nhs-notify-supplier-api/infrastructure/terraform/components/api/modules_eventpub.tf at 4f44a8f9d5a3fef9632ca4e4346ad17a4ef3a3ca · NHSDigital/nhs-notify-supplier-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
module "eventpub" {
  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/4.0.10/terraform-eventpub.zip"

  name = "eventpub"

  aws_account_id = var.aws_account_id
  component      = var.component
  environment    = var.environment
  project        = var.project
  region         = var.region
  group          = var.group

  default_tags = local.default_tags

  kms_key_arn           = module.kms.key_arn
  log_retention_in_days = var.log_retention_in_days
  log_level             = "INFO"

  force_destroy = var.force_destroy

  event_cache_buffer_interval        = 500
  enable_sns_delivery_logging        = var.enable_sns_delivery_logging
  sns_success_logging_sample_percent = var.sns_success_logging_sample_percent
  access_logging_bucket              = local.acct.s3_buckets["access_logs"]["id"]

  event_cache_expiry_days = 30
  enable_event_cache      = var.enable_event_cache
  data_plane_bus_arn      = var.eventpub_data_plane_bus_arn
  control_plane_bus_arn   = var.eventpub_control_plane_bus_arn

  additional_policies_for_event_cache_bucket = [
    data.aws_iam_policy_document.eventcache[0].json
  ]

  enable_event_anomaly_detection   = var.enable_event_anomaly_detection
  event_anomaly_band_width         = var.event_anomaly_band_width
  event_anomaly_evaluation_periods = var.event_anomaly_evaluation_periods
  event_anomaly_period             = var.event_anomaly_period
}

data "aws_iam_policy_document" "eventcache" {
  count = local.event_cache_bucket_name != null ? 1 : 0
  statement {
    sid    = "AllowGlueListBucketAndGetLocation"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.glue_role.arn]
    }

    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]

    resources = [
      "arn:aws:s3:::${local.csi_global}-eventcache"
    ]
  }

  # Object-level permissions: Get/Put/Delete objects
  statement {
    sid    = "AllowGlueObjectAccess"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.glue_role.arn]
    }

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:PutObject",
      "s3:DeleteObject"
    ]

    resources = [
      "arn:aws:s3:::${local.csi_global}-eventcache/*"
    ]
  }
}