Skip to content

Commit 8db941b

Browse files
stevebuxstevebux
committed
Clone SNS Topic
1 parent 567752c commit 8db941b

8 files changed

Lines changed: 139 additions & 9 deletions

‎infrastructure/terraform/components/api/sns_topic_subscription_eventsub_sqs_letter_updates.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,9 @@ resource "aws_sns_topic_subscription" "eventsub_sqs_letter_updates" {
33
protocol = "sqs"
44
endpoint = module.sqs_letter_updates.sqs_queue_arn
55
}
6+
7+
resource "aws_sns_topic_subscription" "eventsub_sqs_letter_updates_clone" {
8+
topic_arn = module.eventsub.sns_topic_clone.arn
9+
protocol = "sqs"
10+
endpoint = module.sqs_letter_updates.sqs_queue_arn
11+
}

‎infrastructure/terraform/modules/eventsub/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
|------|-------------|
4242
| <a name="output_s3_bucket_event_cache"></a> [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache |
4343
| <a name="output_sns_topic"></a> [sns\_topic](#output\_sns\_topic) | SNS Topic ARN and Name |
44+
| <a name="output_sns_topic_clone"></a> [sns\_topic\_clone](#output\_sns\_topic\_clone) | SNS Topic ARN and Name |
4445
<!-- vale on -->
4546
<!-- markdownlint-enable -->
4647
<!-- END_TF_DOCS -->

‎infrastructure/terraform/modules/eventsub/cloudwatch_metric_alarm_sns_delivery_failures.tf‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,23 @@ resource "aws_cloudwatch_metric_alarm" "sns_delivery_failures" {
1111
treat_missing_data = "notBreaching"
1212

1313
dimensions = {
14-
TopicName = aws_sns_topic.main.name
14+
TopicName = aws_sns_topic.main_orig.name
15+
}
16+
}
17+
18+
resource "aws_cloudwatch_metric_alarm" "sns_delivery_failures_clone" {
19+
alarm_name = "${local.csi}-sns-delivery-failures"
20+
alarm_description = "RELIABILITY: Alarm for SNS topic delivery failures"
21+
comparison_operator = "GreaterThanThreshold"
22+
evaluation_periods = 1
23+
metric_name = "NumberOfNotificationsFailed"
24+
namespace = "AWS/SNS"
25+
period = 300
26+
statistic = "Sum"
27+
threshold = 0
28+
treat_missing_data = "notBreaching"
29+
30+
dimensions = {
31+
TopicName = aws_sns_topic.main_clone.name
1532
}
1633
}

‎infrastructure/terraform/modules/eventsub/outputs.tf‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,16 @@
11
output "sns_topic" {
22
description = "SNS Topic ARN and Name"
33
value = {
4-
arn = aws_sns_topic.main.arn
5-
name = aws_sns_topic.main.name
4+
arn = aws_sns_topic.main_orig.arn
5+
name = aws_sns_topic.main_orig.name
6+
}
7+
}
8+
9+
output "sns_topic_clone" {
10+
description = "SNS Topic ARN and Name"
11+
value = {
12+
arn = aws_sns_topic.main_clone.arn
13+
name = aws_sns_topic.main_clone.name
614
}
715
}
816

‎infrastructure/terraform/modules/eventsub/sns_topic.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
resource "aws_sns_topic" "main" {
1+
resource "aws_sns_topic" "main_orig" {
22
name = local.csi
33
kms_master_key_id = var.kms_key_arn
44

‎infrastructure/terraform/modules/eventsub/sns_topic_clone.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
resource "aws_sns_topic" "main_clone" {
2+
name = "${local.csi}-clone"
3+
kms_master_key_id = var.kms_key_arn
4+
5+
application_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
6+
application_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
7+
application_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
8+
9+
firehose_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
10+
firehose_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
11+
firehose_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
12+
13+
http_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
14+
http_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
15+
http_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
16+
17+
lambda_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
18+
lambda_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
19+
lambda_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
20+
21+
sqs_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
22+
sqs_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
23+
sqs_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
24+
}

‎infrastructure/terraform/modules/eventsub/sns_topic_policy.tf‎

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,73 @@
1-
resource "aws_sns_topic_policy" "main" {
2-
arn = aws_sns_topic.main.arn
1+
resource "aws_sns_topic_policy" "main_orig" {
2+
arn = aws_sns_topic.main_orig.arn
33

44
policy = data.aws_iam_policy_document.sns_topic_policy.json
55
}
66

7+
resource "aws_sns_topic_policy" "main_clone" {
8+
arn = aws_sns_topic.main_clone.arn
9+
10+
policy = data.aws_iam_policy_document.sns_topic_policy.json
11+
}
12+
13+
data "aws_iam_policy_document" "sns_topic_policy" {
14+
policy_id = "__default_policy_ID"
15+
16+
statement {
17+
sid = "AllowAllSNSActionsFromAccount"
18+
effect = "Allow"
19+
20+
principals {
21+
type = "AWS"
22+
identifiers = ["*"]
23+
}
24+
25+
actions = [
26+
"SNS:Subscribe",
27+
"SNS:SetTopicAttributes",
28+
"SNS:RemovePermission",
29+
"SNS:Receive",
30+
"SNS:Publish",
31+
"SNS:ListSubscriptionsByTopic",
32+
"SNS:GetTopicAttributes",
33+
"SNS:DeleteTopic",
34+
"SNS:AddPermission",
35+
]
36+
37+
resources = [
38+
aws_sns_topic.main_orig.arn,
39+
]
40+
41+
condition {
42+
test = "StringEquals"
43+
variable = "AWS:SourceOwner"
44+
45+
values = [
46+
var.aws_account_id,
47+
]
48+
}
49+
}
50+
51+
statement {
52+
sid = "AllowAllSNSActionsFromSharedAccount"
53+
effect = "Allow"
54+
actions = [
55+
"SNS:Publish",
56+
]
57+
58+
principals {
59+
type = "AWS"
60+
identifiers = [
61+
"arn:aws:iam::${var.shared_infra_account_id}:root"
62+
]
63+
}
64+
65+
resources = [
66+
aws_sns_topic.main_orig.arn,
67+
]
68+
}
69+
}
70+
771
data "aws_iam_policy_document" "sns_topic_policy" {
872
policy_id = "__default_policy_ID"
973

@@ -29,7 +93,7 @@ data "aws_iam_policy_document" "sns_topic_policy" {
2993
]
3094

3195
resources = [
32-
aws_sns_topic.main.arn,
96+
aws_sns_topic.main_clone.arn,
3397
]
3498

3599
condition {
@@ -57,7 +121,7 @@ data "aws_iam_policy_document" "sns_topic_policy" {
57121
}
58122

59123
resources = [
60-
aws_sns_topic.main.arn,
124+
aws_sns_topic.main_clone.arn,
61125
]
62126
}
63127
}

‎infrastructure/terraform/modules/eventsub/sns_topic_subscription_firehose.tf‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,17 @@
11
resource "aws_sns_topic_subscription" "firehose" {
22
count = var.enable_event_cache ? 1 : 0
33

4-
topic_arn = aws_sns_topic.main.arn
4+
topic_arn = aws_sns_topic.main_orig.arn
5+
protocol = "firehose"
6+
subscription_role_arn = aws_iam_role.sns_role.arn
7+
endpoint = aws_kinesis_firehose_delivery_stream.main[0].arn
8+
raw_message_delivery = var.enable_firehose_raw_message_delivery
9+
}
10+
11+
resource "aws_sns_topic_subscription" "firehose_clone" {
12+
count = var.enable_event_cache ? 1 : 0
13+
14+
topic_arn = aws_sns_topic.main_clone.arn
515
protocol = "firehose"
616
subscription_role_arn = aws_iam_role.sns_role.arn
717
endpoint = aws_kinesis_firehose_delivery_stream.main[0].arn

0 commit comments

Comments
 (0)