cloud-platform-terraform-sqs

This Terraform module will create an Amazon Simple Queue Service (SQS) queue for use on the Cloud Platform.

Usage

module "sqs" {
  source = "github.com/ministryofjustice/cloud-platform-terraform-sqs?ref=version" # use the latest release

  # Queue configuration
  sqs_name        = "example"
  encrypt_sqs_kms = "true"

  # Tags
  business_unit          = var.business_unit
  application            = var.application
  is_production          = var.is_production
  team_name              = var.team_name # also used for naming the queue
  namespace              = var.namespace
  environment_name       = var.environment
  infrastructure_support = var.infrastructure_support
}

Access policy

SQS topics must be allowed access to either read or write, depending on application design, via an IAM policy.

Due to a glitch in the AWS API, TF cannot create the queue policy in a single step, so a separate resource type has been defined. To use, add in the same /resources/:

resource "aws_sqs_queue_policy" "example_sqs_policy" {
  queue_url = "${module.example_sqs.sqs_id}"

  policy = <<EOF
  {
    "Version": "2012-10-17",
    "Id": "${module.example_sqs.sqs_arn}/SQSDefaultPolicy",
    "Statement":
      [
        {
          "Effect": "Allow",
          "Principal": {"AWS": "*"},
          "Resource": "${module.example_sqs.sqs_arn}",
          "Action": "SQS:SendMessage",
          "Condition":
            {
              "ArnEquals":
                {
                  "aws:SourceArn": "${module.example_sns.topic_arn}"
                }
              }
        }
      ]
  }
  EOF
}

Note the reference to an SNS topic, which needs to be defined in the same namespace.

Redrive policy

Messages that cannot be parsed are copied to a "dead letter" queue the ARN of which can be specified inline:

redrive_policy = <<EOF
  {
    "deadLetterTargetArn": "${module.example_dead_letter_queue.sqs_arn}","maxReceiveCount": 1
  }
  EOF

See the examples/ folder for more information.

Requirements

Name	Version
terraform	>= 1.2.5
aws	>= 4.0.0
random	>= 2.0.0

Providers

Name	Version
aws	>= 4.0.0
random	>= 2.0.0

Modules

No modules.

Resources

Name	Type
aws_iam_policy.irsa	resource
aws_kms_alias.alias	resource
aws_kms_key.kms	resource
aws_sqs_queue.terraform_queue	resource
random_id.id	resource
aws_caller_identity.current	data source
aws_iam_policy_document.irsa	data source

Inputs

Name	Description	Type	Default	Required
application	Application name	string	n/a	yes
business_unit	Area of the MOJ responsible for the service	string	n/a	yes
content_based_deduplication	Enables content-based deduplication for FIFO queues.	bool	null	no
deduplication_scope	Specifies whether message deduplication occurs at the message group or queue level. Valid values are messageGroup and queue.	string	null	no
delay_seconds	The time in seconds that the delivery of all messages in the queue will be delayed. An integer from 0 to 900 (15 minutes).	number	0	no
encrypt_sqs_kms	If set to true, this will create aws_kms_key and aws_kms_alias resources and add kms_master_key_id in aws_sqs_queue resource	bool	false	no
environment_name	Environment name	string	n/a	yes
fifo_queue	FIFO means exactly-once processing. Duplicates are not introduced into the queue.	bool	false	no
fifo_throughput_limit	Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group. Valid values are perQueue (default) and perMessageGroupId.	string	null	no
infrastructure_support	The team responsible for managing the infrastructure. Should be of the form ()	string	n/a	yes
is_production	Whether this is used for production or not	string	n/a	yes
kms_data_key_reuse_period_seconds	The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again. An integer representing seconds, between 60 seconds (1 minute) and 86,400 seconds (24 hours).	number	300	no
kms_external_access	A list of external AWS principals (e.g. account ids, or IAM roles) that can access the KMS key, to enable cross-account message decryption.	list(string)	[]	no
max_message_size	The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB).	number	262144	no
message_retention_seconds	The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days).	number	345600	no
namespace	Namespace name	string	n/a	yes
receive_wait_time_seconds	The time for which a ReceiveMessage call will wait for a message to arrive (long polling) before returning. An integer from 0 to 20 (seconds).	number	0	no
redrive_policy	escaped JSON string to set up the Dead Letter Queue	any	""	no
sqs_name	SQS queue name	string	n/a	yes
team_name	Team name	string	n/a	yes
visibility_timeout_seconds	The visibility timeout for the queue. An integer from 0 to 43200 (12 hours).	number	30	no

Outputs

Name	Description
irsa_policy_arn	IAM policy ARN for access to the SQS queue
sqs_arn	The ARN of the SQS queue
sqs_id	The URL for the created Amazon SQS queue
sqs_name	The name of the SQS queue

Tags

Some of the inputs for this module are tags. All infrastructure resources must be tagged to meet the MOJ Technical Guidance on Documenting owners of infrastructure.

You should use your namespace variables to populate these. See the Usage section for more information.

Reading Material

• Cloud Platform user guide
• Amazon Simple Queue Service (SQS) developer guide