Terraform を使用して New Relic One と AWS アカウントを連携する

terraform {
  required_providers {
    newrelic = {
      source  = "newrelic/newrelic"
      version = "2.41.1"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "4.6.0"
    }
  }
  required_version = "1.1.6"
}

provider "newrelic" {
  account_id = var.account_id
  api_key    = var.api_key
  region     = "US"
}

provider "aws" {
  region = "ap-northeast-1"
}

variable "newrelic_account_id" {}

variable "api_key" {}

resource "aws_iam_role" "newrelic_integrations" {
 name               = "NewRelicInfrastructure-Integrations"
 assume_role_policy = data.aws_iam_policy_document.newrelic_integrations.json
}

data "aws_iam_policy_document" "newrelic_integrations" {
 statement {
   actions = ["sts:AssumeRole"]
   effect  = "Allow"

   condition {
     test = "StringEquals"
     // NewRelic AccountID
     values   = var.newrelic_account_id
     variable = "sts:ExternalID"
   }

   principals {
     identifiers = [var.another_aws_account_id]
     type        = "AWS"
   }
 }
}

resource "aws_iam_role_policy_attachment" "read_only_access" {
 policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
 role       = aws_iam_role.newrelic_integrations.id
}

resource "aws_iam_role_policy" "view_budget_access" {
  name   = "view-budget-access"
  policy = data.aws_iam_policy_document.budget_access.json
  role   = aws_iam_role.newrelic_integrations.id
}

data "aws_iam_policy_document" "budget_access" {
 statement {
   actions   = ["budgets:ViewBudget"]
   effect    = "Allow"
   resources = ["*"]
 }
 version = "2012-10-17"
}

variable "another_aws_account_id" {
  type     = string
  default = <Another AWS Account ID>
}

resource "newrelic_cloud_aws_link_account" "example" {
  account_id             = <連携する New Relic のアカウントID>
  arn                    = aws_iam_role.newrelic_integrations.arn
  #PULL の場合は API polling になり PUSH の場合は Metric Streams での転送設定になります。
  metric_collection_mode = "PULL" or "PUSH"
  name                   = "<set your name>"

  # IAM Role や Policy を先に作成しないと実際に連携する際に権限不足になってしまうので作成するまで待つようにします。
  depends_on = [
    aws_iam_role.newrelic_integrations,
    data.aws_iam_policy_document.budget_access,
    data.aws_iam_policy_document.newrelic_integrations,
    aws_iam_role_policy_attachment.read_only_access
  ]
}

$ terraform init

$ terraform plan

$ terraform apply 
# 以下の実行を許可するコメントが出てくるので yes と入力して実行してください。
Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes