Skip to content

Commit

Permalink
Retire support for TREv1 architecture
Browse files Browse the repository at this point in the history
  • Loading branch information
@TomJKing
TomJKing committed Nov 16, 2023
1 parent 6c40b84 commit 01d9792
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 82 deletions.
87 changes: 28 additions & 59 deletions lambda/notifications.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,8 @@ locals {
transform_engine_count = var.apply_resource == true && local.environment != "mgmt" ? local.count_notifications : 0
kms_export_bucket_encryption_count = var.apply_resource == true && local.environment != "mgmt" ? local.count_notifications : 0
//encryption requires some value, as these are not relevant for management account use placeholder values
env_var_judgment_export_bucket = local.transform_engine_count == 0 ? "not_applicable" : var.judgment_export_s3_bucket_name
env_var_standard_export_bucket = local.transform_engine_count == 0 ? "not_applicable" : var.standard_export_s3_bucket_name
env_var_transform_engine_output_sqs_endpoint = local.transform_engine_count == 0 ? "not_applicable" : data.aws_ssm_parameter.transform_engine_output_sqs_endpoint[0].value
env_var_transform_engine_v2_sns_topic_in = local.transform_engine_count == 0 ? "not_applicable" : data.aws_ssm_parameter.transform_engine_v2_input_sns_arn[0].value
env_var_judgment_export_bucket = local.transform_engine_count == 0 ? "not_applicable" : var.judgment_export_s3_bucket_name
env_var_standard_export_bucket = local.transform_engine_count == 0 ? "not_applicable" : var.standard_export_s3_bucket_name
}

resource "aws_lambda_function" "notifications_lambda_function" {
Expand All @@ -22,16 +20,14 @@ resource "aws_lambda_function" "notifications_lambda_function" {
tags = var.common_tags
environment {
variables = {
SLACK_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_notifications_webhook"].ciphertext_blob
SLACK_JUDGMENT_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_judgment_webhook"].ciphertext_blob
SLACK_TDR_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_tdr_webhook"].ciphertext_blob
SLACK_EXPORT_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_export_webhook"].ciphertext_blob
TO_EMAIL = aws_kms_ciphertext.environment_vars_notifications["to_email"].ciphertext_blob
TRANSFORM_ENGINE_OUTPUT_SQS = aws_kms_ciphertext.environment_vars_notifications["transform_engine_output_sqs"].ciphertext_blob
TRANSFORM_ENGINE_V2_SNS_TOPIC_IN = aws_kms_ciphertext.environment_vars_notifications["transform_engine_v2_sns_topic_in"].ciphertext_blob
JUDGMENT_EXPORT_BUCKET = aws_kms_ciphertext.environment_vars_notifications["judgment_export_bucket"].ciphertext_blob
STANDARD_EXPORT_BUCKET = aws_kms_ciphertext.environment_vars_notifications["standard_export_bucket"].ciphertext_blob
DA_EVENT_BUS = aws_kms_ciphertext.environment_vars_notifications["da_event_bus"].ciphertext_blob
SLACK_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_notifications_webhook"].ciphertext_blob
SLACK_JUDGMENT_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_judgment_webhook"].ciphertext_blob
SLACK_TDR_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_tdr_webhook"].ciphertext_blob
SLACK_EXPORT_WEBHOOK = aws_kms_ciphertext.environment_vars_notifications["slack_export_webhook"].ciphertext_blob
TO_EMAIL = aws_kms_ciphertext.environment_vars_notifications["to_email"].ciphertext_blob
JUDGMENT_EXPORT_BUCKET = aws_kms_ciphertext.environment_vars_notifications["judgment_export_bucket"].ciphertext_blob
STANDARD_EXPORT_BUCKET = aws_kms_ciphertext.environment_vars_notifications["standard_export_bucket"].ciphertext_blob
DA_EVENT_BUS = aws_kms_ciphertext.environment_vars_notifications["da_event_bus"].ciphertext_blob
}
}

Expand All @@ -42,16 +38,14 @@ resource "aws_lambda_function" "notifications_lambda_function" {

resource "aws_kms_ciphertext" "environment_vars_notifications" {
for_each = local.count_notifications == 0 ? {} : {
slack_tdr_webhook = data.aws_ssm_parameter.slack_webhook[0].value,
slack_judgment_webhook = data.aws_ssm_parameter.slack_judgment_webhook[0].value,
slack_notifications_webhook = data.aws_ssm_parameter.slack_notifications_webhook[0].value,
slack_export_webhook = data.aws_ssm_parameter.slack_export_webhook[0].value,
to_email = "[email protected]",
transform_engine_output_sqs = local.env_var_transform_engine_output_sqs_endpoint,
transform_engine_v2_sns_topic_in = local.env_var_transform_engine_v2_sns_topic_in,
judgment_export_bucket = local.env_var_judgment_export_bucket,
standard_export_bucket = local.env_var_standard_export_bucket,
da_event_bus = var.da_event_bus_arn
slack_tdr_webhook = data.aws_ssm_parameter.slack_webhook[0].value,
slack_judgment_webhook = data.aws_ssm_parameter.slack_judgment_webhook[0].value,
slack_notifications_webhook = data.aws_ssm_parameter.slack_notifications_webhook[0].value,
slack_export_webhook = data.aws_ssm_parameter.slack_export_webhook[0].value,
to_email = "[email protected]",
judgment_export_bucket = local.env_var_judgment_export_bucket,
standard_export_bucket = local.env_var_standard_export_bucket,
da_event_bus = var.da_event_bus_arn
}
# This lambda is created by the tdr-terraform-backend project as it only exists in the management account so we can't use any KMS keys
# created by the terraform environments project as they won't exist when we first run the backend project.
Expand Down Expand Up @@ -85,36 +79,21 @@ data "aws_ssm_parameter" "slack_export_webhook" {
name = "/${local.environment}/slack/export/webhook"
}

data "aws_ssm_parameter" "transform_engine_output_sqs_arn" {
count = local.transform_engine_count
name = "/${local.environment}/transform_engine/output_sqs/arn"
}

data "aws_ssm_parameter" "transform_engine_v2_input_sns_arn" {
count = local.transform_engine_count
name = "/${local.environment}/transform_engine_v2/tre-in/arn"
}

data "aws_ssm_parameter" "transform_engine_v2_kms_key_arn" {
count = local.transform_engine_count
name = "/${local.environment}/transform_engine_v2/kms/key_arn"
}

data "aws_ssm_parameter" "transform_engine_output_sqs_endpoint" {
count = local.transform_engine_count
name = "/${local.environment}/transform_engine/output_sqs/endpoint"
}

resource "aws_cloudwatch_log_group" "notifications_lambda_log_group" {
count = local.count_notifications
name = "/aws/lambda/${aws_lambda_function.notifications_lambda_function.*.function_name[0]}"
tags = var.common_tags
}

resource "aws_iam_policy" "notifications_lambda_policy" {
count = local.count_notifications
policy = templatefile("${path.module}/templates/notifications_lambda.json.tpl", { account_id = data.aws_caller_identity.current.account_id, environment = local.environment, email = "[email protected]", kms_arn = var.kms_key_arn, kms_account_arn = data.aws_kms_key.encryption_key_account.arn })
name = "${upper(var.project)}NotificationsLambdaPolicy${title(local.environment)}"
count = local.count_notifications
policy = templatefile("${path.module}/templates/notifications_lambda.json.tpl", {
account_id = data.aws_caller_identity.current.account_id,
environment = local.environment,
email = "[email protected]",
kms_arn = var.kms_key_arn,
kms_account_arn = data.aws_kms_key.encryption_key_account.arn })
name = "${upper(var.project)}NotificationsLambdaPolicy${title(local.environment)}"
}

resource "aws_iam_policy" "notifications_kms_bucket_key_policy" {
Expand All @@ -126,11 +105,8 @@ resource "aws_iam_policy" "notifications_kms_bucket_key_policy" {
resource "aws_iam_policy" "transform_engine_notifications_lambda_policy" {
count = local.transform_engine_count
policy = templatefile("${path.module}/templates/notifications_transform_engine_lambda.json.tpl", {
transform_engine_output_queue_arn = data.aws_ssm_parameter.transform_engine_output_sqs_arn[0].value,
transform_engine_retry_queue_arn = local.transform_engine_retry_queue,
transform_engine_v2_out_queue_arn = local.transform_engine_v2_out_queue,
da_event_bus_arn = var.da_event_bus_arn,
da_event_bus_kms_key_arn = var.da_event_bus_kms_key_arn
da_event_bus_arn = var.da_event_bus_arn,
da_event_bus_kms_key_arn = var.da_event_bus_kms_key_arn
})
name = "${upper(var.project)}NotificationsTransformEngineLambdaPolicy${title(local.environment)}"
}
Expand Down Expand Up @@ -183,10 +159,3 @@ resource "aws_sns_topic_subscription" "intg_topic_subscription" {
protocol = "lambda"
topic_arn = each.value
}

resource "aws_lambda_event_source_mapping" "transform_engine_retry_sqs_queue_mapping" {
count = local.transform_engine_count
event_source_arn = local.transform_engine_retry_queue
function_name = aws_lambda_function.notifications_lambda_function.*.arn[0]
batch_size = 1
}
23 changes: 0 additions & 23 deletions lambda/templates/notifications_transform_engine_lambda.json.tpl
View file
Original file line number Diff line number Diff line change
@@ -1,29 +1,6 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:SendMessage"
],
"Resource": [
"${transform_engine_output_queue_arn}"
]
},
{
"Effect": "Allow",
"Action": [
"sqs:ChangeMessageVisibility",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes",
"sqs:ReceiveMessage",
"sqs:SendMessage"
],
"Resource": [
"${transform_engine_retry_queue_arn}",
"${transform_engine_v2_out_queue_arn}"
]
},
{
"Sid":"AllowPublishToDaEventBus",
"Effect":"Allow",
Expand Down

0 comments on commit 01d9792

Please sign in to comment.