AWS Shipper Terraform Module for SNS Integration

Overview

Changed in v4.3.5

Our latest AWS integration provides the easiest way to connect with Coralogix. By using a predefined Lambda function, you can seamlessly send AWS logs and events to your Coralogix subscription for detailed analysis, monitoring, and troubleshooting.

SNS configuration

Name	Description	Type	Default	Required
sns_topic_name	The SNS topic containing the SNS subscription. You need this only when using the SNS integration.	string	n/a	yes
sns_topic_filter	Map of filters to add to the SNS topic Lambda subscription.	map(any)	n/a	no
sns_topic_filter_policy_scope	The scope of the filter policy for the SNS topic Lambda subscription, could be MessageAttributes or MessageBody	string	n/a	no
create_sns_topic_policy	Whether to create and manage the SNS topic policy. Set to false if you want to manage the policy yourself and preserve existing permissions.	bool	true	no

Configuration examples

SNS (default)

module "coralogix-shipper-sns" {
  source = "coralogix/aws/coralogix//modules/coralogix-aws-shipper"

  coralogix_region  = "EU1"
  integration_type  = "Sns"
  api_key           = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXX"
  application_name  = "sns-application"
  subsystem_name    = "sns-subsystem"
  sns_topic_name    = "sns-topic-name"
  ]
}

SNS with a filter policy by account-id

module "coralogix-shipper-sns-with-filter" {
  source = "coralogix/aws/coralogix//modules/coralogix-aws-shipper"

  coralogix_region  = "EU1"
  integration_type  = "Sns"
  api_key           = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXX"
  application_name  = "sns-application"
  subsystem_name    = "sns-subsystem"
  sns_topic_name    = "sns-topic-name"
  sns_topic_filter_scope = "MessageBody"
  sns_topic_filter_policy = {
    "account-id" = ["123456789012"]
  }
}

Name	Description	Type	Default	Required
coralogix_region	The Coralogix location region, available options: [EU1, EU2, AP1, AP2, AP3, US1, US2, Custom]	string	n/a	yes
custom_domain	If using a custom domain name for your private cluster, Coralogix will send telemetry from the specified address (e.g. custom.coralogix.com). There is no need to add ingress. to the domain.	string	n/a	no
integration_type	The AWS service to integrate with Coralogix. Possible values: S3, CloudTrail, VpcFlow, CloudWatch, S3Csv, SNS, SQS, Kinesis, CloudFront, MSK, Kafka, EcrScan.	string	S3	yes
api_key	The Coralogix Send Your Data - API key validates your authenticity. This value can be a direct Coralogix API key or an AWS secret manager ARN containing the API key. Required for metrics, REST logs, and direct Coralogix OTLP; leave empty for Collector OTLP.	string	n/a	yes
store_api_key_in_secrets_manager	Enable this to store your API key securely. Otherwise, it will remain exposed in plain text as an environment variable in the Lambda function console.	bool	true	no
log_export_protocol	Log delivery protocol when telemetry_mode is logs: coralogix_rest (default) or otlp_grpc. Ignored for metrics.	string	coralogix_rest	no
otlp_endpoint	Optional Collector http:// or https:// origin for otlp_grpc. Empty selects direct Coralogix OTLP; non-empty selects unauthenticated Collector delivery.	string	""	no
otlp_headers	Optional semicolon-separated key=value pairs sent as gRPC metadata on every export to otlp_endpoint, e.g. x-api-key=value;tenant=name. Collector route only; the direct Coralogix routes ignore it. Requires shipper 1.5.0 or later. Sensitive.	string	""	no
disable_log_severity_detection	Disable keyword-based severity detection for logs. When true, logs use protocol-level Info severity without modifying the original log body. Ignored for metrics.	bool	false	no
application_name	The name of your application. For a dynamic value, use $.my_log.field. This option is not supported since version 1.1.0 for the source code	string	n\a	yes
subsystem_name	The name of your subsystem. For a dynamic value, use $.my_log.field for CloudWatch log group leave empty. This option is not supported since version 1.1.0 for the source code	string	n\a	yes

When telemetry_mode is logs, three export routes are available (matching the shipper CloudFormation template):

1. Coralogix REST (default): log_export_protocol = "coralogix_rest".
2. Direct Coralogix OTLP/gRPC: log_export_protocol = "otlp_grpc" with empty otlp_endpoint (uses coralogix_region/custom_domain and api_key).
3. Collector OTLP/gRPC: log_export_protocol = "otlp_grpc" with a non-empty otlp_endpoint (no Coralogix API key).

OTLP routes require a shipper binary that supports them; pin source_code_version after that shipper release is published.

For a gateway in front of the Collector that authenticates with its own header, set otlp_headers (shipper 1.5.0 or later). It applies to Collector logs and traces only, and plan fails if source_code_version is pinned below 1.5.0 while it is in use. Keys must be lowercase a-z, 0-9, _, ., - and values printable ASCII; the shipper rejects anything else at startup. The variable is sensitive, which hides it from plan output, but the value is still stored in plaintext in Terraform state and in the Lambda's environment variables, so protect state accordingly.

Traces

telemetry_mode = "traces" forwards AWS CloudWatch Transaction Search spans from the aws/spans log group to Coralogix as traces over OTLP/gRPC. It gives trace coverage for AWS-managed services that cannot be instrumented directly - Step Functions, API Gateway, AppSync - with no application code changes.

Requires shipper 1.4.16 or later - a pinned source_code_version below that is refused, since earlier binaries do not recognise the mode and ship spans as log lines. Enable Transaction Search and X-Ray tracing on the services you want traced, then:

telemetry_mode   = "traces"
integration_type = "CloudWatch"
log_groups       = ["aws/spans"]

As with logs, an empty otlp_endpoint sends direct to Coralogix and a non-empty one sends through a Collector, which is what makes traces work from a lambda in a private subnet.

Traces mode fails at plan time on a non-CloudWatch integration_type, log_groups other than ["aws/spans"], an S3, SNS, Kinesis, Kafka or MSK trigger, enable_dlq, or direct delivery without an api_key or without a custom_domain when coralogix_region = "Custom". integration_info is not supported - traces has a single log group, so configure it with the top-level variables.

Running in a VPC is supported. With an empty otlp_endpoint the lambda resolves the public ingress.<domain>, so the subnets need egress to it - a NAT gateway or an equivalent route. Otherwise set otlp_endpoint to a Collector reachable from the VPC.

Known limitation: AWS records service.name only on the root span of a trace, so child spans arrive unnamed. Traces render correctly - structure, timings, errors and stacktraces are intact - but service-level views are incomplete. See the shipper README.

For additional configuration options, please refer to our main Terraform documentation.