions on terraform destroy
• Create standalone Terraform module for it, that can be used with others, like AWS Lambda Terraform module

Resources

• CloudFormation stacks: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set

Related Issues

• Create Cloudwatch log groups for Lambda@Edge in each available region terraform-aws-modules/terraform-aws-lambda#265
• Logging permission for Lambda@Edge restricted to us-east-1 terraform-aws-modules/terraform-aws-lambda#34