Skip to content

Commit d7f17a8

Browse files
paulschwarzenbergerpaulschwarzenberger
committed
SNS topic
1 parent 5feeb7e commit d7f17a8

File tree

11 files changed

+232
-0
lines changed

11 files changed

+232
-0
lines changed

‎main.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ module "create_rsa_root_ca_lambda" {
190190
domain = var.hosted_zone_domain
191191
runtime = var.runtime
192192
public_crl = var.public_crl
193+
sns_topic_arn = module.sns.sns_topic_arn
193194
}
194195

195196
module "create_rsa_issuing_ca_lambda" {
@@ -210,6 +211,7 @@ module "create_rsa_issuing_ca_lambda" {
210211
domain = var.hosted_zone_domain
211212
runtime = var.runtime
212213
public_crl = var.public_crl
214+
sns_topic_arn = module.sns.sns_topic_arn
213215
}
214216

215217
module "rsa_root_ca_crl_lambda" {
@@ -232,6 +234,7 @@ module "rsa_root_ca_crl_lambda" {
232234
domain = var.hosted_zone_domain
233235
runtime = var.runtime
234236
public_crl = var.public_crl
237+
sns_topic_arn = module.sns.sns_topic_arn
235238
}
236239

237240
module "rsa_issuing_ca_crl_lambda" {
@@ -254,6 +257,7 @@ module "rsa_issuing_ca_crl_lambda" {
254257
domain = var.hosted_zone_domain
255258
runtime = var.runtime
256259
public_crl = var.public_crl
260+
sns_topic_arn = module.sns.sns_topic_arn
257261
}
258262

259263
module "rsa_tls_cert_lambda" {
@@ -276,6 +280,7 @@ module "rsa_tls_cert_lambda" {
276280
public_crl = var.public_crl
277281
max_cert_lifetime = var.max_cert_lifetime
278282
allowed_invocation_principals = var.aws_principals
283+
sns_topic_arn = module.sns.sns_topic_arn
279284
}
280285

281286
module "cloudfront_certificate" {
@@ -369,3 +374,16 @@ module "db-reader-role" {
369374
policy = "db_reader"
370375
assume_role_policy = "db_reader"
371376
}
377+
378+
module "sns-ca-notifications" {
379+
source = "./modules/terraform-aws-ca-sns"
380+
381+
project = var.project
382+
function = "ca-notifications"
383+
env = var.env
384+
custom_sns_topic_name = var.custom_sns_topic_name
385+
kms_key_arn = coalesce(var.kms_arn_resource, module.kms_tls_keygen.kms_arn)
386+
email_subscriptions = var.sns_email_subscriptions
387+
lambda_subscriptions = var.sns_lambda_subscriptions
388+
sqs_subscriptions = var.sns_sqs_subscriptions
389+
}

‎modules/terraform-aws-ca-lambda/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ resource "aws_lambda_function" "lambda" {
6161
ROOT_CA_INFO = jsonencode(var.root_ca_info)
6262
ROOT_CRL_DAYS = tostring(var.root_crl_days)
6363
ROOT_CRL_SECONDS = tostring(var.root_crl_seconds)
64+
SNS_TOPIC_ARN = var.sns_topic_arn
6465
}
6566
}
6667

‎modules/terraform-aws-ca-lambda/variables.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,10 @@ variable "runtime" {
109109
description = "Lambda language runtime"
110110
}
111111

112+
variable "sns_topic_arn" {
113+
description = "SNS Topic ARN for Lambda function to publish to"
114+
}
115+
112116
variable "subscription_filter_destination" {
113117
description = "CloudWatch log subscription filter destination, last section of ARN"
114118
default = ""

‎modules/terraform-aws-ca-sns/data.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "aws_caller_identity" "current" {}
2+
3+
data "aws_region" "current" {}

‎modules/terraform-aws-ca-sns/locals.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
locals {
2+
sns_topic_name = coalesce(var.custom_sns_topic_name, "${var.project}}-${var.function}-${var.env}")
3+
4+
tags = merge(var.tags, {
5+
Terraform = "true"
6+
Name = local.sns_topic_name,
7+
})
8+
}

‎modules/terraform-aws-ca-sns/main.tf

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
resource "aws_sns_topic" "sns_topic" {
2+
name = local.sns_topic_name
3+
policy = coalesce(var.sns_policy, templatefile("${path.module}/templates/${var.sns_policy_template}.json", { region = data.aws_region.current.id, account_id = data.aws_caller_identity.current.account_id, sns_topic_name = local.sns_topic_name }))
4+
5+
tags = merge(
6+
var.tags,
7+
tomap(
8+
{ "Name" = local.sns_topic_name }
9+
)
10+
)
11+
kms_master_key_id = var.kms_key_arn
12+
}
13+
14+
resource "aws_sns_topic_subscription" "email_subscriptions" {
15+
for_each = toset(var.email_subscriptions)
16+
endpoint = each.key
17+
protocol = "email"
18+
topic_arn = aws_sns_topic.sns_topic.arn
19+
raw_message_delivery = false
20+
}
21+
22+
resource "aws_sns_topic_subscription" "lambda_subscriptions" {
23+
for_each = var.lambda_subscriptions
24+
endpoint = each.value
25+
protocol = "lambda"
26+
topic_arn = aws_sns_topic.sns_topic.arn
27+
raw_message_delivery = false
28+
}
29+
30+
resource "aws_sns_topic_subscription" "sqs_subscriptions" {
31+
for_each = var.sqs_subscriptions
32+
endpoint = each.value
33+
protocol = "sqs"
34+
topic_arn = aws_sns_topic.sns_topic.arn
35+
raw_message_delivery = true
36+
}

‎modules/terraform-aws-ca-sns/outputs.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "sns_topic_arn" {
2+
value = aws_sns_topic.sns_topic.arn
3+
}

‎modules/terraform-aws-ca-sns/templates/default.json

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Id": "default_policy",
4+
"Statement": [
5+
{
6+
"Sid": "default_statement",
7+
"Effect": "Allow",
8+
"Principal": {
9+
"AWS": "*"
10+
},
11+
"Action": [
12+
"sns:GetTopicAttributes",
13+
"sns:SetTopicAttributes",
14+
"sns:AddPermission",
15+
"sns:RemovePermission",
16+
"sns:DeleteTopic",
17+
"sns:Subscribe",
18+
"sns:ListSubscriptionsByTopic",
19+
"sns:Publish",
20+
"sns:Receive"
21+
],
22+
"Resource": "arn:aws:sns:${region}:${account_id}:${sns_topic_name}",
23+
"Condition": {
24+
"StringEquals": {
25+
"AWS:SourceOwner": "${account_id}"
26+
}
27+
}
28+
}
29+
]
30+
}

‎modules/terraform-aws-ca-sns/templates/eventbridge.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Id": "allow_account_access_to_topic_policy",
4+
"Statement": [
5+
{
6+
"Sid": "allow_account_access_to_topic",
7+
"Effect": "Allow",
8+
"Principal": {
9+
"AWS": "*"
10+
},
11+
"Action": [
12+
"sns:GetTopicAttributes",
13+
"sns:SetTopicAttributes",
14+
"sns:AddPermission",
15+
"sns:RemovePermission",
16+
"sns:DeleteTopic",
17+
"sns:Subscribe",
18+
"sns:ListSubscriptionsByTopic",
19+
"sns:Publish",
20+
"sns:Receive"
21+
],
22+
"Resource": "arn:aws:sns:${region}:${account_id}:${sns_topic_name}",
23+
"Condition": {
24+
"StringEquals": {
25+
"AWS:SourceOwner": "${account_id}"
26+
}
27+
}
28+
},
29+
{
30+
"Sid": "allow_eventbridge_access_to_topic",
31+
"Effect": "Allow",
32+
"Principal": {
33+
"Service": "events.amazonaws.com"
34+
},
35+
"Action": "sns:Publish",
36+
"Resource": "arn:aws:sns:${region}:${account_id}:${sns_topic_name}"
37+
}
38+
]
39+
}

‎modules/terraform-aws-ca-sns/variables.tf

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
variable "project" {
2+
description = "abbreviation for the project, forms the first part of the resource name"
3+
default = ""
4+
}
5+
6+
variable "function" {
7+
description = "forms the second part of the resource name"
8+
default = ""
9+
}
10+
11+
variable "env" {
12+
description = "suffix for environment, e.g. dev"
13+
default = ""
14+
}
15+
16+
variable "custom_sns_topic_name" {
17+
description = "Customised SNS topic name, leave empty to use standard naming convention"
18+
default = ""
19+
}
20+
21+
variable "sns_policy" {
22+
description = "A string containing the SNS policy, if used"
23+
default = ""
24+
}
25+
26+
variable "sns_policy_template" {
27+
description = "Name of SNS policy template file, if used"
28+
default = "default"
29+
}
30+
31+
variable "kms_key_arn" {
32+
description = "A KMS key arn to be used to encrypt the queue contents at rest"
33+
default = null
34+
}
35+
36+
variable "email_subscriptions" {
37+
type = list(string)
38+
description = "List of email addresses to subscribe to this topic"
39+
default = []
40+
}
41+
42+
variable "lambda_subscriptions" {
43+
type = map(string)
44+
description = "A map of lambda names to arns to subscribe to this topic"
45+
default = {}
46+
}
47+
48+
variable "sqs_subscriptions" {
49+
type = map(string)
50+
description = "A map of SQS names to arns to subscribe to this topic"
51+
default = {}
52+
}
53+
54+
variable "tags" {
55+
type = map(string)
56+
default = {}
57+
}

0 commit comments

Comments
 (0)