[NRL-853] Move notification email config out of lambda-error module and re-use for backup notifications

Author: mattdean3-nhs

terraform/account-wide-infrastructure/dev/aws-backups.tf

@@ -104,6 +104,8 @@ module "source" {
   #terraform_role_arn                = data.aws_caller_identity.current.arn
   terraform_role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
 
+  notification_target_email_addresses = local.notification_emails
+
   backup_plan_config = {
     "compliance_resource_types" : [
       "S3"

terraform/account-wide-infrastructure/dev/cloudwatch.tf

@@ -2,6 +2,8 @@ module "lambda_errors_cloudwatch_metric_alarm_dev" {
   source      = "../modules/lambda-errors-metric-alarm"
   name_prefix = "nhsd-nrlf--dev"
 
+  notification_emails = local.notification_emails
+
   evaluation_periods = 1
   period             = 60
   threshold          = 1

terraform/account-wide-infrastructure/dev/data.tf

@@ -1,3 +1,11 @@
 data "aws_secretsmanager_secret_version" "identities_account_id" {
   secret_id = aws_secretsmanager_secret.identities_account_id.name
 }
+
+data "aws_secretsmanager_secret" "emails" {
+  name = "${local.prefix}-emails"
+}
+
+data "aws_secretsmanager_secret_version" "emails" {
+  secret_id = data.aws_secretsmanager_secret.emails.id
+}

terraform/account-wide-infrastructure/dev/locals.tf

@@ -3,4 +3,6 @@ locals {
   project     = "nhsd-nrlf"
   environment = terraform.workspace
   prefix      = "${local.project}--${local.environment}"
+
+  notification_emails = nonsensitive(toset(tolist(jsondecode(data.aws_secretsmanager_secret_version.emails.secret_string))))
 }

terraform/account-wide-infrastructure/dev/secrets.tf

@@ -2,6 +2,10 @@ resource "aws_secretsmanager_secret" "identities_account_id" {
   name = "${local.prefix}--nhs-identities-account-id"
 }
 
+resource "aws_secretsmanager_secret" "notification_email_addresses" {
+  name = "${local.prefix}-dev-notification-email-addresses"
+}
+
 resource "aws_secretsmanager_secret" "dev_smoke_test_apigee_app" {
   name        = "${local.prefix}--dev--apigee-app--smoke-test"
   description = "APIGEE App used to run Smoke Tests against the DEV environment"

terraform/account-wide-infrastructure/modules/backup-source/backup_notification.tf

@@ -1,7 +1,6 @@
 resource "aws_backup_vault_notifications" "backup_notification" {
-  count             = var.notifications_target_email_address != "" ? 1 : 0
   backup_vault_name = aws_backup_vault.main.name
-  sns_topic_arn     = aws_sns_topic.backup[0].arn
+  sns_topic_arn     = aws_sns_topic.backup.arn
   backup_vault_events = [
     "BACKUP_JOB_COMPLETED",
     "RESTORE_JOB_COMPLETED",

terraform/account-wide-infrastructure/modules/backup-source/sns.tf

@@ -1,5 +1,4 @@
 resource "aws_sns_topic" "backup" {
-  count             = var.notifications_target_email_address != "" ? 1 : 0
   name              = "${local.resource_name_prefix}-notifications"
   kms_master_key_id = var.bootstrap_kms_key_arn
   policy            = data.aws_iam_policy_document.allow_backup_to_sns.json
@@ -27,9 +26,9 @@ data "aws_iam_policy_document" "allow_backup_to_sns" {
 }
 
 resource "aws_sns_topic_subscription" "aws_backup_notifications_email_target" {
-  count         = var.notifications_target_email_address != "" ? 1 : 0
-  topic_arn     = aws_sns_topic.backup[0].arn
+  for_each      = var.notification_target_email_addresses
+  topic_arn     = aws_sns_topic.backup.arn
   protocol      = "email"
-  endpoint      = var.notifications_target_email_address
+  endpoint      = each.value
   filter_policy = jsonencode({ "State" : [{ "anything-but" : "COMPLETED" }] })
 }

terraform/account-wide-infrastructure/modules/backup-source/variables.tf

@@ -8,10 +8,10 @@ variable "environment_name" {
   type        = string
 }
 
-variable "notifications_target_email_address" {
-  description = "The email address to which backup notifications will be sent via SNS."
-  type        = string
-  default     = ""
+variable "notification_target_email_addresses" {
+  description = "The email addresses to which backup notifications will be sent via SNS."
+  type        = set(string)
+  default     = []
 }
 
 variable "bootstrap_kms_key_arn" {

terraform/account-wide-infrastructure/modules/lambda-errors-metric-alarm/secretsmanager.tf

@@ -4,7 +4,7 @@ resource "aws_sns_topic" "sns_topic" {
 }
 
 resource "aws_sns_topic_subscription" "sns_subscription" {
-  for_each  = nonsensitive(toset(tolist(jsondecode(data.aws_secretsmanager_secret_version.emails.secret_string))))
+  for_each  = var.notification_emails
   topic_arn = aws_sns_topic.sns_topic.arn
   protocol  = "email"
   endpoint  = sensitive(each.value)