Skip to content

Commit 1f36eaf

Browse files
authored
Merge pull request easyawslearn#39 from easyawslearn/SNS
Sns
2 parents d40546e + aa3e343 commit 1f36eaf

File tree

4 files changed

+285
-0
lines changed

4 files changed

+285
-0
lines changed
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
module "sns_cloudwatch" {
6+
source = "../"
7+
cloudwatch_event_rule_name = "capture-aws-sign-in"
8+
description = "Capture each AWS Console Sign In"
9+
sns_name = "mysns"
10+
sns_display_name = "demosns"
11+
}
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Terraform version
2+
terraform {
3+
required_version = ">= 0.14.11"
4+
5+
required_providers {
6+
aws = {
7+
source = "hashicorp/aws"
8+
version = ">= 3.1.15"
9+
}
10+
}
11+
}
12+

terraform-aws-sns/main.tf

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
resource "aws_cloudwatch_event_rule" "default" {
6+
count = var.enabled == true ? 1 : 0
7+
8+
name = var.cloudwatch_event_rule_name
9+
description = var.description
10+
event_pattern = <<EOF
11+
{
12+
"detail-type": [
13+
"AWS Console Sign In via CloudTrail"
14+
]
15+
}
16+
EOF
17+
role_arn = var.role_arn
18+
is_enabled = var.is_enabled
19+
}
20+
21+
resource "aws_cloudwatch_event_target" "default" {
22+
count = var.enabled == true ? 1 : 0
23+
rule = aws_cloudwatch_event_rule.default.*.name[0]
24+
target_id = var.target_id
25+
arn = aws_sns_topic.this[count.index].arn
26+
input_path = var.input_path != "" ? var.input_path : null
27+
role_arn = var.target_role_arn
28+
}
29+
30+
resource "aws_sns_topic" "this" {
31+
count = var.enabled ? 1 : 0
32+
33+
name = var.sns_name
34+
display_name = var.sns_display_name
35+
kms_master_key_id = var.kms_master_key_id
36+
delivery_policy = var.delivery_policy
37+
fifo_topic = var.fifo_topic
38+
content_based_deduplication = var.content_based_deduplication
39+
}
40+
41+
resource "aws_sns_topic_subscription" "this" {
42+
for_each = var.enabled ? var.subscribers : {}
43+
44+
topic_arn = join("", aws_sns_topic.this.*.arn)
45+
protocol = var.subscribers[each.key].protocol
46+
endpoint = var.subscribers[each.key].endpoint
47+
endpoint_auto_confirms = var.subscribers[each.key].endpoint_auto_confirms
48+
raw_message_delivery = var.subscribers[each.key].raw_message_delivery
49+
}
50+
51+
resource "aws_sns_topic_policy" "default" {
52+
count = var.sns_topic_policy_enabled ? 1 : 0
53+
54+
arn = aws_sns_topic.this[count.index].arn
55+
policy = data.aws_iam_policy_document.sns_topic_policy[count.index].json
56+
}
57+
58+
data "aws_iam_policy_document" "sns_topic_policy" {
59+
count = var.sns_topic_policy_enabled ? 1 : 0
60+
statement {
61+
effect = "Allow"
62+
actions = ["SNS:Publish"]
63+
64+
principals {
65+
type = "Service"
66+
identifiers = ["events.amazonaws.com"]
67+
}
68+
69+
resources = [aws_sns_topic.this[count.index].arn]
70+
}
71+
}

terraform-aws-sns/variable.tf

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
variable "region" {
2+
type = string
3+
default = "eu-west-1"
4+
}
5+
6+
variable "enabled" {
7+
type = bool
8+
default = true
9+
}
10+
11+
variable "sns_topic_policy_enabled" {
12+
type = bool
13+
default = true
14+
}
15+
16+
variable "sns_display_name" {
17+
type = string
18+
default = ""
19+
}
20+
21+
variable "cloudwatch_event_rule_name" {
22+
type = string
23+
default = ""
24+
description = "Name (e.g. `app` or `cluster`)."
25+
}
26+
27+
variable "description" {
28+
type = string
29+
default = ""
30+
description = "The description for the rule."
31+
}
32+
33+
variable "role_arn" {
34+
type = string
35+
default = ""
36+
description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
37+
}
38+
39+
variable "is_enabled" {
40+
type = bool
41+
default = true
42+
description = "Whether the rule should be enabled (defaults to true)."
43+
}
44+
45+
variable "target_id" {
46+
type = string
47+
default = "SendToSNS"
48+
description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
49+
}
50+
51+
variable "arn" {
52+
type = string
53+
default = ""
54+
description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
55+
}
56+
57+
variable "input_path" {
58+
type = string
59+
default = ""
60+
description = "The value of the JSONPath that is used for extracting part of the matched event when passing it to the target."
61+
}
62+
63+
variable "target_role_arn" {
64+
type = string
65+
default = ""
66+
description = "The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered. Required if ecs_target is used."
67+
}
68+
69+
variable "input_paths" {
70+
type = map(any)
71+
default = {}
72+
description = "Key value pairs specified in the form of JSONPath (for example, time = $.time)"
73+
74+
}
75+
76+
variable "sns_name" {
77+
type = string
78+
default = ""
79+
description = "Name (e.g. `app` or `cluster`)."
80+
}
81+
82+
variable "subscribers" {
83+
type = map(object({
84+
protocol = string
85+
# The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially supported, see below) (email is an option but is unsupported, see below).
86+
endpoint = string
87+
# The endpoint to send data to, the contents will vary with the protocol. (see below for more information)
88+
endpoint_auto_confirms = bool
89+
# Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty (default is false)
90+
raw_message_delivery = bool
91+
# Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property) (default is false)
92+
}))
93+
description = "Required configuration for subscibres to SNS topic."
94+
default = {}
95+
}
96+
97+
variable "allowed_aws_services_for_sns_published" {
98+
type = list(string)
99+
description = "AWS services that will have permission to publish to SNS topic. Used when no external JSON policy is used"
100+
default = []
101+
}
102+
103+
variable "kms_master_key_id" {
104+
type = string
105+
description = "The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK."
106+
default = "alias/aws/sns"
107+
}
108+
109+
variable "encryption_enabled" {
110+
type = bool
111+
description = "Whether or not to use encryption for SNS Topic. If set to `true` and no custom value for KMS key (kms_master_key_id) is provided, it uses the default `alias/aws/sns` KMS key."
112+
default = true
113+
}
114+
115+
variable "sqs_queue_kms_master_key_id" {
116+
type = string
117+
description = "The ID of an AWS-managed customer master key (CMK) for Amazon SQS Queue or a custom CMK"
118+
default = "alias/aws/sqs"
119+
}
120+
121+
variable "sqs_queue_kms_data_key_reuse_period_seconds" {
122+
type = number
123+
description = "The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again"
124+
default = 300
125+
}
126+
127+
variable "allowed_iam_arns_for_sns_publish" {
128+
type = list(string)
129+
description = "IAM role/user ARNs that will have permission to publish to SNS topic. Used when no external json policy is used."
130+
default = []
131+
}
132+
133+
variable "sns_topic_policy_json" {
134+
type = string
135+
description = "The fully-formed AWS policy as JSON"
136+
default = ""
137+
}
138+
139+
variable "sqs_dlq_enabled" {
140+
type = bool
141+
description = "Enable delivery of failed notifications to SQS and monitor messages in queue."
142+
default = false
143+
}
144+
145+
variable "sqs_dlq_max_message_size" {
146+
type = number
147+
description = "The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). The default for this attribute is 262144 (256 KiB)."
148+
default = 262144
149+
}
150+
151+
variable "sqs_dlq_message_retention_seconds" {
152+
type = number
153+
description = "The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days)."
154+
default = 1209600
155+
}
156+
157+
variable "delivery_policy" {
158+
type = string
159+
description = "The SNS delivery policy as JSON."
160+
default = null
161+
}
162+
163+
variable "fifo_topic" {
164+
type = bool
165+
description = "Whether or not to create a FIFO (first-in-first-out) topic"
166+
default = false
167+
}
168+
169+
variable "fifo_queue_enabled" {
170+
type = bool
171+
description = "Whether or not to create a FIFO (first-in-first-out) queue"
172+
default = false
173+
}
174+
175+
variable "content_based_deduplication" {
176+
type = bool
177+
description = "Enable content-based deduplication for FIFO topics"
178+
default = false
179+
}
180+
181+
variable "redrive_policy_max_receiver_count" {
182+
type = number
183+
description = "The number of times a message is delivered to the source queue before being moved to the dead-letter queue. When the ReceiveCount for a message exceeds the maxReceiveCount for a queue, Amazon SQS moves the message to the dead-letter-queue."
184+
default = 5
185+
}
186+
187+
variable "redrive_policy" {
188+
type = string
189+
description = "The SNS redrive policy as JSON. This overrides `var.redrive_policy_max_receiver_count` and the `deadLetterTargetArn` (supplied by `var.fifo_queue = true`) passed in by the module."
190+
default = null
191+
}

0 commit comments

Comments
 (0)