Updates to Fargate logging resources (#271)

* Add  option for customizing container permissions

* Add app_name for clear log group naming

* Make policy name more clear

* Fix how we add perms together

* Fix how we add perms together

* Clean up policy arn code a bit

Author: ryanjjung

tb_pulumi/cloudwatch.py

@@ -18,6 +18,9 @@ class LogDestination(tb_pulumi.ThunderbirdComponentResource):
     with `Thunderbird logging guidelines
     <https://github.com/thunderbird/observability/blob/main/docs/rfc/application_logging/application_logging_guidelines.md>`_.
 
+    The name of the log group is constructed in the following way: ``/{org_name}/{stack_name}/{app_name}``. The first
+    segment will be left off if no org_name is provided.
+
     Produces the following ``resources``:
 
         - *key_alias* - `aws.kms.Alias <https://www.pulumi.com/registry/packages/aws/api-docs/kms/alias/>`_ used to name
@@ -40,6 +43,9 @@ class LogDestination(tb_pulumi.ThunderbirdComponentResource):
     :param project: The ``ThunderbirdPulumiProject`` to build monitoring resources for.
     :type project: tb_pulumi.ThunderbirdPulumiProject
 
+    :param app_name: Final part of the name of the log group. If no app_name is provided, the name of the project will
+        be used.
+
     :param log_group: Dict of inputs to an `aws.cloudwatch.LogGroup
         <https://www.pulumi.com/registry/packages/aws/api-docs/cloudwatch/loggroup/#inputs>`_. This class assumes some
         deviations from defaults, intended to comply with Thunderbird Pro Services internal logging guidelines. Inputs
@@ -82,6 +88,7 @@ def __init__(
         self,
         name: str,
         project: tb_pulumi.ThunderbirdPulumiProject,
+        app_name: str = None,
         log_group: dict = {},
         log_streams: dict = {},
         org_name: str = None,
@@ -98,11 +105,12 @@ def __init__(
             tags=tags,
         )
 
+        if not app_name:
+            app_name = self.project.project
+
         # Determine the log group's name before doing anything else; we need it for the key
         __log_group_name = (
-            f'/{org_name}/{self.project.stack}/{self.project.project}'
-            if org_name
-            else f'/{self.project.stack}/{self.project.project}'
+            f'/{org_name}/{self.project.stack}/{app_name}' if org_name else f'/{self.project.stack}/{app_name}'
         )
 
         # KMS Keys need policies to describe who can manage the keys and who can use them for encryption operations.
@@ -253,7 +261,7 @@ def __init__(
 
         __iam_policy_group_read = aws.iam.Policy(
             f'{self.project.name_prefix}-policy-read',
-            name=f'{self.project.name_prefix}-cloudwatch-group-read-access',
+            name=f'{self.project.name_prefix}-{app_name}-logs-read-access',
             description=__read_policy_description,
             path='/',
             policy=__iam_policy_group_read_doc,
@@ -265,7 +273,7 @@ def __init__(
         )
         __iam_policy_group_write = aws.iam.Policy(
             f'{self.project.name_prefix}-policy-write',
-            name=f'{self.project.name_prefix}-cloudwatch-group-write-access',
+            name=f'{self.project.name_prefix}-{app_name}-logs-write-access',
             description=__write_policy_description,
             path='/',
             policy=__iam_policy_group_write_doc,

tb_pulumi/fargate.py

@@ -91,6 +91,10 @@ class AutoscalingFargateCluster(tb_pulumi.ThunderbirdComponentResource):
       the only valid source. Defaults to {}.
     :type container_security_groups: _type_, optional
 
+    :param extra_policies: A dict where the keys are the names of services and the values are lists of ARNs of IAM
+      Policies that service should operate with in addition to what is provided by using the ``registries``,
+      ``secrets``, and ``ssm_params`` parameters.
+
     :param listeners: A nested dict describing your load balancers' listeners and which targets they point to. At the
       top level, the keys are names of load balancers and the values are other dicts. Those dicts' keys are the names of
       targets, and their values are inputs to an `aws.lb.Listener
@@ -169,6 +173,7 @@ def __init__(
         cluster: dict = {},
         cluster_name: str = None,
         container_security_groups: dict[str:dict] = {},
+        extra_policies: dict[str:list] = {},
         listeners: dict[str, dict] = {},
         load_balancer_security_groups: dict[str, dict] = {},
         load_balancers: dict = {},
@@ -275,21 +280,28 @@ def __init__(
         }
 
         # Build the execution roles using the policies from above, if they exist
-        exec_roles = {
-            service: aws.iam.Role(
+        exec_roles = {}
+
+        for service in services.keys():
+            _managed_policy_arns = [
+                # This AWS managed policy allows access to ECR and log streams
+                'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy',
+            ]
+            _managed_policy_arns += [
+                item
+                for item in [
+                    exec_role_policies[service] if service in exec_role_policies else None,
+                ]
+                if item is not None
+            ]
+            _managed_policy_arns += extra_policies.get(service, [])
+
+            exec_roles[service] = aws.iam.Role(
                 f'{name}-execrole-{service}',
                 name=f'{name}-{service}',
                 description=f'Task execution role for running the {service} service for {self.project.name_prefix}',
                 assume_role_policy=arp,
-                managed_policy_arns=[
-                    item
-                    for item in [
-                        # This AWS managed policy allows access to ECR and log streams
-                        'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy',
-                        exec_role_policies[service] if service in exec_role_policies else None,
-                    ]
-                    if item is not None
-                ],
+                managed_policy_arns=_managed_policy_arns,
                 tags=self.tags,
                 opts=pulumi.ResourceOptions(
                     parent=self,
@@ -300,8 +312,6 @@ def __init__(
                     ],
                 ),
             )
-            for service in services.keys()
-        }
 
         # First we build out task definitions. Later, we can refer to them by name. Since task definitions are
         # one-to-one with cluster services, the task_name here is assumed to match with a service name.