From abe2c0fcd23f1adfcb6e3a7739811e2482e2d197 Mon Sep 17 00:00:00 2001
From: Melissa Greenbaum <69476188+magreenbaum@users.noreply.github.com>
Date: Sat, 18 Nov 2023 11:12:18 -0500
Subject: [PATCH] feat: Add `skip_destroy` to vpc flow log cloudwatch log group
 (#1009)

add skip_destroy to vpc flow log cloudwatch log group

Co-authored-by: magreenbaum <magreenbaum>
---
 README.md        | 1 +
 variables.tf     | 6 ++++++
 vpc-flow-logs.tf | 1 +
 3 files changed, 8 insertions(+)

diff --git a/README.md b/README.md
index 73c591304..caf1610f4 100644
--- a/README.md
+++ b/README.md
@@ -449,6 +449,7 @@ No modules.
 | <a name="input_flow_log_cloudwatch_log_group_name_prefix"></a> [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
 | <a name="input_flow_log_cloudwatch_log_group_name_suffix"></a> [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 | <a name="input_flow_log_cloudwatch_log_group_retention_in_days"></a> [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
+| <a name="input_flow_log_cloudwatch_log_group_skip_destroy"></a> [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
 | <a name="input_flow_log_destination_arn"></a> [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
 | <a name="input_flow_log_destination_type"></a> [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 | <a name="input_flow_log_file_format"></a> [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
diff --git a/variables.tf b/variables.tf
index 148ce3f19..8a20ba93e 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1572,6 +1572,12 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }
 
+variable "flow_log_cloudwatch_log_group_skip_destroy" {
+  description = " Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state"
+  type        = bool
+  default     = false
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
diff --git a/vpc-flow-logs.tf b/vpc-flow-logs.tf
index ac9f25758..127d7e016 100644
--- a/vpc-flow-logs.tf
+++ b/vpc-flow-logs.tf
@@ -48,6 +48,7 @@ resource "aws_cloudwatch_log_group" "flow_log" {
   name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id
+  skip_destroy      = var.flow_log_cloudwatch_log_group_skip_destroy
 
   tags = merge(var.tags, var.vpc_flow_log_tags)
 }