Skip to content

Commit f511c43

Browse files
PedroSoaresNHSPedroSoaresNHS
authored
[PRMP-1538] Remove SES execution (#626)
1 parent 6e4e34e commit f511c43

13 files changed

Lines changed: 377 additions & 371 deletions

‎infrastructure/dns_email_auth.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
resource "aws_route53_record" "dmarc" {
2-
count = local.is_shared_workspace ? 1 : 0
3-
zone_id = module.route53_fargate_ui.zone_id
4-
name = "_dmarc.${var.domain}"
5-
type = "TXT"
6-
ttl = 300
7-
8-
records = ["v=DMARC1; p=none; adkim=s; aspf=s"]
9-
}
1+
# resource "aws_route53_record" "dmarc" {
2+
# count = local.is_shared_workspace ? 1 : 0
3+
# zone_id = module.route53_fargate_ui.zone_id
4+
# name = "_dmarc.${var.domain}"
5+
# type = "TXT"
6+
# ttl = 300
7+
#
8+
# records = ["v=DMARC1; p=none; adkim=s; aspf=s"]
9+
# }

‎infrastructure/iam.tf‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -354,37 +354,37 @@ resource "aws_iam_policy" "s3_document_data_policy_post_document_review_lambda"
354354
})
355355
}
356356

357-
data "aws_iam_policy_document" "reporting_ses" {
358-
statement {
359-
sid = "SESAccess"
360-
effect = "Allow"
361-
362-
actions = [
363-
"ses:SendEmail",
364-
"ses:SendRawEmail"
365-
]
366-
367-
resources = [
368-
"arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
369-
"arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/${aws_ses_configuration_set.reporting.name}"
370-
]
371-
372-
condition {
373-
test = "StringEquals"
374-
variable = "ses:FromAddress"
375-
values = [local.reporting_ses_from_address_value]
376-
}
377-
}
378-
}
379-
380-
data "aws_iam_policy_document" "ses_feedback_s3_put" {
381-
statement {
382-
effect = "Allow"
383-
actions = [
384-
"s3:PutObject"
385-
]
386-
resources = [
387-
"${module.ses-feedback-store.bucket_arn}/ses-feedback/*"
388-
]
389-
}
390-
}
357+
# data "aws_iam_policy_document" "reporting_ses" {
358+
# statement {
359+
# sid = "SESAccess"
360+
# effect = "Allow"
361+
#
362+
# actions = [
363+
# "ses:SendEmail",
364+
# "ses:SendRawEmail"
365+
# ]
366+
#
367+
# resources = [
368+
# "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
369+
# "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/${aws_ses_configuration_set.reporting.name}"
370+
# ]
371+
#
372+
# condition {
373+
# test = "StringEquals"
374+
# variable = "ses:FromAddress"
375+
# values = [local.reporting_ses_from_address_value]
376+
# }
377+
# }
378+
# }
379+
#
380+
# data "aws_iam_policy_document" "ses_feedback_s3_put" {
381+
# statement {
382+
# effect = "Allow"
383+
# actions = [
384+
# "s3:PutObject"
385+
# ]
386+
# resources = [
387+
# "${module.ses-feedback-store.bucket_arn}/ses-feedback/*"
388+
# ]
389+
# }
390+
# }

‎infrastructure/kms_sns.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ module "sns_encryption_key" {
44
kms_key_description = "Custom KMS Key to enable server side encryption for sns subscriptions"
55
environment = var.environment
66
owner = var.owner
7-
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com", "ses.amazonaws.com"]
7+
# service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com", "ses.amazonaws.com"]
8+
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com"]
89
kms_deletion_window = var.kms_deletion_window
910
}

‎infrastructure/lambda-report-distribution.tf‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
module "report-distribution-lambda" {
2-
source = "./modules/lambda"
3-
name = "ReportDistribution"
4-
handler = "handlers.report_distribution_handler.lambda_handler"
5-
lambda_timeout = 300
6-
7-
iam_role_policy_documents = [
8-
module.ndr-report-store.s3_read_policy_document,
9-
module.bulk_upload_contact_lookup_table.dynamodb_read_policy_document,
10-
data.aws_iam_policy_document.reporting_ses.json,
11-
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
12-
]
13-
14-
lambda_environment_variables = {
15-
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16-
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17-
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18-
WORKSPACE = terraform.workspace
19-
20-
REPORT_BUCKET_NAME = module.ndr-report-store.bucket_id
21-
CONTACT_TABLE_NAME = module.bulk_upload_contact_lookup_table.table_name
22-
23-
PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
24-
SES_FROM_ADDRESS = local.reporting_ses_from_address_value
25-
SES_CONFIGURATION_SET = aws_ses_configuration_set.reporting.name
26-
}
27-
28-
is_gateway_integration_needed = false
29-
is_invoked_from_gateway = false
30-
}
1+
# module "report-distribution-lambda" {
2+
# source = "./modules/lambda"
3+
# name = "ReportDistribution"
4+
# handler = "handlers.report_distribution_handler.lambda_handler"
5+
# lambda_timeout = 300
6+
#
7+
# iam_role_policy_documents = [
8+
# module.ndr-report-store.s3_read_policy_document,
9+
# module.bulk_upload_contact_lookup_table.dynamodb_read_policy_document,
10+
# data.aws_iam_policy_document.reporting_ses.json,
11+
# data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
12+
# ]
13+
#
14+
# lambda_environment_variables = {
15+
# APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16+
# APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17+
# APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18+
# WORKSPACE = terraform.workspace
19+
#
20+
# REPORT_BUCKET_NAME = module.ndr-report-store.bucket_id
21+
# CONTACT_TABLE_NAME = module.bulk_upload_contact_lookup_table.table_name
22+
#
23+
# PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
24+
# SES_FROM_ADDRESS = local.reporting_ses_from_address_value
25+
# SES_CONFIGURATION_SET = aws_ses_configuration_set.reporting.name
26+
# }
27+
#
28+
# is_gateway_integration_needed = false
29+
# is_invoked_from_gateway = false
30+
# }

‎infrastructure/lambda-ses-feedback-monitor.tf‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,32 @@
1-
module "ses-feedback-monitor-lambda" {
2-
source = "./modules/lambda"
3-
name = "SesFeedbackMonitor"
4-
handler = "handlers.ses_feedback_monitor_handler.lambda_handler"
5-
lambda_timeout = 60
6-
7-
iam_role_policy_documents = [
8-
data.aws_iam_policy_document.ses_feedback_s3_put.json,
9-
data.aws_iam_policy_document.reporting_ses.json,
10-
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
11-
]
12-
13-
lambda_environment_variables = {
14-
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
15-
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
16-
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
17-
WORKSPACE = terraform.workspace
18-
19-
SES_FEEDBACK_BUCKET_NAME = module.ses-feedback-store.bucket_id
20-
SES_FEEDBACK_PREFIX = "ses-feedback/"
21-
PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
22-
SES_FROM_ADDRESS = local.reporting_ses_from_address_value
23-
ALERT_ON_EVENT_TYPES = "BOUNCE,REJECT"
24-
}
25-
26-
is_gateway_integration_needed = false
27-
is_invoked_from_gateway = false
28-
29-
depends_on = [
30-
module.ses-feedback-store
31-
]
32-
}
1+
# module "ses-feedback-monitor-lambda" {
2+
# source = "./modules/lambda"
3+
# name = "SesFeedbackMonitor"
4+
# handler = "handlers.ses_feedback_monitor_handler.lambda_handler"
5+
# lambda_timeout = 60
6+
#
7+
# iam_role_policy_documents = [
8+
# data.aws_iam_policy_document.ses_feedback_s3_put.json,
9+
# data.aws_iam_policy_document.reporting_ses.json,
10+
# data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
11+
# ]
12+
#
13+
# lambda_environment_variables = {
14+
# APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
15+
# APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
16+
# APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
17+
# WORKSPACE = terraform.workspace
18+
#
19+
# SES_FEEDBACK_BUCKET_NAME = module.ses-feedback-store.bucket_id
20+
# SES_FEEDBACK_PREFIX = "ses-feedback/"
21+
# PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
22+
# SES_FROM_ADDRESS = local.reporting_ses_from_address_value
23+
# ALERT_ON_EVENT_TYPES = "BOUNCE,REJECT"
24+
# }
25+
#
26+
# is_gateway_integration_needed = false
27+
# is_invoked_from_gateway = false
28+
#
29+
# depends_on = [
30+
# module.ses-feedback-store
31+
# ]
32+
# }

‎infrastructure/modules/sns/README.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ module "sns_topic" {
7979
| Name | Type |
8080
|------|------|
8181
| [aws_sns_topic.sns_topic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
82-
| [aws_sns_topic_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |
8382
| [aws_sns_topic_subscription.sns_subscription_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
8483
| [aws_sns_topic_subscription.sns_subscription_single](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
8584

@@ -90,16 +89,13 @@ module "sns_topic" {
9089
| <a name="input_delivery_policy"></a> [delivery\_policy](#input\_delivery\_policy) | Attach delivery or IAM policy. (Legacy name; used as topic policy JSON in this module.) | `string` | n/a | yes |
9190
| <a name="input_enable_deduplication"></a> [enable\_deduplication](#input\_enable\_deduplication) | Prevent content based duplication in notification queue. | `bool` | `false` | no |
9291
| <a name="input_enable_fifo"></a> [enable\_fifo](#input\_enable\_fifo) | Attach first in first out policy to notification queue. | `bool` | `false` | no |
93-
| <a name="input_enable_ses_publish"></a> [enable\_ses\_publish](#input\_enable\_ses\_publish) | If true, module appends a statement allowing ses.amazonaws.com to SNS:Publish to this topic. | `bool` | `false` | no |
9492
| <a name="input_is_topic_endpoint_list"></a> [is\_topic\_endpoint\_list](#input\_is\_topic\_endpoint\_list) | Whether to use the topic\_endpoint\_list instead of a single topic\_endpoint. | `bool` | `false` | no |
9593
| <a name="input_raw_message_delivery"></a> [raw\_message\_delivery](#input\_raw\_message\_delivery) | Whether to enable raw message delivery for the SNS subscription. | `bool` | `false` | no |
96-
| <a name="input_ses_source_account_id"></a> [ses\_source\_account\_id](#input\_ses\_source\_account\_id) | AWS account ID used in the AWS:SourceAccount condition for SES publishing. | `string` | `""` | no |
9794
| <a name="input_sns_encryption_key_id"></a> [sns\_encryption\_key\_id](#input\_sns\_encryption\_key\_id) | The ARN (or ID) of the KMS key used for encrypting the SNS topic. | `string` | n/a | yes |
9895
| <a name="input_sqs_feedback"></a> [sqs\_feedback](#input\_sqs\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback. | `map(string)` | `{}` | no |
9996
| <a name="input_topic_endpoint"></a> [topic\_endpoint](#input\_topic\_endpoint) | A single endpoint (e.g., SQS queue or Lambda function ARN) to subscribe to the topic. | `any` | `null` | no |
10097
| <a name="input_topic_endpoint_list"></a> [topic\_endpoint\_list](#input\_topic\_endpoint\_list) | A list of endpoints (e.g., SQS ARNs) to subscribe to the topic. | `any` | `[]` | no |
10198
| <a name="input_topic_name"></a> [topic\_name](#input\_topic\_name) | Name of the SNS topic. | `string` | n/a | yes |
102-
| <a name="input_topic_policy_json"></a> [topic\_policy\_json](#input\_topic\_policy\_json) | Optional SNS topic access policy JSON. If set, it overrides delivery\_policy. | `string` | `null` | no |
10399
| <a name="input_topic_protocol"></a> [topic\_protocol](#input\_topic\_protocol) | The protocol to use for the subscription (e.g., 'sqs', 'lambda'). | `string` | n/a | yes |
104100

105101
## Outputs

‎infrastructure/modules/sns/main.tf‎

Lines changed: 49 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,49 @@
1-
locals {
2-
base_topic_policy_json = var.topic_policy_json != null ? var.topic_policy_json : var.delivery_policy
3-
base_topic_policy_obj = jsondecode(local.base_topic_policy_json)
4-
normalized_statements = [
5-
for s in try(local.base_topic_policy_obj["Statement"], []) : merge(
6-
s,
7-
{
8-
Resource = (
9-
try(s["Resource"], null) == "*" || try(s["Resource"], null) == null
10-
? aws_sns_topic.sns_topic.arn
11-
: s["Resource"]
12-
)
13-
}
14-
)
15-
]
16-
17-
ses_publish_statement = var.enable_ses_publish ? {
18-
Sid = "AllowSESPublish"
19-
Effect = "Allow"
20-
Principal = {
21-
Service = "ses.amazonaws.com"
22-
}
23-
Action = "SNS:Publish"
24-
Resource = aws_sns_topic.sns_topic.arn
25-
Condition = {
26-
StringEquals = {
27-
"AWS:SourceAccount" = var.ses_source_account_id
28-
}
29-
}
30-
} : null
31-
32-
effective_topic_policy_obj = merge(
33-
local.base_topic_policy_obj,
34-
{
35-
Statement = concat(
36-
local.normalized_statements,
37-
var.enable_ses_publish ? [local.ses_publish_statement] : []
38-
)
39-
}
40-
)
41-
effective_topic_policy_json = jsonencode(local.effective_topic_policy_obj)
42-
}
1+
# locals {
2+
# base_topic_policy_json = var.topic_policy_json != null ? var.topic_policy_json : var.delivery_policy
3+
# base_topic_policy_obj = jsondecode(local.base_topic_policy_json)
4+
# normalized_statements = [
5+
# for s in try(local.base_topic_policy_obj["Statement"], []) : merge(
6+
# s,
7+
# {
8+
# Resource = (
9+
# try(s["Resource"], null) == "*" || try(s["Resource"], null) == null
10+
# ? aws_sns_topic.sns_topic.arn
11+
# : s["Resource"]
12+
# )
13+
# }
14+
# )
15+
# ]
16+
#
17+
# ses_publish_statement = var.enable_ses_publish ? {
18+
# Sid = "AllowSESPublish"
19+
# Effect = "Allow"
20+
# Principal = {
21+
# Service = "ses.amazonaws.com"
22+
# }
23+
# Action = "SNS:Publish"
24+
# Resource = aws_sns_topic.sns_topic.arn
25+
# Condition = {
26+
# StringEquals = {
27+
# "AWS:SourceAccount" = var.ses_source_account_id
28+
# }
29+
# }
30+
# } : null
31+
#
32+
# effective_topic_policy_obj = merge(
33+
# local.base_topic_policy_obj,
34+
# {
35+
# Statement = concat(
36+
# local.normalized_statements,
37+
# var.enable_ses_publish ? [local.ses_publish_statement] : []
38+
# )
39+
# }
40+
# )
41+
# effective_topic_policy_json = jsonencode(local.effective_topic_policy_obj)
42+
# }
4343

4444
resource "aws_sns_topic" "sns_topic" {
4545
name_prefix = "${terraform.workspace}-sns-${var.topic_name}"
46+
policy = var.delivery_policy
4647
fifo_topic = var.enable_fifo
4748
content_based_deduplication = var.enable_deduplication
4849
kms_master_key_id = var.sns_encryption_key_id
@@ -52,10 +53,10 @@ resource "aws_sns_topic" "sns_topic" {
5253
sqs_success_feedback_sample_rate = try(var.sqs_feedback.success_sample_rate, null)
5354
}
5455

55-
resource "aws_sns_topic_policy" "this" {
56-
arn = aws_sns_topic.sns_topic.arn
57-
policy = local.effective_topic_policy_json
58-
}
56+
# resource "aws_sns_topic_policy" "this" {
57+
# arn = aws_sns_topic.sns_topic.arn
58+
# policy = local.effective_topic_policy_json
59+
# }
5960

6061
resource "aws_sns_topic_subscription" "sns_subscription_single" {
6162
count = var.is_topic_endpoint_list ? 0 : 1
@@ -64,7 +65,7 @@ resource "aws_sns_topic_subscription" "sns_subscription_single" {
6465
endpoint = var.topic_endpoint
6566
raw_message_delivery = var.raw_message_delivery
6667

67-
depends_on = [aws_sns_topic_policy.this]
68+
# depends_on = [aws_sns_topic_policy.this]
6869
}
6970

7071
resource "aws_sns_topic_subscription" "sns_subscription_list" {
@@ -74,7 +75,7 @@ resource "aws_sns_topic_subscription" "sns_subscription_list" {
7475
endpoint = each.value
7576
raw_message_delivery = var.raw_message_delivery
7677

77-
depends_on = [aws_sns_topic_policy.this]
78+
# depends_on = [aws_sns_topic_policy.this]
7879
}
7980

8081
output "arn" {

0 commit comments

Comments
 (0)