immunisation-fhir-api/infrastructure/instance/modules/mns_publisher/mns_outbound_events_eb_pipe.tf at 56581e4f4e90d4f479105be1e181872bdd199c00 · NHSDigital/immunisation-fhir-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
# IAM Role for EventBridge Pipe
resource "aws_iam_role" "mns_outbound_events_eb_pipe" {
  name = "${var.mns_publisher_resource_name_prefix}-eventbridge-pipe-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "pipes.amazonaws.com"
        }
        Condition = {
          StringEquals = {
            "aws:SourceAccount" = var.immunisation_account_id
          }
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "mns_outbound_events_eb_pipe_source_policy" {
  role = aws_iam_role.mns_outbound_events_eb_pipe.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        "Effect" : "Allow",
        "Action" : [
          "dynamodb:DescribeStream",
          "dynamodb:GetRecords",
          "dynamodb:GetShardIterator",
          "dynamodb:ListStreams"
        ],
        "Resource" : var.ddb_delta_stream_arn
      },
      {
        "Effect" : "Allow",
        "Action" : [
          "kms:Decrypt",
          "kms:GenerateDataKey"
        ],
        "Resource" : var.dynamo_kms_encryption_key_arn
      },
    ]
  })
}

resource "aws_iam_role_policy" "mns_outbound_events_eb_pipe_target_policy" {
  role = aws_iam_role.mns_outbound_events_eb_pipe.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "sqs:GetQueueAttributes",
          "sqs:SendMessage",
        ],
        Resource = [
          aws_sqs_queue.mns_outbound_events.arn,
        ]
      },
    ]
  })
}

resource "aws_iam_role_policy" "mns_outbound_events_eb_pipe_cw_log_policy" {
  role = aws_iam_role.mns_outbound_events_eb_pipe.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ],
        Resource = [
          "arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/vendedlogs/pipes/${var.mns_publisher_resource_name_prefix}-pipe-logs:*",
        ]
      },
    ]
  })
}

resource "aws_cloudwatch_log_group" "mns_outbound_events_eb_pipe" {
  name              = "/aws/vendedlogs/pipes/${var.mns_publisher_resource_name_prefix}-pipe-logs"
  retention_in_days = 30
}

resource "aws_pipes_pipe" "mns_outbound_events" {
  depends_on = [
    aws_iam_role_policy.mns_outbound_events_eb_pipe_source_policy,
    aws_iam_role_policy.mns_outbound_events_eb_pipe_target_policy,
    aws_iam_role_policy.mns_outbound_events_eb_pipe_cw_log_policy,
  ]
  name     = "${var.mns_publisher_resource_name_prefix}-pipe"
  role_arn = aws_iam_role.mns_outbound_events_eb_pipe.arn
  source   = var.ddb_delta_stream_arn
  target   = aws_sqs_queue.mns_outbound_events.arn

  source_parameters {
    dynamodb_stream_parameters {
      starting_position = "TRIM_HORIZON"
    }
  }

  log_configuration {
    include_execution_data = ["ALL"]
    level                  = "ERROR"
    cloudwatch_logs_log_destination {
      log_group_arn = aws_cloudwatch_log_group.mns_outbound_events_eb_pipe.arn
    }
  }
}