immunisation-fhir-api/infrastructure/instance/sqs_id_sync.tf at d81135a744a190b38737c673a48e3ed4b2385329 · NHSDigital/immunisation-fhir-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
resource "aws_sqs_queue" "id_sync_queue" {
  name                       = "imms-${local.resource_scope}-id-sync-queue"
  kms_master_key_id          = data.aws_kms_key.existing_id_sync_sqs_encryption_key.arn
  visibility_timeout_seconds = 1080 # as per AWS docs to be 6 times the Lambda function timeout but kept to 3 times
  redrive_policy = jsonencode({
    deadLetterTargetArn = aws_sqs_queue.id_sync_dlq.arn
    maxReceiveCount     = 4
  })
}

resource "aws_sqs_queue" "id_sync_dlq" {
  name = "imms-${local.resource_scope}-id-sync-dlq"
}

resource "aws_sqs_queue_redrive_allow_policy" "id_sync_queue_redrive_allow_policy" {
  queue_url = aws_sqs_queue.id_sync_dlq.id

  redrive_allow_policy = jsonencode({
    redrivePermission = "byQueue",
    sourceQueueArns   = [aws_sqs_queue.id_sync_queue.arn]
  })
}

data "aws_iam_policy_document" "id_sync_sqs_policy" {
  statement {
    sid    = "mns-allow-send"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.mns_account_id}:role/nhs-mns-events-lambda-delivery"]
    }

    actions = [
      "sqs:SendMessage",
    ]

    resources = [
      aws_sqs_queue.id_sync_queue.arn
    ]
  }

  statement {
    sid    = "id-sync-allow-receive"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.id_sync_lambda_exec_role.arn]
    }

    actions = [
      "sqs:ReceiveMessage",
    ]

    resources = [
      aws_sqs_queue.id_sync_queue.arn
    ]
  }
}

resource "aws_sqs_queue_policy" "id_sync_sqs_policy" {
  queue_url = aws_sqs_queue.id_sync_queue.id
  policy    = data.aws_iam_policy_document.id_sync_sqs_policy.json
}