Skip to content

Commit f3cc44f

Browse files
stevebuxstevebux
committed
Add new amendments SNS topic
1 parent c6521bd commit f3cc44f

6 files changed

Lines changed: 126 additions & 1 deletion

File tree

‎infrastructure/terraform/modules/eventsub/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939

4040
| Name | Description |
4141
|------|-------------|
42+
| <a name="output_amendments_topic"></a> [amendments\_topic](#output\_amendments\_topic) | Amendments SNS Topic ARN and Name |
4243
| <a name="output_eventsub_topic"></a> [eventsub\_topic](#output\_eventsub\_topic) | SNS Topic ARN and Name |
4344
| <a name="output_s3_bucket_event_cache"></a> [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache |
4445
<!-- vale on -->

‎infrastructure/terraform/modules/eventsub/cloudwatch_metric_alarm_sns_delivery_failures.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,20 @@ resource "aws_cloudwatch_metric_alarm" "sns_delivery_failures" {
1414
TopicName = aws_sns_topic.eventsub_topic.name
1515
}
1616
}
17+
18+
resource "aws_cloudwatch_metric_alarm" "amendments_delivery_failures" {
19+
alarm_name = "${local.csi}-amendments-sns-delivery-failures"
20+
alarm_description = "RELIABILITY: Alarm for amendments SNS topic delivery failures"
21+
comparison_operator = "GreaterThanThreshold"
22+
evaluation_periods = 1
23+
metric_name = "NumberOfNotificationsFailed"
24+
namespace = "AWS/SNS"
25+
period = 300
26+
statistic = "Sum"
27+
threshold = 0
28+
treat_missing_data = "notBreaching"
29+
30+
dimensions = {
31+
TopicName = amendments_sns_topic.eventsub_topic.name
32+
}
33+
}

‎infrastructure/terraform/modules/eventsub/outputs.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,14 @@ output "eventsub_topic" {
66
}
77
}
88

9+
output "amendments_topic" {
10+
description = "Amendments SNS Topic ARN and Name"
11+
value = {
12+
arn = amendments_sns_topic.eventsub_topic.arn
13+
name = amendments_sns_topic.eventsub_topic.name
14+
}
15+
}
16+
917
output "s3_bucket_event_cache" {
1018
description = "S3 Bucket ARN and Name for event cache"
1119
value = var.enable_event_cache ? {

‎infrastructure/terraform/modules/eventsub/sns_topic_eventsub.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,28 @@ resource "aws_sns_topic" "eventsub_topic" {
2222
sqs_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
2323
sqs_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
2424
}
25+
26+
resource "aws_sns_topic" "amendments_topic" {
27+
name = "${local.csi}-amendments"
28+
kms_master_key_id = var.kms_key_arn
29+
30+
application_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
31+
application_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
32+
application_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
33+
34+
firehose_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
35+
firehose_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
36+
firehose_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
37+
38+
http_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
39+
http_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
40+
http_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
41+
42+
lambda_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
43+
lambda_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
44+
lambda_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
45+
46+
sqs_failure_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
47+
sqs_success_feedback_role_arn = var.enable_sns_delivery_logging == true ? aws_iam_role.sns_delivery_logging_role[0].arn : null
48+
sqs_success_feedback_sample_rate = var.enable_sns_delivery_logging == true ? var.sns_success_logging_sample_percent : null
49+
}

‎infrastructure/terraform/modules/eventsub/sns_topic_policy_eventsub.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ resource "aws_sns_topic_policy" "eventsub_topic" {
44
policy = data.aws_iam_policy_document.sns_topic_policy.json
55
}
66

7+
resource "aws_sns_topic_policy" "amendments_topic" {
8+
arn = aws_sns_topic.amendments_topic.arn
9+
10+
policy = data.aws_iam_policy_document.amendments_topic_policy.json
11+
}
12+
713
data "aws_iam_policy_document" "sns_topic_policy" {
814
policy_id = "__default_policy_ID"
915

@@ -61,3 +67,61 @@ data "aws_iam_policy_document" "sns_topic_policy" {
6167
]
6268
}
6369
}
70+
71+
data "aws_iam_policy_document" "amendments_topic_policy" {
72+
policy_id = "__default_policy_ID"
73+
74+
statement {
75+
sid = "AllowAllSNSActionsFromAccount"
76+
effect = "Allow"
77+
78+
principals {
79+
type = "AWS"
80+
identifiers = ["*"]
81+
}
82+
83+
actions = [
84+
"SNS:Subscribe",
85+
"SNS:SetTopicAttributes",
86+
"SNS:RemovePermission",
87+
"SNS:Receive",
88+
"SNS:Publish",
89+
"SNS:ListSubscriptionsByTopic",
90+
"SNS:GetTopicAttributes",
91+
"SNS:DeleteTopic",
92+
"SNS:AddPermission",
93+
]
94+
95+
resources = [
96+
aws_sns_topic.eventsub_topic.arn,
97+
]
98+
99+
condition {
100+
test = "StringEquals"
101+
variable = "AWS:SourceOwner"
102+
103+
values = [
104+
var.aws_account_id,
105+
]
106+
}
107+
}
108+
109+
statement {
110+
sid = "AllowAllSNSActionsFromSharedAccount"
111+
effect = "Allow"
112+
actions = [
113+
"SNS:Publish",
114+
]
115+
116+
principals {
117+
type = "AWS"
118+
identifiers = [
119+
"arn:aws:iam::${var.shared_infra_account_id}:root"
120+
]
121+
}
122+
123+
resources = [
124+
aws_sns_topic.amendments_topic.arn,
125+
]
126+
}
127+
}

‎infrastructure/terraform/modules/eventsub/sns_topic_subscription_firehose.tf‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
resource "aws_sns_topic_subscription" "firehose" {
1+
resource "aws_sns_topic_subscription" "firehose_eventsub" {
22
count = var.enable_event_cache ? 1 : 0
33

44
topic_arn = aws_sns_topic.eventsub_topic.arn
@@ -7,3 +7,13 @@ resource "aws_sns_topic_subscription" "firehose" {
77
endpoint = aws_kinesis_firehose_delivery_stream.main[0].arn
88
raw_message_delivery = var.enable_firehose_raw_message_delivery
99
}
10+
11+
resource "aws_sns_topic_subscription" "firehose_amendments" {
12+
count = var.enable_event_cache ? 1 : 0
13+
14+
topic_arn = aws_sns_topic.amendments_topic.arn
15+
protocol = "firehose"
16+
subscription_role_arn = aws_iam_role.sns_role.arn
17+
endpoint = aws_kinesis_firehose_delivery_stream.main[0].arn
18+
raw_message_delivery = var.enable_firehose_raw_message_delivery
19+
}

0 commit comments

Comments
 (0)