Skip to content

Commit f1ebb8d

Browse files
create module
1 parent bca03ea commit f1ebb8d

File tree

4 files changed

+270
-78
lines changed

4 files changed

+270
-78
lines changed
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
module "sns_cloudwatch" {
6+
source = "../"
7+
name = "capture-aws-sign-in"
8+
description = "Capture each AWS Console Sign In"
9+
target_id = "SendToSNS"
10+
}
11+
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Terraform version
2+
terraform {
3+
required_version = ">= 0.14.11"
4+
5+
required_providers {
6+
aws = {
7+
source = "hashicorp/aws"
8+
version = ">= 3.1.15"
9+
}
10+
}
11+
}
12+

terraform-aws-sns/main.tf

Lines changed: 56 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -1,93 +1,71 @@
1-
## Managed By : S3CloudHub
2-
## Description : This Script is used to create SNS Platform Application, SNS Topic, Topic Subscription and Sms Preferences.
3-
## Copyright @ S3CloudHub. All Right Reserved.
1+
provider "aws" {
2+
region = var.region
3+
}
44

5-
#Module : label
6-
#Description : This terraform module is designed to generate consistent label names and
7-
# tags for resources. You can use terraform-labels to implement a strict
8-
# naming convention.
9-
module "labels" {
10-
source = "F:/Office_Work/git-clone-easyaws/Terraform-Tutorial\terraform-aws-sns"
11-
version = "0.15.0"
5+
resource "aws_cloudwatch_event_rule" "default" {
6+
count = var.enabled == true ? 1 : 0
127

13-
name = var.name
14-
repository = var.repository
15-
environment = var.environment
16-
managedby = var.managedby
17-
attributes = var.attributes
18-
label_order = var.label_order
8+
name = var.name
9+
description = var.description
10+
event_pattern = <<EOF
11+
{
12+
"detail-type": [
13+
"AWS Console Sign In via CloudTrail"
14+
]
15+
}
16+
EOF
17+
role_arn = var.role_arn
18+
is_enabled = var.is_enabled
1919
}
2020

21-
#Module : SNS
22-
#Description : Terraform module is used to setup SNS service to manage notifications on
23-
# application.
24-
resource "aws_sns_platform_application" "default" {
25-
count = var.enabled && var.enable_sns ? 1 : 0
26-
27-
name = module.labels.id
28-
platform = var.platform
29-
platform_credential = length(var.gcm_key) > 0 ? var.gcm_key : file(var.key)
30-
platform_principal = length(var.gcm_key) > 0 ? var.gcm_key : file(var.certificate)
31-
event_delivery_failure_topic_arn = var.event_delivery_failure_topic_arn
32-
event_endpoint_created_topic_arn = var.event_endpoint_created_topic_arn
33-
event_endpoint_deleted_topic_arn = var.event_endpoint_deleted_topic_arn
34-
event_endpoint_updated_topic_arn = var.event_endpoint_updated_topic_arn
35-
failure_feedback_role_arn = var.failure_feedback_role_arn
36-
success_feedback_role_arn = var.success_feedback_role_arn
37-
success_feedback_sample_rate = var.success_feedback_sample_rate
21+
resource "aws_cloudwatch_event_target" "default" {
22+
count = var.enabled == true ? 1 : 0
23+
rule = aws_cloudwatch_event_rule.default.*.name[0]
24+
target_id = var.target_id
25+
arn = aws_sns_topic.this[count.index].arn
26+
input_path = var.input_path != "" ? var.input_path : null
27+
role_arn = var.target_role_arn
3828
}
3929

40-
#Module : SNS TOPIC
41-
#Description : Terraform module which creates SNS Topic resources on AWS
42-
#tfsec:ignore:aws-sns-enable-topic-encryption
43-
resource "aws_sns_topic" "default" {
44-
count = var.enabled && var.enable_topic ? 1 : 0
30+
resource "aws_sns_topic" "this" {
31+
count = var.enabled ? 1 : 0
4532

46-
name = module.labels.id
47-
display_name = var.display_name
48-
policy = var.policy
49-
delivery_policy = var.delivery_policy
50-
application_success_feedback_role_arn = var.application_success_feedback_role_arn
51-
application_success_feedback_sample_rate = var.application_success_feedback_sample_rate
52-
application_failure_feedback_role_arn = var.application_failure_feedback_role_arn
53-
http_success_feedback_role_arn = var.http_success_feedback_role_arn
54-
http_success_feedback_sample_rate = var.http_success_feedback_sample_rate
55-
http_failure_feedback_role_arn = var.http_failure_feedback_role_arn
56-
kms_master_key_id = var.kms_master_key_id
57-
lambda_success_feedback_role_arn = var.lambda_success_feedback_role_arn
58-
lambda_success_feedback_sample_rate = var.lambda_success_feedback_sample_rate
59-
lambda_failure_feedback_role_arn = var.lambda_failure_feedback_role_arn
60-
sqs_success_feedback_role_arn = var.sqs_success_feedback_role_arn
61-
sqs_success_feedback_sample_rate = var.sqs_success_feedback_sample_rate
62-
sqs_failure_feedback_role_arn = var.sqs_failure_feedback_role_arn
63-
tags = module.labels.tags
33+
name = var.snsname
34+
display_name = var.display_name
35+
kms_master_key_id = var.kms_master_key_id
36+
delivery_policy = var.delivery_policy
37+
fifo_topic = var.fifo_topic
38+
content_based_deduplication = var.content_based_deduplication
6439
}
6540

66-
#Module : SNS TOPIC SUBSCRIPTION
67-
#Description : Terraform module which creates SNS Topic Subscription resources on AWS
6841
resource "aws_sns_topic_subscription" "this" {
69-
for_each = var.subscribers
70-
topic_arn = join("", aws_sns_topic.default.*.arn)
71-
protocol = var.subscribers[each.key].protocol
72-
endpoint = var.subscribers[each.key].endpoint
73-
endpoint_auto_confirms = var.subscribers[each.key].endpoint_auto_confirms
74-
raw_message_delivery = var.subscribers[each.key].raw_message_delivery
75-
filter_policy = var.subscribers[each.key].filter_policy
76-
delivery_policy = var.subscribers[each.key].delivery_policy
77-
confirmation_timeout_in_minutes = var.subscribers[each.key].confirmation_timeout_in_minutes
42+
for_each = var.enabled ? var.subscribers : {}
7843

44+
topic_arn = join("", aws_sns_topic.this.*.arn)
45+
protocol = var.subscribers[each.key].protocol
46+
endpoint = var.subscribers[each.key].endpoint
47+
endpoint_auto_confirms = var.subscribers[each.key].endpoint_auto_confirms
48+
raw_message_delivery = var.subscribers[each.key].raw_message_delivery
7949
}
8050

51+
resource "aws_sns_topic_policy" "default" {
52+
count = var.sns_topic_policy_enabled ? 1 : 0
8153

82-
#Module : SNS SMS Preferences
83-
#Description : Terraform module which creates SNS SMS Preferences on AWS
84-
resource "aws_sns_sms_preferences" "default" {
85-
count = var.enabled && var.enable_sms_preference ? 1 : 0
86-
87-
monthly_spend_limit = var.monthly_spend_limit
88-
delivery_status_iam_role_arn = var.delivery_status_iam_role_arn
89-
delivery_status_success_sampling_rate = var.delivery_status_success_sampling_rate
90-
default_sender_id = var.default_sender_id
91-
default_sms_type = var.default_sms_type
92-
usage_report_s3_bucket = var.usage_report_s3_bucket
54+
arn = aws_sns_topic.this[count.index].arn
55+
policy = data.aws_iam_policy_document.sns_topic_policy[count.index].json
9356
}
57+
58+
data "aws_iam_policy_document" "sns_topic_policy" {
59+
count = var.sns_topic_policy_enabled ? 1 : 0
60+
statement {
61+
effect = "Allow"
62+
actions = ["SNS:Publish"]
63+
64+
principals {
65+
type = "Service"
66+
identifiers = ["events.amazonaws.com"]
67+
}
68+
69+
resources = [aws_sns_topic.this[count.index].arn]
70+
}
71+
}

terraform-aws-sns/variable.tf

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
variable "region" {
2+
type = string
3+
default = "eu-west-1"
4+
}
5+
6+
variable "enabled" {
7+
type = bool
8+
default = true
9+
}
10+
11+
variable "sns_topic_policy_enabled" {
12+
type = bool
13+
default = true
14+
}
15+
16+
variable "display_name" {
17+
type = string
18+
default = ""
19+
}
20+
21+
variable "name" {
22+
type = string
23+
default = ""
24+
description = "Name (e.g. `app` or `cluster`)."
25+
}
26+
27+
variable "description" {
28+
type = string
29+
default = ""
30+
description = "The description for the rule."
31+
}
32+
33+
variable "role_arn" {
34+
type = string
35+
default = ""
36+
description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
37+
}
38+
39+
variable "is_enabled" {
40+
type = bool
41+
default = true
42+
description = "Whether the rule should be enabled (defaults to true)."
43+
}
44+
45+
variable "target_id" {
46+
type = string
47+
default = ""
48+
description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
49+
}
50+
51+
variable "arn" {
52+
type = string
53+
default = ""
54+
description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
55+
}
56+
57+
variable "input_path" {
58+
type = string
59+
default = ""
60+
description = "The value of the JSONPath that is used for extracting part of the matched event when passing it to the target."
61+
}
62+
63+
variable "target_role_arn" {
64+
type = string
65+
default = ""
66+
description = "The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered. Required if ecs_target is used."
67+
}
68+
69+
variable "input_paths" {
70+
type = map(any)
71+
default = {}
72+
description = "Key value pairs specified in the form of JSONPath (for example, time = $.time)"
73+
74+
}
75+
76+
variable "snsname" {
77+
type = string
78+
default = ""
79+
description = "Name (e.g. `app` or `cluster`)."
80+
}
81+
82+
variable "subscribers" {
83+
type = map(object({
84+
protocol = string
85+
# The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially supported, see below) (email is an option but is unsupported, see below).
86+
endpoint = string
87+
# The endpoint to send data to, the contents will vary with the protocol. (see below for more information)
88+
endpoint_auto_confirms = bool
89+
# Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty (default is false)
90+
raw_message_delivery = bool
91+
# Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property) (default is false)
92+
}))
93+
description = "Required configuration for subscibres to SNS topic."
94+
default = {}
95+
}
96+
97+
variable "allowed_aws_services_for_sns_published" {
98+
type = list(string)
99+
description = "AWS services that will have permission to publish to SNS topic. Used when no external JSON policy is used"
100+
default = []
101+
}
102+
103+
variable "kms_master_key_id" {
104+
type = string
105+
description = "The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK."
106+
default = "alias/aws/sns"
107+
}
108+
109+
variable "encryption_enabled" {
110+
type = bool
111+
description = "Whether or not to use encryption for SNS Topic. If set to `true` and no custom value for KMS key (kms_master_key_id) is provided, it uses the default `alias/aws/sns` KMS key."
112+
default = true
113+
}
114+
115+
variable "sqs_queue_kms_master_key_id" {
116+
type = string
117+
description = "The ID of an AWS-managed customer master key (CMK) for Amazon SQS Queue or a custom CMK"
118+
default = "alias/aws/sqs"
119+
}
120+
121+
variable "sqs_queue_kms_data_key_reuse_period_seconds" {
122+
type = number
123+
description = "The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again"
124+
default = 300
125+
}
126+
127+
variable "allowed_iam_arns_for_sns_publish" {
128+
type = list(string)
129+
description = "IAM role/user ARNs that will have permission to publish to SNS topic. Used when no external json policy is used."
130+
default = []
131+
}
132+
133+
variable "sns_topic_policy_json" {
134+
type = string
135+
description = "The fully-formed AWS policy as JSON"
136+
default = ""
137+
}
138+
139+
variable "sqs_dlq_enabled" {
140+
type = bool
141+
description = "Enable delivery of failed notifications to SQS and monitor messages in queue."
142+
default = false
143+
}
144+
145+
variable "sqs_dlq_max_message_size" {
146+
type = number
147+
description = "The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). The default for this attribute is 262144 (256 KiB)."
148+
default = 262144
149+
}
150+
151+
variable "sqs_dlq_message_retention_seconds" {
152+
type = number
153+
description = "The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days)."
154+
default = 1209600
155+
}
156+
157+
variable "delivery_policy" {
158+
type = string
159+
description = "The SNS delivery policy as JSON."
160+
default = null
161+
}
162+
163+
variable "fifo_topic" {
164+
type = bool
165+
description = "Whether or not to create a FIFO (first-in-first-out) topic"
166+
default = false
167+
}
168+
169+
variable "fifo_queue_enabled" {
170+
type = bool
171+
description = "Whether or not to create a FIFO (first-in-first-out) queue"
172+
default = false
173+
}
174+
175+
variable "content_based_deduplication" {
176+
type = bool
177+
description = "Enable content-based deduplication for FIFO topics"
178+
default = false
179+
}
180+
181+
variable "redrive_policy_max_receiver_count" {
182+
type = number
183+
description = "The number of times a message is delivered to the source queue before being moved to the dead-letter queue. When the ReceiveCount for a message exceeds the maxReceiveCount for a queue, Amazon SQS moves the message to the dead-letter-queue."
184+
default = 5
185+
}
186+
187+
variable "redrive_policy" {
188+
type = string
189+
description = "The SNS redrive policy as JSON. This overrides `var.redrive_policy_max_receiver_count` and the `deadLetterTargetArn` (supplied by `var.fifo_queue = true`) passed in by the module."
190+
default = null
191+
}

0 commit comments

Comments
 (0)