Skip to content

Commit 051d8c5

Browse files
harrim91harrim91
committed
CCM-7939: pipe template table stream to fifo queue
1 parent f0641a3 commit 051d8c5

File tree

6 files changed

+111
-0
lines changed

6 files changed

+111
-0
lines changed

‎infrastructure/terraform/components/sandbox/module_backend_api.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,6 @@ module "backend_api" {
2424
dynamodb_kms_key_arn = data.aws_kms_key.sandbox.arn
2525

2626
send_to_firehose = false
27+
28+
enable_event_stream = true
2729
}

‎infrastructure/terraform/modules/backend-api/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ No requirements.
1616
| <a name="input_csi"></a> [csi](#input\_csi) | CSI from the parent component | `string` | n/a | yes |
1717
| <a name="input_dynamodb_kms_key_arn"></a> [dynamodb\_kms\_key\_arn](#input\_dynamodb\_kms\_key\_arn) | KMS Key ARN for encrypting DynamoDB data. If not given, a key will be created. | `string` | `""` | no |
1818
| <a name="input_enable_backup"></a> [enable\_backup](#input\_enable\_backup) | Enable Backups for the DynamoDB table? | `bool` | `true` | no |
19+
| <a name="input_enable_event_stream"></a> [enable\_event\_stream](#input\_enable\_event\_stream) | Enable DynamoDB streaming to SQS? | `bool` | `false` | no |
1920
| <a name="input_enable_proofing"></a> [enable\_proofing](#input\_enable\_proofing) | Enable proofing feature flag | `bool` | n/a | yes |
2021
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2122
| <a name="input_function_s3_bucket"></a> [function\_s3\_bucket](#input\_function\_s3\_bucket) | Name of S3 bucket to upload lambda artefacts to | `string` | n/a | yes |
@@ -52,6 +53,7 @@ No requirements.
5253
| <a name="module_s3bucket_internal"></a> [s3bucket\_internal](#module\_s3bucket\_internal) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
5354
| <a name="module_s3bucket_quarantine"></a> [s3bucket\_quarantine](#module\_s3bucket\_quarantine) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
5455
| <a name="module_sqs_sftp_upload"></a> [sqs\_sftp\_upload](#module\_sqs\_sftp\_upload) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
56+
| <a name="module_sqs_template_table_events"></a> [sqs\_template\_table\_events](#module\_sqs\_template\_table\_events) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.8 |
5557
| <a name="module_sqs_validate_letter_template_files"></a> [sqs\_validate\_letter\_template\_files](#module\_sqs\_validate\_letter\_template\_files) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
5658
| <a name="module_submit_template_lambda"></a> [submit\_template\_lambda](#module\_submit\_template\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
5759
| <a name="module_update_template_lambda"></a> [update\_template\_lambda](#module\_update\_template\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |

‎infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,4 +45,7 @@ resource "aws_dynamodb_table" "templates" {
4545
projection_type = "INCLUDE"
4646
non_key_attributes = ["owner"]
4747
}
48+
49+
stream_enabled = true
50+
stream_view_type = "NEW_AND_OLD_IMAGES"
4851
}

‎infrastructure/terraform/modules/backend-api/module_sqs_template_table_events.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
module "sqs_template_table_events" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs?ref=v2.0.8"
3+
4+
aws_account_id = var.aws_account_id
5+
component = var.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
name = "template-table-events"
10+
fifo_queue = true
11+
content_based_deduplication = true
12+
13+
sqs_kms_key_arn = var.kms_key_arn
14+
}

‎infrastructure/terraform/modules/backend-api/pipes_pipe_template_table_events.tf‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
resource "aws_pipes_pipe" "template_table_events" {
2+
name = "${local.csi}-template-table-events"
3+
role_arn = aws_iam_role.pipe_template_table_events.arn
4+
source = aws_dynamodb_table.templates.stream_arn
5+
target = module.sqs_template_table_events.sqs_queue_arn
6+
desired_state = var.enable_event_stream ? "RUNNING" : "STOPPED"
7+
8+
source_parameters {
9+
dynamodb_stream_parameters {
10+
starting_position = "TRIM_HORIZON"
11+
}
12+
}
13+
14+
target_parameters {
15+
sqs_queue_parameters {
16+
message_group_id = "$.dynamodb.Keys.id.S"
17+
}
18+
}
19+
}
20+
21+
resource "aws_iam_role" "pipe_template_table_events" {
22+
name = "${local.csi}-pipe-template-table-events"
23+
description = "IAM Role for Pipe forward template table stream events to SQS"
24+
assume_role_policy = data.aws_iam_policy_document.pipes_trust_policy.json
25+
}
26+
27+
data "aws_iam_policy_document" "pipes_trust_policy" {
28+
statement {
29+
sid = "PipesAssumeRole"
30+
effect = "Allow"
31+
actions = ["sts:AssumeRole"]
32+
33+
principals {
34+
type = "Service"
35+
identifiers = ["pipes.amazonaws.com"]
36+
}
37+
}
38+
}
39+
40+
resource "aws_iam_role_policy" "pipe_template_table_events" {
41+
name = "${local.csi}-pipe-template-table-events"
42+
role = aws_iam_role.pipe_template_table_events.id
43+
policy = data.aws_iam_policy_document.pipe_template_table_events.json
44+
}
45+
46+
data "aws_iam_policy_document" "pipe_template_table_events" {
47+
version = "2012-10-17"
48+
49+
statement {
50+
sid = "AllowDDBStreamRead"
51+
effect = "Allow"
52+
actions = [
53+
"dynamodb:DescribeStream",
54+
"dynamodb:GetRecords",
55+
"dynamodb:GetShardIterator",
56+
"dynamodb:ListStreams",
57+
]
58+
resources = [aws_dynamodb_table.templates.stream_arn]
59+
}
60+
61+
statement {
62+
sid = "AllowSQSSendMessage"
63+
effect = "Allow"
64+
actions = ["sqs:SendMessage"]
65+
resources = [module.sqs_template_table_events.sqs_queue_arn]
66+
}
67+
68+
statement {
69+
sid = "AllowSqsKMS"
70+
effect = "Allow"
71+
actions = [
72+
"kms:Decrypt",
73+
"kms:GenerateDataKey"
74+
]
75+
resources = [var.kms_key_arn]
76+
}
77+
78+
statement {
79+
sid = "AllowDynamoKMS"
80+
effect = "Allow"
81+
actions = ["kms:Decrypt"]
82+
resources = [local.dynamodb_kms_key_arn]
83+
}
84+
}

‎infrastructure/terraform/modules/backend-api/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,12 @@ variable "enable_proofing" {
7676
description = "Enable proofing feature flag"
7777
}
7878

79+
variable "enable_event_stream" {
80+
type = bool
81+
description = "Enable DynamoDB streaming to SQS?"
82+
default = false
83+
}
84+
7985
variable "kms_key_arn" {
8086
type = string
8187
description = "KMS Key ARN"

0 commit comments

Comments
 (0)