Skip to content

Commit bdd1cd8

Browse files
aidenvaines-cgiaidenvaines-cgi
committed
CCM-7938 adding base module for Messaging Infrastructure
1 parent 559bc88 commit bdd1cd8

26 files changed

Lines changed: 4185 additions & 1 deletion

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ version.json
1010
*.code-workspace
1111
!project.code-workspace
1212

13-
# Please, add your custom content below!
13+
infrastructure/modules/eventpub/lambda/*.zip

‎infrastructure/modules/eventpub/cloudwatch_log_group_kinesis_data_firehose.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
resource "aws_cloudwatch_log_group" "kinesis_data_firehose" {
2+
count = var.enable_event_cache ? 1 : 0
3+
4+
name = "/aws/firehose/${local.csi}"
5+
kms_key_id = var.kms_key_arn
6+
retention_in_days = var.log_retention_in_days
7+
}
8+
9+
resource "aws_cloudwatch_log_stream" "kinesis_data_firehose_extended_s3" {
10+
count = var.enable_event_cache ? 1 : 0
11+
12+
name = "extended_s3"
13+
log_group_name = aws_cloudwatch_log_group.kinesis_data_firehose[0].name
14+
}

‎infrastructure/modules/eventpub/cloudwatch_log_group_lambda.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "aws_cloudwatch_log_group" "lambda" {
2+
name = "/aws/lambda/${local.csi}"
3+
retention_in_days = var.log_retention_in_days
4+
kms_key_id = var.kms_key_arn
5+
}

‎infrastructure/modules/eventpub/cloudwatch_log_group_sns_delivery_logging_failure.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_cloudwatch_log_group" "sns_delivery_logging_failure" {
2+
count = var.enable_sns_delivery_logging ? 1 : 0
3+
4+
# SNS doesn't allow specifying a log group and is derived as: sns/${region}/${account_id}/${name_of_sns_topic}/Failure
5+
# (for failure logs)
6+
name = "sns/${var.region}/${var.aws_account_id}/${local.csi}/Failure"
7+
kms_key_id = var.kms_key_arn
8+
retention_in_days = var.log_retention_in_days
9+
}

‎infrastructure/modules/eventpub/cloudwatch_log_group_sns_delivery_logging_success.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_cloudwatch_log_group" "sns_delivery_logging_success" {
2+
count = var.enable_sns_delivery_logging ? 1 : 0
3+
4+
# SNS doesn't allow specifying a log group and is derived as: sns/${region}/${account_id}/${name_of_sns_topic}/Failure
5+
# (for failure logs)
6+
name = "sns/${var.region}/${var.aws_account_id}/${local.csi}"
7+
kms_key_id = var.kms_key_arn
8+
retention_in_days = var.log_retention_in_days
9+
}

‎infrastructure/modules/eventpub/data_archive_file_lambda.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
data "archive_file" "lambda" {
2+
type = "zip"
3+
source_dir = "${path.module}/lambda/eventpub/src"
4+
output_path = "${path.module}/lambda/eventpub.zip"
5+
excludes = [
6+
# NodeJS Exclusions
7+
"**/__tests__",
8+
"**/node_modules",
9+
"**/package.json",
10+
"**/package-lock.json",
11+
]
12+
}

‎infrastructure/modules/eventpub/iam_policy_sns_delivery_logging_cloudwatch.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
resource "aws_iam_policy" "sns_delivery_logging_cloudwatch" {
2+
count = var.enable_sns_delivery_logging ? 1 : 0
3+
4+
name = "${local.csi}-${var.name}-sns-delivery"
5+
description = "Policy for ${local.csi}-${var.name} SNS Delivery Logging"
6+
policy = data.aws_iam_policy_document.sns_delivery_logging_cloudwatch[0].json
7+
}
8+
9+
data "aws_iam_policy_document" "sns_delivery_logging_cloudwatch" {
10+
count = var.enable_sns_delivery_logging ? 1 : 0
11+
12+
statement {
13+
sid = "KMSCloudwatchKeyAccess"
14+
effect = "Allow"
15+
16+
actions = [
17+
"kms:GenerateDataKey",
18+
"kms:Decrypt",
19+
]
20+
21+
resources = [
22+
var.kms_key_arn
23+
]
24+
}
25+
26+
statement {
27+
sid = "AllowSNSDeliveryNotifications"
28+
effect = "Allow"
29+
30+
actions = [
31+
"logs:CreateLogStream",
32+
"logs:PutLogEvents",
33+
"logs:PutMetricFilter",
34+
"logs:PutRetentionPolicy",
35+
]
36+
37+
resources = [
38+
aws_cloudwatch_log_group.sns_delivery_logging_success[0].arn,
39+
"${aws_cloudwatch_log_group.sns_delivery_logging_success[0].arn}:log-stream:*",
40+
aws_cloudwatch_log_group.sns_delivery_logging_failure[0].arn,
41+
"${aws_cloudwatch_log_group.sns_delivery_logging_failure[0].arn}:log-stream:*",
42+
]
43+
}
44+
}

‎infrastructure/modules/eventpub/iam_role_firehose_role.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
resource "aws_iam_role" "firehose_role" {
2+
count = var.enable_event_cache ? 1 : 0
3+
4+
name = "${local.csi}-firehose-role"
5+
assume_role_policy = data.aws_iam_policy_document.firehose_assume_role[0].json
6+
}
7+
8+
data "aws_iam_policy_document" "firehose_assume_role" {
9+
count = var.enable_event_cache ? 1 : 0
10+
11+
statement {
12+
effect = "Allow"
13+
14+
principals {
15+
type = "Service"
16+
identifiers = ["firehose.amazonaws.com"]
17+
}
18+
19+
actions = ["sts:AssumeRole"]
20+
}
21+
}
22+
23+
resource "aws_iam_role_policy_attachment" "s3_write_object" {
24+
count = var.enable_event_cache ? 1 : 0
25+
26+
role = aws_iam_role.firehose_role[0].name
27+
policy_arn = aws_iam_policy.s3_write_object[0].arn
28+
}
29+
30+
resource "aws_iam_policy" "s3_write_object" {
31+
count = var.enable_event_cache ? 1 : 0
32+
33+
name = "${local.csi}-${var.name}-s3-write-object"
34+
description = "S3 Put Object policy for ${local.csi}-${var.name} Firehose"
35+
policy = data.aws_iam_policy_document.s3_write_object[0].json
36+
}
37+
38+
data "aws_iam_policy_document" "s3_write_object" {
39+
count = var.enable_event_cache ? 1 : 0
40+
41+
statement {
42+
sid = "AllowWriteObject"
43+
effect = "Allow"
44+
45+
actions = [
46+
"s3:AbortMultipartUpload",
47+
"s3:GetBucketLocation",
48+
"s3:GetObject",
49+
"s3:ListBucket",
50+
"s3:ListBucketMultipartUploads",
51+
"s3:PutObject",
52+
"s3:PutObject",
53+
]
54+
55+
resources = [
56+
"${module.s3bucket_event_cache[0].arn}/*",
57+
]
58+
}
59+
}

‎infrastructure/modules/eventpub/iam_role_lambda.tf‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
resource "aws_iam_role" "lambda" {
2+
name = local.csi
3+
assume_role_policy = data.aws_iam_policy_document.lambda_assumerole.json
4+
}
5+
6+
resource "aws_iam_policy" "lambda" {
7+
name = local.csi
8+
policy = data.aws_iam_policy_document.lambda.json
9+
}
10+
11+
resource "aws_iam_role_policy_attachment" "lambda_lambda" {
12+
role = aws_iam_role.lambda.name
13+
policy_arn = aws_iam_policy.lambda.arn
14+
}
15+
16+
resource "aws_iam_role_policy_attachment" "lambda_insights" {
17+
role = aws_iam_role.lambda.name
18+
policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
19+
}
20+
21+
data "aws_iam_policy_document" "lambda_assumerole" {
22+
statement {
23+
sid = "LambdaAssumeRole"
24+
effect = "Allow"
25+
26+
principals {
27+
type = "Service"
28+
29+
identifiers = [
30+
"lambda.amazonaws.com",
31+
]
32+
}
33+
34+
actions = [
35+
"sts:AssumeRole",
36+
]
37+
}
38+
}
39+
40+
# tfsec:ignore:aws-iam-no-policy-wildcards
41+
data "aws_iam_policy_document" "lambda" {
42+
statement {
43+
sid = "AllowLogging"
44+
effect = "Allow"
45+
46+
actions = [
47+
"logs:CreateLogStream",
48+
"logs:PutLogEvents",
49+
]
50+
51+
resources = [
52+
"${aws_cloudwatch_log_group.lambda.arn}:*",
53+
]
54+
}
55+
56+
statement {
57+
sid = "PutEvents"
58+
effect = "Allow"
59+
60+
actions = [
61+
"events:PutEvents",
62+
]
63+
64+
resources = [
65+
var.control_plane_bus_arn,
66+
var.data_plane_bus_arn,
67+
]
68+
}
69+
70+
statement {
71+
sid = "KMSCloudwatchKeyAccess"
72+
effect = "Allow"
73+
74+
actions = [
75+
"kms:GenerateDataKey",
76+
"kms:Decrypt",
77+
]
78+
79+
resources = [
80+
var.kms_key_arn
81+
]
82+
}
83+
}

‎infrastructure/modules/eventpub/iam_role_sns.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
resource "aws_iam_role" "sns_role" {
2+
name = "${local.csi}-sns-role"
3+
assume_role_policy = data.aws_iam_policy_document.sns_assume_role.json
4+
}
5+
6+
resource "aws_iam_policy" "firehose_delivery" {
7+
count = var.enable_event_cache ? 1 : 0
8+
9+
name = "${local.csi}-${var.name}-firehose-delivery"
10+
description = "Delivery Policy for ${local.csi}-${var.name} Firehose"
11+
policy = data.aws_iam_policy_document.firehose_delivery[0].json
12+
}
13+
14+
resource "aws_iam_role_policy_attachment" "firehose_delivery" {
15+
count = var.enable_event_cache ? 1 : 0
16+
17+
role = aws_iam_role.sns_role.name
18+
policy_arn = aws_iam_policy.firehose_delivery[0].arn
19+
}
20+
21+
22+
data "aws_iam_policy_document" "sns_assume_role" {
23+
statement {
24+
effect = "Allow"
25+
26+
principals {
27+
type = "Service"
28+
identifiers = ["sns.amazonaws.com"]
29+
}
30+
31+
actions = ["sts:AssumeRole"]
32+
}
33+
}
34+
35+
data "aws_iam_policy_document" "firehose_delivery" {
36+
count = var.enable_event_cache ? 1 : 0
37+
38+
statement {
39+
sid = "AllowFirehoseDelivery"
40+
effect = "Allow"
41+
42+
actions = [
43+
"firehose:PutRecord",
44+
"firehose:PutRecordBatch"
45+
]
46+
47+
resources = [
48+
"${aws_kinesis_firehose_delivery_stream.main[0].arn}",
49+
]
50+
}
51+
}

0 commit comments

Comments
 (0)