feat: setup Cost and Usuage Report module

.github/workflows/tf-apply.yml

@@ -60,7 +60,7 @@ jobs:
             role: cds-aws-lz-apply
 
           - account_folder: org_account
-            module: billing_extract_tags
+            module: cost_usage_report
             account: 659087519042
             role: cds-aws-lz-apply
 

.github/workflows/tf-drift-check.yml

@@ -41,7 +41,7 @@ jobs:
             role: cds-aws-lz-plan
 
           - account_folder: org_account
-            module: billing_extract_tags
+            module: cost_usage_report
             account: 659087519042
             role: cds-aws-lz-plan
 

.github/workflows/tf-plan.yml

@@ -56,7 +56,7 @@ jobs:
             role: cds-aws-lz-plan
 
           - account_folder: org_account
-            module: billing_extract_tags
+            module: cost_usage_report
             account: 659087519042
             role: cds-aws-lz-plan
 

terragrunt/org_account/cost_usage_report/import.tf

@@ -0,0 +1,49 @@
+import {
+  to = aws_cloudwatch_event_rule.billing_extract_tags
+  id = "default/billing_extract_tags_daily"
+}
+
+import {
+  to = aws_cloudwatch_event_target.billing_extract_tags
+  id = "billing_extract_tags_daily/terraform-20240305180415483500000002"
+}
+
+import {
+  to = aws_iam_role.billing_extract_tags
+  id = "BillingExtractTags"
+}
+
+import {
+  to = aws_iam_policy.billing_extract_tags
+  id = "arn:aws:iam::659087519042:policy/BillingExtractTags"
+}
+
+import {
+  to = aws_iam_role_policy_attachment.billing_extract_tags
+  id = "BillingExtractTags/arn:aws:iam::659087519042:policy/BillingExtractTags"
+}
+
+import {
+  to = aws_iam_role_policy_attachment.org_read_only
+  id = "BillingExtractTags/arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess"
+}
+
+import {
+  to = aws_iam_role_policy_attachment.lambda_insights
+  id = "BillingExtractTags/arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+}
+
+import {
+  to = aws_lambda_function.billing_extract_tags
+  id = "billing_extract_tags"
+}
+
+import {
+  to = aws_lambda_permission.billing_extract_tags
+  id = "billing_extract_tags/AllowBillingExtractTagsDaily"
+}
+
+import {
+  to = aws_cloudwatch_log_group.billing_extract_tags
+  id = "/aws/lambda/billing_extract_tags"
+}

terragrunt/org_account/cost_usage_report/s3.tf

@@ -0,0 +1,134 @@
+#
+# Cost and usage report
+#
+module "cost_usage_report" {
+  source      = "github.com/cds-snc/terraform-modules//S3?ref=v9.6.8"
+  bucket_name = "cds-cost-usage-report"
+
+  versioning = {
+    enabled = true
+  }
+
+  billing_tag_value = var.billing_code
+}
+
+resource "aws_s3_bucket_policy" "cost_usage_report" {
+  bucket = module.cost_usage_report.s3_bucket_id
+  policy = data.aws_iam_policy_document.cost_usage_report.json
+}
+
+data "aws_iam_policy_document" "cost_usage_report" {
+  statement {
+    sid    = "EnableAWSDataExportsToWriteToS3AndCheckPolicy"
+    effect = "Allow"
+    principals {
+      type = "Service"
+      identifiers = [
+        "bcm-data-exports.amazonaws.com",
+        "billingreports.amazonaws.com"
+      ]
+    }
+    actions = [
+      "s3:PutObject",
+      "s3:GetBucketPolicy"
+    ]
+    resources = [
+      module.cost_usage_report.s3_bucket_arn,
+      "${module.cost_usage_report.s3_bucket_arn}/*"
+    ]
+    condition {
+      test     = "StringLike"
+      variable = "aws:SourceArn"
+      values = [
+        "arn:aws:cur:us-east-1:659087519042:definition/*",
+        "arn:aws:bcm-data-exports:us-east-1:659087519042:export/*"
+      ]
+    }
+    condition {
+      test     = "StringLike"
+      variable = "aws:SourceAccount"
+      values   = ["659087519042"]
+    }
+  }
+
+  statement {
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::066023111852:root"]
+    }
+    actions = [
+      "s3:ListMultipartUploadParts",
+      "s3:ListBucketMultipartUploads",
+      "s3:ListBucket",
+      "s3:GetObject",
+      "s3:GetBucketLocation",
+      "s3:AbortMultipartUpload"
+    ]
+    resources = [
+      module.cost_usage_report.s3_bucket_arn,
+      "${module.cost_usage_report.s3_bucket_arn}/*"
+    ]
+  }
+}
+
+#
+# Account billing tags
+#
+module "billing_extract_tags" {
+  source      = "github.com/cds-snc/terraform-modules//S3?ref=v9.6.8"
+  bucket_name = "cds-account-billing-extract-tags"
+  acl         = null
+
+  versioning = {
+    enabled = true
+  }
+
+  billing_tag_value = var.billing_code
+}
+
+resource "aws_s3_bucket_policy" "billing_extract_tags" {
+  bucket = module.billing_extract_tags.s3_bucket_id
+  policy = data.aws_iam_policy_document.billing_extract_tags_bucket.json
+}
+
+data "aws_iam_policy_document" "billing_extract_tags_bucket" {
+  statement {
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_role.billing_extract_tags.arn]
+    }
+    actions = [
+      "s3:PutObject*",
+      "s3:ListBucket",
+      "s3:GetObject*",
+      "s3:DeleteObject*",
+      "s3:GetBucketLocation"
+    ]
+    resources = [
+      module.billing_extract_tags.s3_bucket_arn,
+      "${module.billing_extract_tags.s3_bucket_arn}/*",
+    ]
+  }
+
+  statement {
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::066023111852:root"]
+    }
+    actions = [
+      "s3:GetBucketLocation",
+      "s3:GetObject",
+      "s3:ListBucket",
+      "s3:ListBucketMultipartUploads",
+      "s3:ListMultipartUploadParts",
+      "s3:AbortMultipartUpload"
+    ]
+    resources = [
+      module.billing_extract_tags.s3_bucket_arn,
+      "${module.billing_extract_tags.s3_bucket_arn}/*",
+    ]
+  }
+}