diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index d5886a6..0f34283 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.77.0 + rev: v1.81.0 hooks: - id: terraform_fmt - id: terraform_validate diff --git a/README.md b/README.md index 10fc901..239591a 100644 --- a/README.md +++ b/README.md @@ -390,6 +390,7 @@ No modules. | [aws_iam_policy.kinesis_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.sfn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.sns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.sqs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy_attachment.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | @@ -402,6 +403,7 @@ No modules. | [aws_iam_policy_attachment.kinesis_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | | [aws_iam_policy_attachment.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | | [aws_iam_policy_attachment.sfn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | +| [aws_iam_policy_attachment.sns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | | [aws_iam_policy_attachment.sqs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | | [aws_iam_policy_attachment.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | | [aws_iam_role.eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | @@ -419,6 +421,7 @@ No modules. | [aws_iam_policy_document.kinesis_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.sfn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.sns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.sqs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | ## Inputs @@ -442,6 +445,7 @@ No modules. | [attach\_policy\_jsons](#input\_attach\_policy\_jsons) | Controls whether policy\_jsons should be added to IAM role | `bool` | `false` | no | | [attach\_policy\_statements](#input\_attach\_policy\_statements) | Controls whether policy\_statements should be added to IAM role | `bool` | `false` | no | | [attach\_sfn\_policy](#input\_attach\_sfn\_policy) | Controls whether the StepFunction policy should be added to IAM role for EventBridge Target | `bool` | `false` | no | +| [attach\_sns\_policy](#input\_attach\_sns\_policy) | Controls whether the SNS policy should be added to IAM role for EventBridge Target | `bool` | `false` | no | | [attach\_sqs\_policy](#input\_attach\_sqs\_policy) | Controls whether the SQS policy should be added to IAM role for EventBridge Target | `bool` | `false` | no | | [attach\_tracing\_policy](#input\_attach\_tracing\_policy) | Controls whether X-Ray tracing policy should be added to IAM role for EventBridge | `bool` | `false` | no | | [bus\_name](#input\_bus\_name) | A unique name for your EventBridge Bus | `string` | `"default"` | no | @@ -479,6 +483,7 @@ No modules. | [rules](#input\_rules) | A map of objects with EventBridge Rule definitions. | `map(any)` | `{}` | no | | [schemas\_discoverer\_description](#input\_schemas\_discoverer\_description) | Default schemas discoverer description | `string` | `"Auto schemas discoverer event"` | no | | [sfn\_target\_arns](#input\_sfn\_target\_arns) | The Amazon Resource Name (ARN) of the StepFunctions you want to use as EventBridge targets | `list(string)` | `[]` | no | +| [sns\_target\_arns](#input\_sns\_target\_arns) | The Amazon Resource Name (ARN) of the AWS SNS's you want to use as EventBridge targets | `list(string)` | `[]` | no | | [sqs\_target\_arns](#input\_sqs\_target\_arns) | The Amazon Resource Name (ARN) of the AWS SQS Queues you want to use as EventBridge targets | `list(string)` | `[]` | no | | [tags](#input\_tags) | A map of tags to assign to resources. | `map(string)` | `{}` | no | | [targets](#input\_targets) | A map of objects with EventBridge Target definitions. | `any` | `{}` | no | diff --git a/examples/api-gateway-event-source/main.tf b/examples/api-gateway-event-source/main.tf index 49166d5..bfa10d1 100644 --- a/examples/api-gateway-event-source/main.tf +++ b/examples/api-gateway-event-source/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/complete/main.tf b/examples/complete/main.tf index a2eb2ba..998f9e6 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/default-bus/main.tf b/examples/default-bus/main.tf index b487942..362c017 100644 --- a/examples/default-bus/main.tf +++ b/examples/default-bus/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/with-api-destination/main.tf b/examples/with-api-destination/main.tf index 7542787..e207290 100644 --- a/examples/with-api-destination/main.tf +++ b/examples/with-api-destination/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/with-archive/main.tf b/examples/with-archive/main.tf index 31d52c4..f5f4623 100644 --- a/examples/with-archive/main.tf +++ b/examples/with-archive/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/with-ecs-scheduling/main.tf b/examples/with-ecs-scheduling/main.tf index bbae3ec..a1515ef 100644 --- a/examples/with-ecs-scheduling/main.tf +++ b/examples/with-ecs-scheduling/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/with-lambda-scheduling/main.tf b/examples/with-lambda-scheduling/main.tf index 7ada3fa..6498ba6 100644 --- a/examples/with-lambda-scheduling/main.tf +++ b/examples/with-lambda-scheduling/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/examples/with-permissions/main.tf b/examples/with-permissions/main.tf index 9dbbc76..0f0d711 100644 --- a/examples/with-permissions/main.tf +++ b/examples/with-permissions/main.tf @@ -2,7 +2,6 @@ provider "aws" { region = "ap-southeast-1" # Make it faster by skipping something - skip_get_ec2_platforms = true skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true diff --git a/iam.tf b/iam.tf index 30e61a2..55927f9 100644 --- a/iam.tf +++ b/iam.tf @@ -168,6 +168,51 @@ resource "aws_iam_policy_attachment" "sqs" { policy_arn = aws_iam_policy.sqs[0].arn } +############# +# SNS Config +############# + +data "aws_iam_policy_document" "sns" { + count = local.create_role && var.attach_sns_policy ? 1 : 0 + + statement { + sid = "SNSAccess" + effect = "Allow" + actions = [ + "sns:Publish", + ] + resources = var.sns_target_arns + } + + statement { + sid = "SNSKMSAccess" + effect = "Allow" + actions = [ + "kms:Decrypt", + "kms:GenerateDataKey" + ] + resources = ["*"] + } + +} + +resource "aws_iam_policy" "sns" { + count = local.create_role && var.attach_sns_policy ? 1 : 0 + + name = "${local.role_name}-sns" + policy = data.aws_iam_policy_document.sns[0].json + + tags = merge({ Name = "${local.role_name}-sns" }, var.tags) +} + +resource "aws_iam_policy_attachment" "sns" { + count = local.create_role && var.attach_sns_policy ? 1 : 0 + + name = "${local.role_name}-sns" + roles = [aws_iam_role.eventbridge[0].name] + policy_arn = aws_iam_policy.sns[0].arn +} + ############# # ECS Config ############# diff --git a/variables.tf b/variables.tf index 6635fc0..e598631 100644 --- a/variables.tf +++ b/variables.tf @@ -200,6 +200,12 @@ variable "attach_sqs_policy" { default = false } +variable "attach_sns_policy" { + description = "Controls whether the SNS policy should be added to IAM role for EventBridge Target" + type = bool + default = false +} + variable "attach_ecs_policy" { description = "Controls whether the ECS policy should be added to IAM role for EventBridge Target" type = bool @@ -254,6 +260,12 @@ variable "sqs_target_arns" { default = [] } +variable "sns_target_arns" { + description = "The Amazon Resource Name (ARN) of the AWS SNS's you want to use as EventBridge targets" + type = list(string) + default = [] +} + variable "ecs_target_arns" { description = "The Amazon Resource Name (ARN) of the AWS ECS Tasks you want to use as EventBridge targets" type = list(string)