Step 1 - Create the parent account destination instance

Follow Provisioning an IBM Cloud Logs instance by using Terraform to create the instance in the enterprise parent account. The instance will not receive platform logs until the child accounts are configured to send their logs to the instance.

Step 2 - Create parent authorization policies

Create an Cloud Identity and Access Management (IAM) service to service authorization policy in the parent account for each of your child accounts. In this example there are two child accounts.

# FILE: parent/main.tf

terraform {
  required_version = ">= 0.13"
  required_providers {
    ibm = {
      source  = "ibm-cloud/ibm"
      version = "~>1.88.3"
    }
  }
}

variable "ibmcloud_api_key" {
  description = "The IBM Cloud API key."
  type        = string
  sensitive   = true
}

provider "ibm" {
  ibmcloud_api_key = var.ibmcloud_api_key
}

locals {
  child_accounts = [
    "<INPUT_CHILD_A_ACCOUNT_ID>",
    "<INPUT_CHILD_B_ACCOUNT_ID>"
  ]
}

resource "ibm_iam_authorization_policy" "cross_account_policy" {
  for_each = toset(local.child_accounts)
  source_service_name         = "logs-router"
  source_service_account      = each.key
  target_service_name         = "logs"
  target_resource_instance_id = "<INPUT_PARENT_LOGS_INSTANCE_ID>"
  roles                       = ["Sender"]
  description                 = "Authorize enterprise child account routing to the parent"
}

This step ensures IBM® Cloud Logs Routing is authorized to route child A and child B account platform logs to parent account.

Step 3 - Create enterprise targets in child accounts

Next, you need to create IBM® Cloud Logs Routing enterprise targets in each child account, the target destination is the parent account's IBM Cloud Logs instance. In this example, there are only two child accounts, but there is no limitation to the number of child accounts that can be targeted to a single parent account.

Note the managed_by = "enterprise" parameter below.

# NEW FILE: child_a/main.tf

terraform {
  required_version = ">= 0.13"
  required_providers {
    ibm = {
      source  = "ibm-cloud/ibm"
      version = "~>1.88.3"
    }
  }
}

variable "ibmcloud_api_key" {
  description = "The IBM Cloud API key."
  type        = string
  sensitive   = true
}

provider "ibm" {
  ibmcloud_api_key = var.ibmcloud_api_key
}

resource "ibm_logs_router_settings" "logs_router_settings" {
  primary_metadata_region = "<INPUT_LOGS_ROUTING_REGION>"
}

resource "ibm_logs_router_target" "logs_router_target" {
  destination_crn = "<INPUT_PARENT_CLOUD_LOGS_CRN>"
  name            = "child-a-target"
  managed_by      = "enterprise"
}

# NEW FILE: child_b/main.tf

terraform {
  required_version = ">= 0.13"
  required_providers {
    ibm = {
      source  = "ibm-cloud/ibm"
      version = "~>1.81.0"
    }
  }
}

variable "ibmcloud_api_key" {
  description = "The IBM Cloud API key."
  type        = string
  sensitive   = true
}

provider "ibm" {
  ibmcloud_api_key = var.ibmcloud_api_key
}

resource "ibm_logs_router_settings" "logs_router_settings" {
  primary_metadata_region = "<INPUT_LOGS_ROUTING_REGION>"
}

resource "ibm_logs_router_target" "logs_router_target" {
  destination_crn = "<INPUT_PARENT_CLOUD_LOGS_CRN>"
  name            = "child-b-target"
  managed_by      = "enterprise"
}

This step creates IBM® Cloud Logs Routing enterprise targets pointing to the parent IBM Cloud Logs instance. Routing is not yet enabled.

Step 4 - Create enterprise routes in the child accounts

Create IBM® Cloud Logs Routing enterprise routes in each child account. You can route all platform logs to the parent or a subset of platform logs to the parent. In this example, child A and child B accounts will route all platform logs to the parent.

See IBM Cloud services that generate platform logs.

# FILE: child_a/main.tf

# Previous steps...

resource "ibm_logs_router_route" "logs_router_route" {
  lifecycle {
    create_before_destroy = true
  }
  name       = "child-a-route"
  managed_by = "enterprise"

  # Route all platform logs to the hub.
  rules {
    action = "send"
    targets {
      id = ibm_logs_router_target.logs_router_target.id
    }
  }
}

# FILE: child_b/main.tf

# Previous steps...

resource "ibm_logs_router_route" "logs_router_route" {
  lifecycle {
    create_before_destroy = true
  }
  name       = "child-b-route"
  managed_by = "enterprise"

  # Route all platform logs to the hub.
  rules {
    action = "send"
    targets {
      id = ibm_logs_router_target.logs_router_target.id
    }
  }
}

This step creates the IBM® Cloud Logs Routing enterprise routes. Platform logs will be routed to the parent IBM Cloud Logs instance.

Step 5 - Restrict enterprise actions with IAM Action Control

Now that the enterprise-managed routing is created, you must restrict the usage of IBM® Cloud Logs Routing enterprise actions so that the enterprise-managed routing cannot be modified by any entity. In this example, there is only one version of the action control template and it is assigned to each individual Account instead of the entire Enterprise or an Account Group.

In order to make changes to the enterprise-managed routing, you must delete the action control assignments.

# FILE: parent/main.tf

# Previous steps...

resource "ibm_iam_action_control_template" "logs_router_enterprise_action_control_template" {
  name = "Logs Router Enterprise Routing"
  description = "Restrict Logs Router enterprise-managed routing"
  action_control {
    actions = [
      "logs-router.enterprise-target.create",
      "logs-router.enterprise-target.update",
      "logs-router.enterprise-target.delete",
      "logs-router.enterprise-route.create",
      "logs-router.enterprise-route.update",
      "logs-router.enterprise-route.delete"
    ]
    service_name = "logs-router"
  }
  committed = "true"
}

locals {
  child_accounts = [
    "<INPUT_CHILD_A_ACCOUNT_ID>",
    "<INPUT_CHILD_B_ACCOUNT_ID>"
  ]
}

resource "ibm_iam_action_control_assignment" "logs_router_enterprise_action_control_assignment" {
  for_each = toset(local.child_accounts)
  target = {
    type = "Account"
    id   = each.key
  }
  templates {
    id      = ibm_iam_action_control_template.logs_router_enterprise_action_control_template.template_id
    version = ibm_iam_action_control_template.logs_router_enterprise_action_control_template.version
  }
}

This step ensures IBM® Cloud Logs Routing enterprise actions are restricted from further use, locking the enterprise-managed routing.

Optional Step 6 - Account-managed routing

Optionally, you can create account-managed routing in the enterprise child accounts or parent account; it will not conflict with the enterprise-managed routing created earlier. To create account-managed routing, ensure that the IBM® Cloud Logs Routing target and route configurations have managed_by = "account".