playbook.aws-cloudwatch-agent.yml

---
- hosts: fcos
  gather_facts: false

  vars_files:
    - external_vars.yml

  tasks:

  ##########
  # Amazon CloudWatch Agent
  ##########

  - name: Make CloudWatch directory
    become: yes
    file:
      path: /var/home/core/cloudwatch-agent
      state: directory

  - name: Create CloudWatch Dockerfile
    become: yes
    copy:
      dest: /var/home/core/cloudwatch-agent/Dockerfile
      content: |
        FROM debian:latest

        RUN apt-get update &&  \
            apt-get install -y ca-certificates curl && \
            rm -rf /var/lib/apt/lists/*

        RUN curl -O https://s3.amazonaws.com/amazoncloudwatch-agent/debian/amd64/latest/amazon-cloudwatch-agent.deb && \
            dpkg -i -E amazon-cloudwatch-agent.deb && \
            rm -rf /tmp/* && \
            rm -rf /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard && \
            rm -rf /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl && \
            rm -rf /opt/aws/amazon-cloudwatch-agent/bin/config-downloader && \
            rm /amazon-cloudwatch-agent.deb && \
            mkdir -p /opt/aws/amazon-cloudwatch-agent/bin

        COPY default_linux_config.json /opt/aws/amazon-cloudwatch-agent/bin/default_linux_config.json
        COPY default_linux_config.json /etc/cwagentconfig

        ENV RUN_IN_CONTAINER="True"
        ENTRYPOINT ["/opt/aws/amazon-cloudwatch-agent/bin/start-amazon-cloudwatch-agent"]

  - name: Create CloudWatch Configuration File
    become: yes
    copy:
      dest: /var/home/core/cloudwatch-agent/default_linux_config.json
      content: |
        {
            "logs": {
                "logs_collected": {
                    "files": {
                        "collect_list": [{
                                "file_path": "/var/log/audit/audit.log",
                                "log_group_name": "audit",
                                "log_stream_name": "{instance_id}",
                                "timestamp_format": "%H: %M: %S%y%b%-d"
                        }]
                    }
                },
                "log_stream_name": "default_stream"
            }
        }

  - name: Install docker package
    become: yes
    pip:
      executable: /usr/bin/pip3
      extra_args: --user
      name: docker
      state: present

  - name: Build CloudWatch Agent Image
    become: yes
    docker_image:
      build:
        path: /var/home/core/cloudwatch-agent
        pull: no
      name: dva/cloudwatch-agent
      tag: '1.0'
      source: build

  - name: Start CloudWatch agent container
    become: yes
    command: docker run --detach --volume /var/log/audit:/var/log/audit:z dva/cloudwatch-agent:1.0