VED-1005: Manage S3 replication config in Terraform. (#1097)

* VED-1005: Manage S3 replication config in Terraform.

* VED-1005: Use more descriptive policy names.

Author: mfjarvis

infrastructure/account/s3_source_bucket.tf

@@ -71,3 +71,63 @@ resource "aws_s3_bucket_lifecycle_configuration" "datasources_lifecycle" {
     }
   }
 }
+
+data "aws_iam_policy_document" "replication_assume_role" {
+  count = var.blue_green_split ? 1 : 0
+
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["s3.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "replication" {
+  count              = var.blue_green_split ? 1 : 0
+  name               = "immunisation-batch-${var.environment}-replication"
+  assume_role_policy = data.aws_iam_policy_document.replication_assume_role[0].json
+}
+
+data "aws_iam_policy_document" "replication_allow_source" {
+  count = var.blue_green_split ? 1 : 0
+
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:GetReplicationConfiguration",
+      "s3:ListBucket",
+    ]
+
+    resources = [aws_s3_bucket.batch_data_source_bucket[0].arn]
+  }
+
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:GetObjectVersionForReplication",
+      "s3:GetObjectVersionAcl",
+      "s3:GetObjectVersionTagging",
+    ]
+
+    resources = ["${aws_s3_bucket.batch_data_source_bucket[0].arn}/*"]
+  }
+}
+
+resource "aws_iam_policy" "replication_allow_source" {
+  count  = var.blue_green_split ? 1 : 0
+  name   = "allow-replication-from-${var.environment}-data-sources"
+  policy = data.aws_iam_policy_document.replication_allow_source[0].json
+}
+
+resource "aws_iam_role_policy_attachment" "replication_allow_source" {
+  count      = var.blue_green_split ? 1 : 0
+  role       = aws_iam_role.replication[0].name
+  policy_arn = aws_iam_policy.replication_allow_source[0].arn
+}

infrastructure/instance/s3_config.tf

@@ -102,6 +102,89 @@ resource "aws_s3_bucket_lifecycle_configuration" "datasources_lifecycle" {
   }
 }
 
+data "aws_iam_role" "existing_replication_role" {
+  count = var.has_sub_environment_scope ? 0 : 1
+  name  = "immunisation-batch-${var.environment}-replication"
+}
+
+data "aws_iam_policy_document" "replication_allow_destination" {
+  count = var.has_sub_environment_scope ? 0 : 1
+
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:ReplicateObject",
+      "s3:ReplicateDelete",
+      "s3:ReplicateTags",
+    ]
+
+    resources = ["${aws_s3_bucket.batch_data_source_bucket.arn}/*"]
+  }
+}
+
+resource "aws_iam_policy" "replication_allow_destination" {
+  count  = var.has_sub_environment_scope ? 0 : 1
+  name   = "${local.batch_prefix}-destination"
+  policy = data.aws_iam_policy_document.replication_allow_destination[0].json
+}
+
+resource "aws_iam_role_policy_attachment" "replication_allow_destination" {
+  count      = var.has_sub_environment_scope ? 0 : 1
+  role       = data.aws_iam_role.existing_replication_role[0].name
+  policy_arn = aws_iam_policy.replication_allow_destination[0].arn
+}
+
+resource "aws_s3_bucket_replication_configuration" "replication" {
+  count  = var.has_sub_environment_scope ? 0 : 1
+  role   = data.aws_iam_role.existing_replication_role[0].arn
+  bucket = "immunisation-batch-${local.resource_scope}-data-sources"
+
+  rule {
+    id       = var.sub_environment
+    priority = strcontains(var.sub_environment, "blue") ? 0 : 1
+    status   = "Enabled"
+
+    filter {
+      prefix = ""
+    }
+
+    destination {
+      bucket        = aws_s3_bucket.batch_data_source_bucket.arn
+      storage_class = "STANDARD"
+
+      replication_time {
+        status = "Enabled"
+        time {
+          minutes = 15
+        }
+      }
+    }
+  }
+
+  rule {
+    id       = strcontains(var.sub_environment, "blue") ? replace(var.sub_environment, "blue", "green") : replace(var.sub_environment, "green", "blue")
+    priority = strcontains(var.sub_environment, "blue") ? 1 : 0
+    status   = "Disabled"
+
+    filter {
+      prefix = ""
+    }
+
+    destination {
+      bucket        = strcontains(aws_s3_bucket.batch_data_source_bucket.arn, "blue") ? replace(aws_s3_bucket.batch_data_source_bucket.arn, "blue", "green") : replace(aws_s3_bucket.batch_data_source_bucket.arn, "green", "blue")
+      storage_class = "STANDARD"
+
+      replication_time {
+        status = "Enabled"
+        time {
+          minutes = 15
+        }
+      }
+    }
+  }
+}
+
 resource "aws_s3_bucket" "batch_data_destination_bucket" {
   # Deliberately not using `local.batch_prefix` as we don't want separate blue / green destinations in prod.
   bucket        = "immunisation-batch-${local.resource_scope}-data-destinations"