Skip to content

Commit 707b407

Browse files
bryantbiggsantonbabenko
bryantbiggs
and
antonbabenko
authored
feat!: Add support for SNS topic filtering, subscriptions, and topic policy creation (#36)
Co-authored-by: Anton Babenko <[email protected]> Resolves undefined
1 parent 117400e commit 707b407

File tree

17 files changed

+1021
-178
lines changed

17 files changed

+1021
-178
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ repos:
33
rev: v1.77.0
44
hooks:
55
- id: terraform_fmt
6+
- id: terraform_wrapper_module_for_each
67
- id: terraform_validate
78
- id: terraform_docs
89
args:

‎README.md‎

Lines changed: 141 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,34 +2,146 @@
22

33
Terraform module which creates SNS resources on AWS
44

5+
[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
6+
57
## Usage
68

9+
### Simple Topic
10+
11+
```hcl
12+
module "sns_topic" {
13+
source = "terraform-aws-modules/sns/aws"
14+
15+
name = "simple"
16+
17+
tags = {
18+
Environment = "dev"
19+
Terraform = "true"
20+
}
21+
}
22+
```
23+
24+
### Topic w/ SQS Subscription
25+
26+
```hcl
27+
module "sns_topic" {
28+
source = "terraform-aws-modules/sns/aws"
29+
30+
name = "pub-sub"
31+
32+
topic_policy_statements = {
33+
pub = {
34+
actions = ["sns:Publish"]
35+
principals = [{
36+
type = "AWS"
37+
identifiers = ["arn:aws:iam::66666666666:role/publisher"]
38+
}]
39+
},
40+
41+
sub = {
42+
actions = [
43+
"sns:Subscribe",
44+
"sns:Receive",
45+
]
46+
47+
principals = [{
48+
type = "AWS"
49+
identifiers = ["*"]
50+
}]
51+
52+
conditions = [{
53+
test = "StringLike"
54+
variable = "sns:Endpoint"
55+
values = ["arn:aws:sqs:eu-west-1:11111111111:subscriber"]
56+
}]
57+
}
58+
}
59+
60+
subscriptions = {
61+
sqs = {
62+
protocol = "sqs"
63+
endpoint = "arn:aws:sqs:eu-west-1:11111111111:subscriber"
64+
}
65+
}
66+
67+
tags = {
68+
Environment = "dev"
69+
Terraform = "true"
70+
}
71+
}
72+
```
73+
74+
### FIFO Topic w/ FIFO SQS Subscription
75+
776
```hcl
877
module "sns_topic" {
978
source = "terraform-aws-modules/sns/aws"
10-
version = "~> 3.0"
1179
1280
name = "my-topic"
81+
82+
# SQS queue must be FIFO as well
83+
fifo_topic = true
84+
content_based_deduplication = true
85+
86+
topic_policy_statements = {
87+
pub = {
88+
actions = ["sns:Publish"]
89+
principals = [{
90+
type = "AWS"
91+
identifiers = ["arn:aws:iam::66666666666:role/publisher"]
92+
}]
93+
},
94+
95+
sub = {
96+
actions = [
97+
"sns:Subscribe",
98+
"sns:Receive",
99+
]
100+
101+
principals = [{
102+
type = "AWS"
103+
identifiers = ["*"]
104+
}]
105+
106+
conditions = [{
107+
test = "StringLike"
108+
variable = "sns:Endpoint"
109+
values = ["arn:aws:sqs:eu-west-1:11111111111:subscriber.fifo"]
110+
}]
111+
}
112+
}
113+
114+
subscriptions = {
115+
sqs = {
116+
protocol = "sqs"
117+
endpoint = "arn:aws:sqs:eu-west-1:11111111111:subscriber.fifo"
118+
}
119+
}
120+
121+
tags = {
122+
Environment = "dev"
123+
Terraform = "true"
124+
}
13125
}
14126
```
15127

16128
## Examples
17129

18-
- [Complete SNS topics](https://github.com/terraform-aws-modules/terraform-aws-sns/tree/master/examples/complete)
130+
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-sns/tree/master/examples/complete)
19131

20132
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
21133
## Requirements
22134

23135
| Name | Version |
24136
|------|---------|
25137
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
26-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
138+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.40 |
27139

28140
## Providers
29141

30142
| Name | Version |
31143
|------|---------|
32-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
144+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.40 |
33145

34146
## Modules
35147

@@ -40,45 +152,47 @@ No modules.
40152
| Name | Type |
41153
|------|------|
42154
| [aws_sns_topic.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
155+
| [aws_sns_topic_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |
156+
| [aws_sns_topic_subscription.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
157+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
158+
| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
43159

44160
## Inputs
45161

46162
| Name | Description | Type | Default | Required |
47163
|------|-------------|------|---------|:--------:|
48-
| <a name="input_application_failure_feedback_role_arn"></a> [application\_failure\_feedback\_role\_arn](#input\_application\_failure\_feedback\_role\_arn) | IAM role for failure feedback | `string` | `null` | no |
49-
| <a name="input_application_success_feedback_role_arn"></a> [application\_success\_feedback\_role\_arn](#input\_application\_success\_feedback\_role\_arn) | The IAM role permitted to receive success feedback for this topic | `string` | `null` | no |
50-
| <a name="input_application_success_feedback_sample_rate"></a> [application\_success\_feedback\_sample\_rate](#input\_application\_success\_feedback\_sample\_rate) | Percentage of success to sample | `string` | `null` | no |
164+
| <a name="input_application_feedback"></a> [application\_feedback](#input\_application\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback | `map(string)` | `{}` | no |
51165
| <a name="input_content_based_deduplication"></a> [content\_based\_deduplication](#input\_content\_based\_deduplication) | Boolean indicating whether or not to enable content-based deduplication for FIFO topics. | `bool` | `false` | no |
52-
| <a name="input_create_sns_topic"></a> [create\_sns\_topic](#input\_create\_sns\_topic) | Whether to create the SNS topic | `bool` | `true` | no |
166+
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |
167+
| <a name="input_create_subscription"></a> [create\_subscription](#input\_create\_subscription) | Determines whether an SNS subscription is created | `bool` | `true` | no |
168+
| <a name="input_create_topic_policy"></a> [create\_topic\_policy](#input\_create\_topic\_policy) | Determines whether an SNS topic policy is created | `bool` | `true` | no |
53169
| <a name="input_delivery_policy"></a> [delivery\_policy](#input\_delivery\_policy) | The SNS delivery policy | `string` | `null` | no |
54170
| <a name="input_display_name"></a> [display\_name](#input\_display\_name) | The display name for the SNS topic | `string` | `null` | no |
171+
| <a name="input_enable_default_topic_policy"></a> [enable\_default\_topic\_policy](#input\_enable\_default\_topic\_policy) | Specifies whether to enable the default topic policy. Defaults to `true` | `bool` | `true` | no |
55172
| <a name="input_fifo_topic"></a> [fifo\_topic](#input\_fifo\_topic) | Boolean indicating whether or not to create a FIFO (first-in-first-out) topic | `bool` | `false` | no |
56-
| <a name="input_firehose_failure_feedback_role_arn"></a> [firehose\_failure\_feedback\_role\_arn](#input\_firehose\_failure\_feedback\_role\_arn) | IAM role for failure feedback | `string` | `null` | no |
57-
| <a name="input_firehose_success_feedback_role_arn"></a> [firehose\_success\_feedback\_role\_arn](#input\_firehose\_success\_feedback\_role\_arn) | The IAM role permitted to receive success feedback for this topic | `string` | `null` | no |
58-
| <a name="input_firehose_success_feedback_sample_rate"></a> [firehose\_success\_feedback\_sample\_rate](#input\_firehose\_success\_feedback\_sample\_rate) | Percentage of success to sample | `number` | `null` | no |
59-
| <a name="input_http_failure_feedback_role_arn"></a> [http\_failure\_feedback\_role\_arn](#input\_http\_failure\_feedback\_role\_arn) | IAM role for failure feedback | `string` | `null` | no |
60-
| <a name="input_http_success_feedback_role_arn"></a> [http\_success\_feedback\_role\_arn](#input\_http\_success\_feedback\_role\_arn) | The IAM role permitted to receive success feedback for this topic | `string` | `null` | no |
61-
| <a name="input_http_success_feedback_sample_rate"></a> [http\_success\_feedback\_sample\_rate](#input\_http\_success\_feedback\_sample\_rate) | Percentage of success to sample | `string` | `null` | no |
173+
| <a name="input_firehose_feedback"></a> [firehose\_feedback](#input\_firehose\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback | `map(string)` | `{}` | no |
174+
| <a name="input_http_feedback"></a> [http\_feedback](#input\_http\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback | `map(string)` | `{}` | no |
62175
| <a name="input_kms_master_key_id"></a> [kms\_master\_key\_id](#input\_kms\_master\_key\_id) | The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK | `string` | `null` | no |
63-
| <a name="input_lambda_failure_feedback_role_arn"></a> [lambda\_failure\_feedback\_role\_arn](#input\_lambda\_failure\_feedback\_role\_arn) | IAM role for failure feedback | `string` | `null` | no |
64-
| <a name="input_lambda_success_feedback_role_arn"></a> [lambda\_success\_feedback\_role\_arn](#input\_lambda\_success\_feedback\_role\_arn) | The IAM role permitted to receive success feedback for this topic | `string` | `null` | no |
65-
| <a name="input_lambda_success_feedback_sample_rate"></a> [lambda\_success\_feedback\_sample\_rate](#input\_lambda\_success\_feedback\_sample\_rate) | Percentage of success to sample | `string` | `null` | no |
176+
| <a name="input_lambda_feedback"></a> [lambda\_feedback](#input\_lambda\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback | `map(string)` | `{}` | no |
66177
| <a name="input_name"></a> [name](#input\_name) | The name of the SNS topic to create | `string` | `null` | no |
67-
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | The prefix name of the SNS topic to create | `string` | `null` | no |
68-
| <a name="input_policy"></a> [policy](#input\_policy) | The fully-formed AWS policy as JSON | `string` | `null` | no |
69-
| <a name="input_sqs_failure_feedback_role_arn"></a> [sqs\_failure\_feedback\_role\_arn](#input\_sqs\_failure\_feedback\_role\_arn) | IAM role for failure feedback | `string` | `null` | no |
70-
| <a name="input_sqs_success_feedback_role_arn"></a> [sqs\_success\_feedback\_role\_arn](#input\_sqs\_success\_feedback\_role\_arn) | The IAM role permitted to receive success feedback for this topic | `string` | `null` | no |
71-
| <a name="input_sqs_success_feedback_sample_rate"></a> [sqs\_success\_feedback\_sample\_rate](#input\_sqs\_success\_feedback\_sample\_rate) | Percentage of success to sample | `string` | `null` | no |
72-
| <a name="input_tags"></a> [tags](#input\_tags) | A mapping of tags to assign to all resources | `map(string)` | `{}` | no |
178+
| <a name="input_override_topic_policy_documents"></a> [override\_topic\_policy\_documents](#input\_override\_topic\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no |
179+
| <a name="input_source_topic_policy_documents"></a> [source\_topic\_policy\_documents](#input\_source\_topic\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s | `list(string)` | `[]` | no |
180+
| <a name="input_sqs_feedback"></a> [sqs\_feedback](#input\_sqs\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback | `map(string)` | `{}` | no |
181+
| <a name="input_subscriptions"></a> [subscriptions](#input\_subscriptions) | A map of subscription definitions to create | `any` | `{}` | no |
182+
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
183+
| <a name="input_topic_policy"></a> [topic\_policy](#input\_topic\_policy) | An externally created fully-formed AWS policy as JSON | `string` | `null` | no |
184+
| <a name="input_topic_policy_statements"></a> [topic\_policy\_statements](#input\_topic\_policy\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | `any` | `{}` | no |
185+
| <a name="input_use_name_prefix"></a> [use\_name\_prefix](#input\_use\_name\_prefix) | Determines whether `name` is used as a prefix | `bool` | `false` | no |
73186

74187
## Outputs
75188

76189
| Name | Description |
77190
|------|-------------|
78-
| <a name="output_sns_topic_arn"></a> [sns\_topic\_arn](#output\_sns\_topic\_arn) | ARN of SNS topic |
79-
| <a name="output_sns_topic_id"></a> [sns\_topic\_id](#output\_sns\_topic\_id) | ID of SNS topic |
80-
| <a name="output_sns_topic_name"></a> [sns\_topic\_name](#output\_sns\_topic\_name) | NAME of SNS topic |
81-
| <a name="output_sns_topic_owner"></a> [sns\_topic\_owner](#output\_sns\_topic\_owner) | OWNER of SNS topic |
191+
| <a name="output_subscriptions"></a> [subscriptions](#output\_subscriptions) | Map of subscriptions created and their attributes |
192+
| <a name="output_topic_arn"></a> [topic\_arn](#output\_topic\_arn) | The ARN of the SNS topic, as a more obvious property (clone of id) |
193+
| <a name="output_topic_id"></a> [topic\_id](#output\_topic\_id) | The ARN of the SNS topic |
194+
| <a name="output_topic_name"></a> [topic\_name](#output\_topic\_name) | The name of the topic |
195+
| <a name="output_topic_owner"></a> [topic\_owner](#output\_topic\_owner) | The AWS Account ID of the SNS topic owner |
82196
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
83197

84198
## Authors

‎UPGRADE-5.0.md‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
# Upgrade from v4.x to v5.x
2+
3+
If you have any questions regarding this upgrade process, please consult the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-sns/tree/master/examples/complete) directory:
4+
5+
If you find a bug, please open an issue with supporting configuration to reproduce.
6+
7+
## List of backwards incompatible changes
8+
9+
- `create_sns_topic` has been renamed to `create`
10+
- `policy` has been renamed to `topic_policy`
11+
- `name_prefix` has been replaced with the combination of `name` and `use_name_prefix = true` to ensure only one value is provided
12+
- `*_failure_feedback_role_arn`, `*_success_feedback_role_arn`, `*_success_feedback_sample_rate` variables have been replaced with a respective top level variable that contains a map to the three attributes. See before and after below for further clarification.
13+
- Outputs have had the `sns_` prefix stripped from their names
14+
15+
## Additional changes
16+
17+
### Added
18+
19+
- Support for topic policy creation and subscriptions
20+
21+
### Variable and output changes
22+
23+
1. Removed variables:
24+
25+
- None
26+
27+
2. Renamed variables:
28+
29+
- `create_sns_topic` -> `create`
30+
- `policy` -> `topic_policy`
31+
- `application_feedback_failure_role_arn`/`application_feedback_success_role_arn`/`application_feedback_success_feedback_sample_rate` -> `application_feedback`
32+
- `firehose_feedback_failure_role_arn`/`firehose_feedback_success_role_arn`/`firehose_feedback_success_feedback_sample_rate` -> `firehose_feedback`
33+
- `http_feedback_failure_role_arn`/`http_feedback_success_role_arn`/`http_feedback_success_feedback_sample_rate` -> `http_feedback`
34+
- `lambda_feedback_failure_role_arn`/`lambda_feedback_success_role_arn`/`lambda_feedback_success_feedback_sample_rate` -> `lambda_feedback`
35+
- `sqs_feedback_failure_role_arn`/`sqs_feedback_success_role_arn`/`sqs_feedback_success_feedback_sample_rate` -> `sqs_feedback`
36+
37+
3. Added variables:
38+
39+
- `use_name_prefix`
40+
- `create_topic_policy`
41+
- `source_topic_policy_documents`
42+
- `override_topic_policy_documents`
43+
- `enable_default_topic_policy`
44+
- `topic_policy_statements`
45+
- `create_subscription`
46+
- `subscriptions`
47+
48+
4. Removed outputs:
49+
50+
- None
51+
52+
5. Renamed outputs:
53+
54+
- `sns_` prefix removed from all outputs
55+
56+
6. Added outputs:
57+
58+
- `subscriptions`
59+
60+
## Upgrade Migrations
61+
62+
Note: Only the affected attributes are shown below for brevity.
63+
64+
### Before 4.x Example
65+
66+
```hcl
67+
module "sns" {
68+
source = "terraform-aws-modules/sns/aws"
69+
version = "~> 4.0"
70+
71+
create_sns_topic = true
72+
73+
name_prefix = "example-"
74+
policy = "..."
75+
76+
application_feedback_failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:application"
77+
application_feedback_success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:application"
78+
application_feedback_success_sample_rate = 100
79+
80+
firehose_feedback_failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:firehose"
81+
firehose_feedback_success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:firehose"
82+
firehose_feedback_success_sample_rate = 100
83+
84+
http_feedback_failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:http"
85+
http_feedback_success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:http"
86+
http_feedback_success_sample_rate = 100
87+
88+
lambda_feedback = {
89+
lambda_feedback_failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:lambda"
90+
lambda_feedback_success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:lambda"
91+
lambda_feedback_success_sample_rate = 100
92+
93+
sqs_feedback_failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:sqs"
94+
sqs_feedback_success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:sqs"
95+
sqs_feedback_success_sample_rate = 100
96+
}
97+
```
98+
99+
### After 5.x Example
100+
101+
```hcl
102+
module "sns" {
103+
source = "terraform-aws-modules/sns/aws"
104+
version = "~> 5.0"
105+
106+
create = true
107+
108+
name = "example-"
109+
use_name_prefix = true
110+
topic_policy = "..."
111+
112+
application_feedback = {
113+
failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:application"
114+
success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:application"
115+
success_sample_rate = 100
116+
}
117+
firehose_feedback = {
118+
failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:firehose"
119+
success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:firehose"
120+
success_sample_rate = 100
121+
}
122+
http_feedback = {
123+
failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:http"
124+
success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:http"
125+
success_sample_rate = 100
126+
}
127+
lambda_feedback = {
128+
failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:lambda"
129+
success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:lambda"
130+
success_sample_rate = 100
131+
}
132+
sqs_feedback = {
133+
failure_role_arn = "arn:aws:sqs:eu-west-1:11111111111:sqs"
134+
success_role_arn = "arn:aws:sqs:eu-west-1:11111111111:sqs"
135+
success_sample_rate = 100
136+
}
137+
}
138+
```
139+
140+
### State Changes
141+
142+
No state changes required.

‎examples/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Examples
2+
3+
Please note - the examples provided serve two primary means:
4+
5+
1. Show users working examples of the various ways in which the module can be configured and features supported
6+
2. A means of testing/validating module changes
7+
8+
Please do not mistake the examples provided as "best practices". It is up to users to consult the AWS service documentation for best practices, usage recommendations, etc.

0 commit comments

Comments
 (0)