Skip to content

Commit 89f4a0a

Browse files
jamesthompson26-nhsjamesthompson26-nhs
committed
CCM-10257: Implement Eventpub in Core
1 parent 6445f48 commit 89f4a0a

9 files changed

Lines changed: 68 additions & 9 deletions

‎infrastructure/modules/eventpub/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
| Name | Description | Type | Default | Required |
1313
|------|-------------|------|---------|:--------:|
14+
| <a name="input_alarm_prefixes"></a> [alarm\_prefixes](#input\_alarm\_prefixes) | Object containing prefixes for alarm descriptions, e.g. 'RELIABILITY:', 'SECURITY:', 'PERFORMANCE:' | <pre>object({<br/> dlq = string<br/> sns_delivery = string<br/> lambda = string<br/> })</pre> | <pre>{<br/> "dlq": null,<br/> "lambda": null,<br/> "sns_delivery": null<br/>}</pre> | no |
1415
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
1516
| <a name="input_component"></a> [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes |
1617
| <a name="input_control_plane_bus_arn"></a> [control\_plane\_bus\_arn](#input\_control\_plane\_bus\_arn) | Data plane event bus arn | `string` | n/a | yes |
@@ -22,6 +23,7 @@
2223
| <a name="input_event_cache_buffer_interval"></a> [event\_cache\_buffer\_interval](#input\_event\_cache\_buffer\_interval) | The buffer interval for data firehose | `number` | `500` | no |
2324
| <a name="input_event_cache_expiry_days"></a> [event\_cache\_expiry\_days](#input\_event\_cache\_expiry\_days) | s3 archiving expiry in days | `number` | `30` | no |
2425
| <a name="input_group"></a> [group](#input\_group) | The name of the tfscaffold group | `string` | `null` | no |
26+
| <a name="input_iam_permissions_boundary_arn"></a> [iam\_permissions\_boundary\_arn](#input\_iam\_permissions\_boundary\_arn) | The ARN of the permissions boundary to use for the IAM role | `string` | `null` | no |
2527
| <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | KMS key arn to use for this function | `string` | n/a | yes |
2628
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | The log level to be used in lambda functions within the component. Any log with a lower severity than the configured value will not be logged: https://docs.python.org/3/library/logging.html#levels | `string` | `"WARN"` | no |
2729
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events generated by the lambda function | `number` | n/a | yes |

‎infrastructure/modules/eventpub/cloudwatch_metric_alarm_dlq_alarm.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
resource "aws_cloudwatch_metric_alarm" "dlq_alarm" {
22
alarm_name = "${local.csi}-dlq-messages-alarm"
3-
alarm_description = "Alarm for messages in the DLQ"
3+
alarm_description = "${var.alarm_prefixes.dlq} Alarm for messages in the DLQ"
44
comparison_operator = "GreaterThanThreshold"
55
evaluation_periods = 1
66
metric_name = "ApproximateNumberOfMessagesVisible"

‎infrastructure/modules/eventpub/cloudwatch_metric_alarm_lambda_errors.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
2+
alarm_name = "${local.csi}-lambda-errors-alarm"
3+
alarm_description = "${var.alarm_prefixes.lambda} Alarm for Lambda function errors"
4+
comparison_operator = "GreaterThanOrEqualToThreshold"
5+
evaluation_periods = 1
6+
metric_name = "Errors"
7+
namespace = "AWS/Lambda"
8+
period = 300
9+
statistic = "Sum"
10+
threshold = 1
11+
actions_enabled = true
12+
treat_missing_data = "notBreaching"
13+
14+
dimensions = {
15+
FunctionName = aws_lambda_function.main.function_name
16+
}
17+
}

‎infrastructure/modules/eventpub/cloudwatch_metric_alarm_sns_delivery_failures.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "aws_cloudwatch_metric_alarm" "sns_delivery_failures" {
2+
alarm_name = "${local.csi}-sns-delivery-failures"
3+
alarm_description = "${var.alarm_prefixes.sns_delivery} Alarm when SNS topic ${aws_sns_topic.main.name} has delivery failures"
4+
comparison_operator = "GreaterThanThreshold"
5+
evaluation_periods = 1
6+
metric_name = "NumberOfNotificationsFailed"
7+
namespace = "AWS/SNS"
8+
period = 300
9+
statistic = "Sum"
10+
threshold = 0
11+
treat_missing_data = "notBreaching"
12+
13+
dimensions = {
14+
TopicName = aws_sns_topic.main.name
15+
}
16+
}

‎infrastructure/modules/eventpub/iam_role_firehose_role.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
resource "aws_iam_role" "firehose_role" {
22
count = var.enable_event_cache ? 1 : 0
33

4-
name = "${local.csi}-firehose-role"
5-
assume_role_policy = data.aws_iam_policy_document.firehose_assume_role[0].json
4+
name = "${local.csi}-firehose-role"
5+
assume_role_policy = data.aws_iam_policy_document.firehose_assume_role[0].json
6+
permissions_boundary = var.iam_permissions_boundary_arn != null ? var.iam_permissions_boundary_arn : null
67
}
78

89
data "aws_iam_policy_document" "firehose_assume_role" {

‎infrastructure/modules/eventpub/iam_role_lambda.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
resource "aws_iam_role" "lambda" {
2-
name = local.csi
3-
assume_role_policy = data.aws_iam_policy_document.lambda_assumerole.json
2+
name = local.csi
3+
assume_role_policy = data.aws_iam_policy_document.lambda_assumerole.json
4+
permissions_boundary = var.iam_permissions_boundary_arn != null ? var.iam_permissions_boundary_arn : null
45
}
56

67
resource "aws_iam_policy" "lambda" {

‎infrastructure/modules/eventpub/iam_role_sns.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
resource "aws_iam_role" "sns_role" {
2-
name = "${local.csi}-sns-role"
3-
assume_role_policy = data.aws_iam_policy_document.sns_assume_role.json
2+
name = "${local.csi}-sns-role"
3+
assume_role_policy = data.aws_iam_policy_document.sns_assume_role.json
4+
permissions_boundary = var.iam_permissions_boundary_arn != null ? var.iam_permissions_boundary_arn : null
45
}
56

67
resource "aws_iam_policy" "firehose_delivery" {

‎infrastructure/modules/eventpub/iam_role_sns_delivery_logging.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
resource "aws_iam_role" "sns_delivery_logging_role" {
22
count = var.enable_sns_delivery_logging ? 1 : 0
33

4-
name = "${local.csi}-sns-delivery-logging"
5-
assume_role_policy = data.aws_iam_policy_document.sns_delivery_logging_assume_role[0].json
4+
name = "${local.csi}-sns-delivery-logging"
5+
assume_role_policy = data.aws_iam_policy_document.sns_delivery_logging_assume_role[0].json
6+
permissions_boundary = var.iam_permissions_boundary_arn != null ? var.iam_permissions_boundary_arn : null
67
}
78

89
data "aws_iam_policy_document" "sns_delivery_logging_assume_role" {

‎infrastructure/modules/eventpub/variables.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,3 +108,23 @@ variable "control_plane_bus_arn" {
108108
type = string
109109
description = "Data plane event bus arn"
110110
}
111+
112+
variable "iam_permissions_boundary_arn" {
113+
type = string
114+
description = "The ARN of the permissions boundary to use for the IAM role"
115+
default = null
116+
}
117+
118+
variable "alarm_prefixes" {
119+
type = object({
120+
dlq = string
121+
sns_delivery = string
122+
lambda = string
123+
})
124+
description = "Object containing prefixes for alarm descriptions, e.g. 'RELIABILITY:', 'SECURITY:', 'PERFORMANCE:'"
125+
default = {
126+
dlq = null
127+
sns_delivery = null
128+
lambda = null
129+
}
130+
}

0 commit comments

Comments
 (0)