Skip to content

Commit 7ae1ede

Browse files
dlzhry2nhsdlzhry2nhs
committed
VED-981 (Part 2) Add DLQ, redrive policy, and encryption to queues (#1203)
1 parent 61f2c7a commit 7ae1ede

File tree

15 files changed

+281
-63
lines changed

15 files changed

+281
-63
lines changed

‎infrastructure/instance/dynamodb.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ resource "aws_dynamodb_table" "delta-dynamodb-table" {
5656
name = "imms-${local.resource_scope}-delta"
5757
billing_mode = "PAY_PER_REQUEST"
5858
hash_key = "PK"
59-
stream_enabled = true
60-
stream_view_type = "NEW_IMAGE"
59+
stream_enabled = var.mns_publisher_feature_enabled
60+
stream_view_type = var.mns_publisher_feature_enabled ? "NEW_IMAGE" : null
6161
deletion_protection_enabled = !local.is_temp
6262

6363
attribute {

‎infrastructure/instance/environments/dev/internal-qa/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@ immunisation_account_id = "345594581768"
33
dspp_core_account_id = "603871901111"
44
pds_environment = "int"
55
error_alarm_notifications_enabled = false
6+
mns_publisher_feature_enabled = true
67
create_mesh_processor = false
78
has_sub_environment_scope = true

‎infrastructure/instance/environments/dev/pr/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@ immunisation_account_id = "345594581768"
33
dspp_core_account_id = "603871901111"
44
pds_environment = "int"
55
error_alarm_notifications_enabled = false
6+
mns_publisher_feature_enabled = true # Switch this off once tested fully e2e in Lambda branch
67
create_mesh_processor = false
78
has_sub_environment_scope = true

‎infrastructure/instance/environments/preprod/int-blue/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ immunisation_account_id = "084828561157"
33
dspp_core_account_id = "603871901111"
44
pds_environment = "int"
55
error_alarm_notifications_enabled = true
6+
mns_publisher_feature_enabled = true
67

78
# mesh no invocation period metric set to 3 days (in seconds) for preprod environment i.e 3 * 24 * 60 * 60
89
mesh_no_invocation_period_seconds = 259200

‎infrastructure/instance/environments/preprod/int-green/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ immunisation_account_id = "084828561157"
33
dspp_core_account_id = "603871901111"
44
pds_environment = "int"
55
error_alarm_notifications_enabled = true
6+
mns_publisher_feature_enabled = true
67

78
# mesh no invocation period metric set to 3 days (in seconds) for preprod environment i.e 3 * 24 * 60 * 60
89
mesh_no_invocation_period_seconds = 259200

‎infrastructure/instance/environments/prod/blue/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ dspp_core_account_id = "232116723729"
44
mns_account_id = "758334270304"
55
pds_environment = "prod"
66
error_alarm_notifications_enabled = true
7+
mns_publisher_feature_enabled = true
78

89
# mesh no invocation period metric set to 1 day (in seconds) for prod environment i.e 1 * 24 * 60 * 60
910
mesh_no_invocation_period_seconds = 86400

‎infrastructure/instance/environments/prod/green/variables.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ dspp_core_account_id = "232116723729"
44
mns_account_id = "758334270304"
55
pds_environment = "prod"
66
error_alarm_notifications_enabled = true
7+
mns_publisher_feature_enabled = true
78

89
# mesh no invocation period metric set to 1 day (in seconds) for prod environment i.e 1 * 24 * 60 * 60
910
mesh_no_invocation_period_seconds = 86400

‎infrastructure/instance/mns_publisher.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
module "mns_publisher" {
2+
source = "./modules/mns_publisher"
3+
count = var.mns_publisher_feature_enabled ? 1 : 0
4+
5+
ddb_delta_stream_arn = aws_dynamodb_table.delta-dynamodb-table.stream_arn
6+
dynamo_kms_encryption_key_arn = data.aws_kms_key.existing_dynamo_encryption_key.arn
7+
enable_lambda_alarm = var.error_alarm_notifications_enabled # consider just INT and PROD
8+
immunisation_account_id = var.immunisation_account_id
9+
is_temp = local.is_temp
10+
lambda_kms_encryption_key_arn = data.aws_kms_key.existing_lambda_encryption_key.arn
11+
mns_publisher_resource_name_prefix = "${local.resource_scope}-mns-outbound-events"
12+
13+
private_subnet_ids = local.private_subnet_ids
14+
security_group_id = data.aws_security_group.existing_securitygroup.id
15+
16+
shared_dir_sha = local.shared_dir_sha
17+
splunk_firehose_stream_name = module.splunk.firehose_stream_name
18+
19+
short_prefix = local.short_prefix
20+
21+
system_alarm_sns_topic_arn = data.aws_sns_topic.imms_system_alert_errors.arn
22+
}

infrastructure/instance/mns_outbound_events_eb_pipe.tf renamed to infrastructure/instance/modules/mns_publisher/mns_outbound_events_eb_pipe.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# IAM Role for EventBridge Pipe
22
resource "aws_iam_role" "mns_outbound_events_eb_pipe" {
3-
name = "${local.resource_scope}-mns-outbound-eventbridge-pipe-role"
3+
name = "${var.mns_publisher_resource_name_prefix}-eventbridge-pipe-role"
44
assume_role_policy = jsonencode({
55
Version = "2012-10-17"
66
Statement = [
@@ -33,15 +33,15 @@ resource "aws_iam_role_policy" "mns_outbound_events_eb_pipe_source_policy" {
3333
"dynamodb:GetShardIterator",
3434
"dynamodb:ListStreams"
3535
],
36-
"Resource" : aws_dynamodb_table.delta-dynamodb-table.stream_arn
36+
"Resource" : var.ddb_delta_stream_arn
3737
},
3838
{
3939
"Effect" : "Allow",
4040
"Action" : [
4141
"kms:Decrypt",
4242
"kms:GenerateDataKey"
4343
],
44-
"Resource" : data.aws_kms_key.existing_dynamo_encryption_key.arn
44+
"Resource" : var.dynamo_kms_encryption_key_arn
4545
},
4646
]
4747
})
@@ -79,15 +79,15 @@ resource "aws_iam_role_policy" "mns_outbound_events_eb_pipe_cw_log_policy" {
7979
"logs:PutLogEvents"
8080
],
8181
Resource = [
82-
"arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/vendedlogs/pipes/${local.resource_scope}-mns-outbound-event-pipe-logs:*",
82+
"arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/vendedlogs/pipes/${var.mns_publisher_resource_name_prefix}-pipe-logs:*",
8383
]
8484
},
8585
]
8686
})
8787
}
8888

8989
resource "aws_cloudwatch_log_group" "mns_outbound_events_eb_pipe" {
90-
name = "/aws/vendedlogs/pipes/${local.resource_scope}-mns-outbound-event-pipe-logs"
90+
name = "/aws/vendedlogs/pipes/${var.mns_publisher_resource_name_prefix}-pipe-logs"
9191
retention_in_days = 30
9292
}
9393

@@ -97,9 +97,9 @@ resource "aws_pipes_pipe" "mns_outbound_events" {
9797
aws_iam_role_policy.mns_outbound_events_eb_pipe_target_policy,
9898
aws_iam_role_policy.mns_outbound_events_eb_pipe_cw_log_policy,
9999
]
100-
name = "${local.resource_scope}-mns-outbound-events"
100+
name = "${var.mns_publisher_resource_name_prefix}-pipe"
101101
role_arn = aws_iam_role.mns_outbound_events_eb_pipe.arn
102-
source = aws_dynamodb_table.delta-dynamodb-table.stream_arn
102+
source = var.ddb_delta_stream_arn
103103
target = aws_sqs_queue.mns_outbound_events.arn
104104

105105
source_parameters {
@@ -112,7 +112,7 @@ resource "aws_pipes_pipe" "mns_outbound_events" {
112112
include_execution_data = ["ALL"]
113113
level = "ERROR"
114114
cloudwatch_logs_log_destination {
115-
log_group_arn = aws_cloudwatch_log_group.pipe_log_group.arn
115+
log_group_arn = aws_cloudwatch_log_group.mns_outbound_events_eb_pipe.arn
116116
}
117117
}
118118
}

‎infrastructure/instance/modules/mns_publisher/mns_outbound_events_kms_key.tf‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
resource "aws_kms_key" "mns_outbound_events" {
2+
description = "KMS key for encrypting MNS outbound immunisation events in SQS"
3+
key_usage = "ENCRYPT_DECRYPT"
4+
enable_key_rotation = true
5+
6+
policy = jsonencode({
7+
Version = "2012-10-17"
8+
Statement = [
9+
{
10+
Sid = "EnableRootPermissions"
11+
Effect = "Allow"
12+
Principal = {
13+
AWS = "arn:aws:iam::${var.immunisation_account_id}:root"
14+
},
15+
Action = [
16+
"kms:Create*",
17+
"kms:Describe*",
18+
"kms:Enable*",
19+
"kms:List*",
20+
"kms:Put*",
21+
"kms:Update*",
22+
"kms:Revoke*",
23+
"kms:Disable*",
24+
"kms:Get*",
25+
"kms:Delete*",
26+
"kms:ScheduleKeyDeletion",
27+
"kms:CancelKeyDeletion",
28+
"kms:GenerateDataKey*",
29+
"kms:Decrypt",
30+
"kms:Tag*"
31+
],
32+
Resource = "*"
33+
},
34+
{
35+
Sid = "AllowSQSUseOfKey"
36+
Effect = "Allow"
37+
Principal = {
38+
Service = "sqs.amazonaws.com"
39+
}
40+
Action = [
41+
"kms:GenerateDataKey",
42+
"kms:Decrypt"
43+
]
44+
Resource = "*"
45+
Condition = {
46+
StringEquals = {
47+
"kms:EncryptionContext:aws:sqs:queue_arn" = [
48+
"arn:aws:sqs:${var.aws_region}:${var.immunisation_account_id}:${var.mns_publisher_resource_name_prefix}-queue",
49+
"arn:aws:sqs:${var.aws_region}:${var.immunisation_account_id}:${var.mns_publisher_resource_name_prefix}-dead-letter-queue"
50+
]
51+
}
52+
}
53+
},
54+
{
55+
Sid = "AllowLambdaToDecrypt"
56+
Effect = "Allow"
57+
Principal = {
58+
AWS = "arn:aws:iam::${var.immunisation_account_id}:role/${var.short_prefix}-mns-publisher-lambda-exec-role"
59+
}
60+
Action = [
61+
"kms:Decrypt",
62+
"kms:GenerateDataKey"
63+
]
64+
Resource = "*"
65+
},
66+
{
67+
Sid = "AllowEventBridgePipesUseOfKey"
68+
Effect = "Allow"
69+
Principal = {
70+
AWS = "arn:aws:iam::${var.immunisation_account_id}:role/${var.mns_publisher_resource_name_prefix}-eventbridge-pipe-role"
71+
}
72+
Action = [
73+
"kms:GenerateDataKey",
74+
"kms:Encrypt",
75+
"kms:DescribeKey"
76+
77+
]
78+
Resource = "*"
79+
}
80+
]
81+
})
82+
}
83+
84+
resource "aws_kms_alias" "mns_outbound_events_key" {
85+
name = "alias/${var.mns_publisher_resource_name_prefix}-key"
86+
target_key_id = aws_kms_key.mns_outbound_events.id
87+
}

0 commit comments

Comments
 (0)