queue permissions

Author: nhsd-david-wass

infrastructure/terraform/components/api/module_lambda_supplier_allocator.tf

@@ -15,7 +15,7 @@ module "supplier_allocator" {
   kms_key_arn           = module.kms.key_arn
 
   iam_policy_document = {
-    body = data.aws_iam_policy_document.sqs_supplier_allocator_lambda.json
+    body = data.aws_iam_policy_document.supplier_allocator_lambda.json
   }
 
   function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
@@ -40,7 +40,7 @@ module "supplier_allocator" {
   })
 }
 
-data "aws_iam_policy_document" "sqs_supplier_allocator_lambda" {
+data "aws_iam_policy_document" "supplier_allocator_lambda" {
   statement {
     sid    = "KMSPermissions"
     effect = "Allow"

infrastructure/terraform/components/api/module_sqs_supplier_allocator.tf

@@ -12,5 +12,60 @@ module "sqs_supplier_allocator" {
 
   visibility_timeout_seconds = 60
 
-  create_dlq = true
+  create_dlq          = true
+  sqs_policy_overload = data.aws_iam_policy_document.supplier_allocator_queue_policy.json
+}
+
+data "aws_iam_policy_document" "supplier_allocator_queue_policy" {
+  version = "2012-10-17"
+  statement {
+    sid    = "AllowSNSToSendMessage"
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+
+    actions = [
+      "sqs:SendMessage"
+    ]
+
+    resources = [
+      "arn:aws:sqs:${var.region}:${var.aws_account_id}:${var.project}-${var.environment}-${var.component}-supplier-allocator-queue"
+    ]
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [module.eventsub.sns_topic.arn]
+    }
+  }
+
+  statement {
+    sid    = "AllowSNSPermissions"
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+
+    actions = [
+      "sqs:SendMessage",
+      "sqs:ListQueueTags",
+      "sqs:GetQueueUrl",
+      "sqs:GetQueueAttributes",
+    ]
+
+    resources = [
+      "arn:aws:sqs:${var.region}:${var.aws_account_id}:${var.project}-${var.environment}-${var.component}-supplier-allocator-queue"
+    ]
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [module.eventsub.sns_topic.arn]
+    }
+  }
 }