add eventsub

Author: nhsd-david-wass

infrastructure/terraform/components/api/glue_crawler_event_crawler.tf

@@ -8,6 +8,10 @@ resource "aws_glue_crawler" "event_crawler" {
   s3_target {
     path = "s3://${local.csi_global}-eventcache/"
   }
+
+  s3_target {
+    path = "s3://${local.csi_global}-eventsubeventcache/"
+  }
   recrawl_policy {
     recrawl_behavior = "CRAWL_EVERYTHING"
   }

infrastructure/terraform/components/api/iam_role_glue.tf

@@ -50,7 +50,8 @@ data "aws_iam_policy_document" "glue_service_policy" {
       "s3:DeleteObject"
     ]
     resources = ["arn:aws:s3:::${local.csi}-glue-bucket/*",
-    "arn:aws:s3:::${local.csi_global}-eventcache/*"]
+    "arn:aws:s3:::${local.csi_global}-eventcache/*",
+    "arn:aws:s3:::${local.csi_global}-eventsubeventcache/*"]
   }
   statement {
     sid    = "GlueCatalogAccess"

infrastructure/terraform/components/api/s3_bucket_policy_eventcache.tf

@@ -3,7 +3,7 @@ resource "aws_s3_bucket_policy" "eventcache" {
   bucket = local.event_cache_bucket_name
   policy = data.aws_iam_policy_document.eventcache[0].json
 
-  depends_on = [ module.eventpub ]
+  depends_on = [module.eventpub]
 }
 
 data "aws_iam_policy_document" "eventcache" {

infrastructure/terraform/modules/eventsub/s3_bucket_policy_eventcache.tf

@@ -0,0 +1,48 @@
+resource "aws_s3_bucket_policy" "eventcache" {
+  bucket = s3_bucket_event_cache.bucket
+  policy = data.aws_iam_policy_document.eventcache[0].json
+
+}
+
+data "aws_iam_policy_document" "eventcache" {
+  statement {
+    sid    = "AllowGlueListBucketAndGetLocation"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_role.glue_role.arn]
+    }
+
+    actions = [
+      "s3:ListBucket",
+      "s3:GetBucketLocation"
+    ]
+
+    resources = [
+      "arn:aws:s3:::${local.csi_global}-eventsubeventcache"
+    ]
+  }
+
+  # Object-level permissions: Get/Put/Delete objects
+  statement {
+    sid    = "AllowGlueObjectAccess"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_role.glue_role.arn]
+    }
+
+    actions = [
+      "s3:GetObject",
+      "s3:GetObjectVersion",
+      "s3:PutObject",
+      "s3:DeleteObject"
+    ]
+
+    resources = [
+      "arn:aws:s3:::${local.csi_global}-eventsubeventcache/*"
+    ]
+  }
+}