Skip to content

A Terraform module to provision SQS resources to the Cloud Platform.

License

Notifications You must be signed in to change notification settings

ministryofjustice/cloud-platform-terraform-sqs

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

cloud-platform-terraform-sqs

Releases

This Terraform module will create an Amazon Simple Queue Service (SQS) queue for use on the Cloud Platform.

Usage

module "sqs" {
  source = "github.com/ministryofjustice/cloud-platform-terraform-sqs?ref=version" # use the latest release

  # Queue configuration
  sqs_name        = "example"
  encrypt_sqs_kms = "true"

  # Tags
  business_unit          = var.business_unit
  application            = var.application
  is_production          = var.is_production
  team_name              = var.team_name # also used for naming the queue
  namespace              = var.namespace
  environment_name       = var.environment
  infrastructure_support = var.infrastructure_support
}

Access policy

SQS topics must be allowed access to either read or write, depending on application design, via an IAM policy.

Due to a glitch in the AWS API, TF cannot create the queue policy in a single step, so a separate resource type has been defined. To use, add in the same /resources/:

resource "aws_sqs_queue_policy" "example_sqs_policy" {
  queue_url = "${module.example_sqs.sqs_id}"

  policy = <<EOF
  {
    "Version": "2012-10-17",
    "Id": "${module.example_sqs.sqs_arn}/SQSDefaultPolicy",
    "Statement":
      [
        {
          "Effect": "Allow",
          "Principal": {"AWS": "*"},
          "Resource": "${module.example_sqs.sqs_arn}",
          "Action": "SQS:SendMessage",
          "Condition":
            {
              "ArnEquals":
                {
                  "aws:SourceArn": "${module.example_sns.topic_arn}"
                }
              }
        }
      ]
  }
  EOF
}

Note the reference to an SNS topic, which needs to be defined in the same namespace.

Redrive policy

Messages that cannot be parsed are copied to a "dead letter" queue the ARN of which can be specified inline:

redrive_policy = <<EOF
  {
    "deadLetterTargetArn": "${module.example_dead_letter_queue.sqs_arn}","maxReceiveCount": 1
  }
  EOF

See the examples/ folder for more information.

Requirements

Name Version
terraform >= 1.2.5
aws >= 4.0.0
random >= 2.0.0

Providers

Name Version
aws >= 4.0.0
random >= 2.0.0

Modules

No modules.

Resources

Name Type
aws_iam_policy.irsa resource
aws_kms_alias.alias resource
aws_kms_key.kms resource
aws_sqs_queue.terraform_queue resource
random_id.id resource
aws_caller_identity.current data source
aws_iam_policy_document.irsa data source

Inputs

Name Description Type Default Required
application Application name string n/a yes
business_unit Area of the MOJ responsible for the service string n/a yes
content_based_deduplication Enables content-based deduplication for FIFO queues. bool null no
deduplication_scope Specifies whether message deduplication occurs at the message group or queue level. Valid values are messageGroup and queue. string null no
delay_seconds The time in seconds that the delivery of all messages in the queue will be delayed. An integer from 0 to 900 (15 minutes). number 0 no
encrypt_sqs_kms If set to true, this will create aws_kms_key and aws_kms_alias resources and add kms_master_key_id in aws_sqs_queue resource bool false no
environment_name Environment name string n/a yes
fifo_queue FIFO means exactly-once processing. Duplicates are not introduced into the queue. bool false no
fifo_throughput_limit Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group. Valid values are perQueue (default) and perMessageGroupId. string null no
infrastructure_support The team responsible for managing the infrastructure. Should be of the form () string n/a yes
is_production Whether this is used for production or not string n/a yes
kms_data_key_reuse_period_seconds The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again. An integer representing seconds, between 60 seconds (1 minute) and 86,400 seconds (24 hours). number 300 no
kms_external_access A list of external AWS principals (e.g. account ids, or IAM roles) that can access the KMS key, to enable cross-account message decryption. list(string) [] no
max_message_size The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). number 262144 no
message_retention_seconds The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days). number 345600 no
namespace Namespace name string n/a yes
receive_wait_time_seconds The time for which a ReceiveMessage call will wait for a message to arrive (long polling) before returning. An integer from 0 to 20 (seconds). number 0 no
redrive_policy escaped JSON string to set up the Dead Letter Queue any "" no
sqs_name SQS queue name string n/a yes
team_name Team name string n/a yes
visibility_timeout_seconds The visibility timeout for the queue. An integer from 0 to 43200 (12 hours). number 30 no

Outputs

Name Description
irsa_policy_arn IAM policy ARN for access to the SQS queue
sqs_arn The ARN of the SQS queue
sqs_id The URL for the created Amazon SQS queue
sqs_name The name of the SQS queue

Tags

Some of the inputs for this module are tags. All infrastructure resources must be tagged to meet the MOJ Technical Guidance on Documenting owners of infrastructure.

You should use your namespace variables to populate these. See the Usage section for more information.

Reading Material