generated from dxw/terraform-template
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcloudwatch-opsgenie-alerts-sns.tf
140 lines (113 loc) · 4.78 KB
/
cloudwatch-opsgenie-alerts-sns.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
resource "aws_kms_key" "cloudwatch_opsgenie_alerts_sns" {
count = local.cloudwatch_opsgenie_alerts_sns_kms_encryption ? 1 : 0
description = "This key is used to encrypt data in SNS for the CloudWatch Opsgenie Alerts (${local.project_name})"
deletion_window_in_days = 10
enable_key_rotation = true
policy = templatefile(
"${path.root}/policies/kms-key-policy.json.tpl",
{
statement = <<EOT
[
${templatefile("${path.root}/policies/kms-key-policy-statements/root-allow-all.json.tpl",
{
aws_account_id = local.aws_account_id
}
)},
${templatefile("${path.root}/policies/kms-key-policy-statements/cloudwatch-sns-allow-encrypt.json.tpl",
{
sns_topic_arn = "arn:aws:sns:${local.aws_region}:${local.aws_account_id}:${local.project_name}-cloudwatch-opsgenie-alerts"
}
)}
]
EOT
}
)
}
resource "aws_kms_alias" "cloudwatch_opsgenie_alerts_sns" {
count = local.cloudwatch_opsgenie_alerts_sns_kms_encryption ? 1 : 0
name = "alias/${local.project_name}-cloudwatch-opsgenie-alerts-sns"
target_key_id = aws_kms_key.cloudwatch_opsgenie_alerts_sns[0].key_id
}
resource "aws_sns_topic" "cloudwatch_opsgenie_alerts" {
count = local.enable_cloudwatch_opsgenie_alerts ? 1 : 0
name = "${local.project_name}-cloudwatch-opsgenie-alerts"
kms_master_key_id = local.cloudwatch_opsgenie_alerts_sns_kms_encryption ? aws_kms_alias.cloudwatch_opsgenie_alerts_sns[0].name : null
}
resource "aws_kms_key" "cloudwatch_opsgenie_alerts_sns_us_east_1" {
count = local.cloudwatch_opsgenie_alerts_sns_kms_encryption ? 1 : 0
provider = aws.useast1
description = "This key is used to encrypt data in SNS for the CloudWatch Opsgenie Alerts (${local.project_name})"
deletion_window_in_days = 10
enable_key_rotation = true
policy = templatefile(
"${path.root}/policies/kms-key-policy.json.tpl",
{
statement = <<EOT
[
${templatefile("${path.root}/policies/kms-key-policy-statements/root-allow-all.json.tpl",
{
aws_account_id = local.aws_account_id
}
)},
${templatefile("${path.root}/policies/kms-key-policy-statements/cloudwatch-sns-allow-encrypt.json.tpl",
{
sns_topic_arn = "arn:aws:sns:us-east-1:${local.aws_account_id}:${local.project_name}-cloudwatch-opsgenie-alerts"
}
)}
]
EOT
}
)
}
resource "aws_kms_alias" "cloudwatch_opsgenie_alerts_sns_us_east_1" {
count = local.cloudwatch_opsgenie_alerts_sns_kms_encryption ? 1 : 0
provider = aws.useast1
name = "alias/${local.project_name}-cloudwatch-opsgenie-alerts-sns"
target_key_id = aws_kms_key.cloudwatch_opsgenie_alerts_sns_us_east_1[0].key_id
}
resource "aws_sns_topic" "cloudwatch_opsgenie_alerts_us_east_1" {
count = local.enable_cloudwatch_opsgenie_alerts ? 1 : 0
provider = aws.useast1
name = "${local.project_name}-cloudwatch-opsgenie-alerts"
kms_master_key_id = local.cloudwatch_opsgenie_alerts_sns_kms_encryption ? aws_kms_alias.cloudwatch_opsgenie_alerts_sns_us_east_1[0].name : null
}
resource "aws_sns_topic_policy" "sns_cloudwatch_opsgenie_alerts" {
count = local.enable_cloudwatch_opsgenie_alerts ? 1 : 0
arn = aws_sns_topic.cloudwatch_opsgenie_alerts[0].arn
policy = templatefile(
"${path.root}/policies/sns-events-policy.json.tpl",
{
sns_arn = aws_sns_topic.cloudwatch_opsgenie_alerts[0].arn
aws_account_id = local.aws_account_id
}
)
}
resource "aws_sns_topic_policy" "sns_cloudwatch_opsgenie_alerts_us_east_1" {
count = local.enable_cloudwatch_opsgenie_alerts ? 1 : 0
provider = aws.useast1
arn = aws_sns_topic.cloudwatch_opsgenie_alerts_us_east_1[0].arn
policy = templatefile(
"${path.root}/policies/sns-events-policy.json.tpl",
{
sns_arn = aws_sns_topic.cloudwatch_opsgenie_alerts_us_east_1[0].arn
aws_account_id = local.aws_account_id
}
)
}
resource "aws_sns_topic_subscription" "cloudwatch_opsgenie_alerts_subscription" {
count = local.enable_cloudwatch_opsgenie_alerts ? 1 : 0
topic_arn = aws_sns_topic.cloudwatch_opsgenie_alerts[0].arn
protocol = "https"
endpoint = local.cloudwatch_opsgenie_alerts_sns_endpoint
endpoint_auto_confirms = true
confirmation_timeout_in_minutes = 10
}
resource "aws_sns_topic_subscription" "cloudwatch_opsgenie_alerts_subscription_us_east_1" {
count = local.enable_cloudwatch_opsgenie_alerts ? 1 : 0
provider = aws.useast1
topic_arn = aws_sns_topic.cloudwatch_opsgenie_alerts_us_east_1[0].arn
protocol = "https"
endpoint = local.cloudwatch_opsgenie_alerts_sns_endpoint
endpoint_auto_confirms = true
confirmation_timeout_in_minutes = 10
}