Merge pull request #36 from proactiveops/remove-dlq-key

skwashd · web-flow · commit a2ae81caa339 · 2026-01-25T12:32:06.000+11:00
Make CMK mandatory for the DLQ
diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023-2025 Dave Hall
+Copyright (c) 2023-2026 Dave Hall, https://proactiveops.io
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
@@ -205,7 +205,7 @@ module "eventbus_dlq_example" {
   source = "git::ssh://git@github.com/proactiveops/eventbus//modules/dlq?ref=main"
 
   queue_name = "[sub-name]-[optional-rule-name]" # Must not exceed 60 characters as the module appends "-dlq" to the name
-  kms_key_id = aws_kms_key.my_key.id             # omit if you want a new KMS key to be created.
+  kms_key_id = aws_kms_key.my_key.id             # The key is required. If needed, create a new one and pass it to the module.
   tags       = var.tags
 }
 
@@ -220,13 +220,13 @@ EventBus++ is built and maintained by [ProactiveOps](https://proactiveops.com/).
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0, < 2.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0, <6.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0, <7.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.94.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0, <7.0 |
 
 ## Modules
 
diff --git a/event_bus.tf b/event_bus.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 resource "aws_cloudwatch_event_bus" "this" {
   name = local.namespace
 
diff --git a/event_bus_iam.tf b/event_bus_iam.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 data "aws_iam_policy_document" "event_bus" {
   statement {
     sid       = "iamManageBus"
diff --git a/event_bus_rules.tf b/event_bus_rules.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 resource "aws_cloudwatch_event_rule" "targets" {
   for_each = { for index, rule in var.cross_bus_rules : rule.name => rule }
 
diff --git a/examples/full/main.tf b/examples/full/main.tf
@@ -1,17 +1,32 @@
-/**
- * Example of using EventBus++ module with multiple event buses and cross-bus rules.
- */
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
+resource "aws_kms_key" "this" {
+  description = "EvenBus Example"
+
+  deletion_window_in_days = 14
+  enable_key_rotation     = true
+
+  tags = local.tags
+}
+
+resource "aws_kms_alias" "this" {
+  name          = "alias/eventbus-example"
+  target_key_id = aws_kms_key.this.key_id
+}
 
 module "eventbus_dlq_example" {
   source = "../../modules/dlq"
 
+  kms_key_id = aws_kms_alias.this.arn
   queue_name = "example"
-  tags       = local.tags
+
+  tags = local.tags
 }
 
 module "eventbus_partner" {
   source = "../../"
 
+  # Note: Zendesk no longer supports EventBridge partnet buses.
   name = "aws.partner/zendesk.com/12345678/default"
 
   cross_bus_rules = [
diff --git a/main.tf b/main.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 data "aws_caller_identity" "current" {}
 
 data "aws_partition" "current" {}
diff --git a/modules/dlq/README.md b/modules/dlq/README.md
@@ -1,20 +1,20 @@
-<!-- BEGIN_TF_DOCS -->
 # EventBus Dead Letter Queue (DLQ) Sub Module
 
 This module creates a SQS queue that can be used by Amazon EventBridge as a DLQ.
 
+<!-- BEGIN_TF_DOCS -->
 ## Requirements
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0, < 2.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0, <7.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0, <7.0 |
 
 ## Modules
 
@@ -24,19 +24,15 @@ No modules.
 
 | Name | Type |
 |------|------|
-| [aws_kms_alias.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
-| [aws_kms_key.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
 | [aws_sqs_queue.dlq](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |
 | [aws_sqs_queue_policy.dlq](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |
-| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.dlq](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [aws_iam_policy_document.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | The ID of the existing KMS key. If empty, then a new key will be created with permissions for EventBridge. | `string` | `""` | no |
+| <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | The ID of the existing KMS key. | `string` | n/a | yes |
 | <a name="input_queue_name"></a> [queue\_name](#input\_queue\_name) | The name of the queue to create. -dlq will be appended to the end. The name should the [bus-name]-[rule-name] convention. | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags help you manage, identify, organize search and filter resources. | `map(string)` | n/a | yes |
 
diff --git a/modules/dlq/kms.tf b/modules/dlq/kms.tf
diff --git a/modules/dlq/main.tf b/modules/dlq/main.tf
diff --git a/modules/dlq/outputs.tf b/modules/dlq/outputs.tf
@@ -1,9 +1,11 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 output "arn" {
   value       = aws_sqs_queue.dlq.arn
   description = "The ARN of the dead letter queue."
 }
 
 output "kms_id" {
-  value       = local.kms_key_id
+  value       = var.kms_key_id
   description = "The ID of the KMS used by the queue."
 }
diff --git a/modules/dlq/sqs.tf b/modules/dlq/sqs.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 resource "aws_sqs_queue" "dlq" {
   name = "${var.queue_name}-dlq"
 
@@ -6,7 +8,7 @@ resource "aws_sqs_queue" "dlq" {
   receive_wait_time_seconds = 0
   max_message_size          = 262144
 
-  kms_master_key_id = local.kms_key_id
+  kms_master_key_id = var.kms_key_id
 
   tags = var.tags
 }
@@ -26,7 +28,7 @@ data "aws_iam_policy_document" "dlq" {
   }
 
   dynamic "statement" {
-    for_each = local.kms_count == 1 ? [1] : []
+    for_each = var.kms_key_id == null ? [1] : []
     content {
       sid    = "events-policy"
       effect = "Allow"
@@ -39,7 +41,7 @@ data "aws_iam_policy_document" "dlq" {
         identifiers = ["events.amazonaws.com"]
       }
       resources = [
-        local.kms_key_id
+        var.kms_key_id
       ]
     }
   }
diff --git a/modules/dlq/variables.tf b/modules/dlq/variables.tf
@@ -1,7 +1,8 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 variable "kms_key_id" {
-  description = "The ID of the existing KMS key. If empty, then a new key will be created with permissions for EventBridge."
+  description = "The ID of the existing KMS key."
   type        = string
-  default     = ""
 }
 
 variable "queue_name" {
@@ -13,8 +14,3 @@ variable "tags" {
   description = "Tags help you manage, identify, organize search and filter resources."
   type        = map(string)
 }
-
-locals {
-  kms_count  = var.kms_key_id == "" ? 1 : 0
-  kms_key_id = local.kms_count == 1 ? aws_kms_key.this[0].id : var.kms_key_id
-}
diff --git a/modules/dlq/versions.tf b/modules/dlq/versions.tf
@@ -1,5 +1,7 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 terraform {
-  required_version = ">= 1.0"
+  required_version = ">= 1.0, < 2.0"
 
   required_providers {
     aws = {
diff --git a/outputs.tf b/outputs.tf
@@ -1,3 +1,4 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
 
 output "bus" {
   value       = aws_cloudwatch_event_bus.this
diff --git a/schema_discovery.tf b/schema_discovery.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 resource "aws_schemas_discoverer" "this" {
   count = var.enable_schema_discovery_registry ? 1 : 0
 
diff --git a/variables.tf b/variables.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 variable "name" {
   description = "The name of the eventbus or partner source. This must be unique per region per account."
   type        = string
diff --git a/versions.tf b/versions.tf
@@ -1,3 +1,5 @@
+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License
+
 terraform {
   required_version = ">= 1.0, < 2.0"
 

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License`
	`2`	`+`
`1`	`3`	`resource "aws_cloudwatch_event_bus" "this" {`
`2`	`4`	`name = local.namespace`
`3`	`5`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License`
	`2`	`+`
`1`	`3`	`data "aws_iam_policy_document" "event_bus" {`
`2`	`4`	`statement {`
`3`	`5`	`sid = "iamManageBus"`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+# Copyright 2023 - 2026 Dave Hall, https://proactiveops.io, MIT License`
	`2`	`+`
`1`	`3`	`resource "aws_cloudwatch_event_rule" "targets" {`
`2`	`4`	`for_each = { for index, rule in var.cross_bus_rules : rule.name => rule }`
`3`	`5`