MLPAB-1090 - Stream DB Events to Eventbridge Bus

terraform/environment/.envrc

@@ -1,3 +1,4 @@
 export TF_CLI_ARGS_init="-backend-config=role_arn=arn:aws:iam::311462405659:role/operator -upgrade -reconfigure"
 export TF_VAR_default_role=operator
 export TF_VAR_pagerduty_api_key=$(aws-vault exec mlpa-dev -- aws secretsmanager get-secret-value --secret-id "pagerduty_api_key" | jq -r .'SecretString')
+export TF_VAR_container_version=$(aws-vault exec management-global -- aws ssm get-parameter --name "/modernising-lpa/container-version/production" --query 'Parameter.Value' --output text)

terraform/environment/dynamodb.tf

@@ -9,8 +9,9 @@ data "aws_kms_alias" "dynamodb_encryption_key_eu_west_2" {
 }
 
 resource "aws_dynamodb_table" "lpas_table" {
-  name         = "${local.environment_name}-Lpas2"
-  billing_mode = "PAY_PER_REQUEST"
+  name                        = "${local.environment_name}-Lpas2"
+  billing_mode                = "PAY_PER_REQUEST"
+  deletion_protection_enabled = local.default_tags.environment-name == "production" ? true : false
   # see docs/runbooks/disabling_dynamodb_global_tables.md when Global Tables needs to be disabled
   stream_enabled   = local.environment.dynamodb.stream_enabled
   stream_view_type = local.environment.dynamodb.stream_enabled ? "NEW_AND_OLD_IMAGES" : null
@@ -44,8 +45,7 @@ resource "aws_dynamodb_table" "lpas_table" {
   }
 
   lifecycle {
-    prevent_destroy = false
-    ignore_changes  = [replica]
+    ignore_changes = [replica]
   }
   provider = aws.eu_west_1
 }

terraform/environment/reduced_fees.tf

@@ -0,0 +1,14 @@
+module "reduced_fees" {
+  count                = local.environment.reduced_fees.enabled ? 1 : 0
+  source               = "./reduced_fees"
+  target_event_bus_arn = local.environment.reduced_fees.target_event_bus_arn
+  providers = {
+    aws.region = aws.eu_west_1
+    aws.global = aws.global
+  }
+}
+
+moved {
+  from = module.reduced_fees
+  to   = module.reduced_fees[0]
+}

terraform/environment/reduced_fees/main.tf

@@ -0,0 +1,185 @@
+# DynamoDB table for reduced fees
+
+resource "aws_dynamodb_table" "reduced_fees" {
+  name                        = "${data.aws_default_tags.current.tags.environment-name}-reduced-fees"
+  billing_mode                = "PAY_PER_REQUEST"
+  deletion_protection_enabled = data.aws_default_tags.current.tags.environment-name == "production" ? true : false
+  stream_enabled              = true
+  stream_view_type            = "NEW_AND_OLD_IMAGES"
+  hash_key                    = "PK"
+
+  # key for encryption may need to be available to consuming services if they intend to reach in and grab
+  # server_side_encryption {
+  #   enabled     = true
+  #   kms_key_arn = var.dynamodb_encryption_key_arn
+  # }
+
+  attribute {
+    name = "PK"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  lifecycle {
+    ignore_changes = [replica]
+  }
+  provider = aws.region
+}
+
+# Event bus for reduced fees
+
+resource "aws_cloudwatch_event_bus" "reduced_fees" {
+  name     = "${data.aws_default_tags.current.tags.environment-name}-reduced-fees"
+  provider = aws.region
+}
+
+resource "aws_cloudwatch_event_archive" "reduced_fees" {
+  name             = "${data.aws_default_tags.current.tags.environment-name}-reduced-fees"
+  event_source_arn = aws_cloudwatch_event_bus.reduced_fees.arn
+  provider         = aws.region
+}
+
+# Event pipe to send events from dynamodb stream to event bus
+
+resource "aws_pipes_pipe" "reduced_fees" {
+  name        = "${data.aws_default_tags.current.tags.environment-name}-reduced-fees"
+  description = "capture events from dynamodb stream and pass to event bus"
+  role_arn    = aws_iam_role.reduced_fees_pipe.arn
+  source      = aws_dynamodb_table.reduced_fees.stream_arn
+  target      = aws_cloudwatch_event_bus.reduced_fees.arn
+  source_parameters {}
+  target_parameters {}
+  provider = aws.region
+}
+
+resource "aws_iam_role" "reduced_fees_pipe" {
+  name               = "${data.aws_default_tags.current.tags.environment-name}-reduced-fees-pipe"
+  assume_role_policy = data.aws_iam_policy_document.reduced_fees_assume_role.json
+  path               = "/service-role/"
+  provider           = aws.region
+}
+
+data "aws_iam_policy_document" "reduced_fees_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    effect  = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["pipes.amazonaws.com"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceAccount"
+      values   = [data.aws_caller_identity.current.account_id]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceArn"
+      values   = ["arn:aws:pipes:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:pipe/reduced-fees"]
+    }
+  }
+  provider = aws.region
+}
+
+resource "aws_iam_role_policy" "reduced_fees_pipe_source" {
+  name     = "${data.aws_default_tags.current.tags.environment-name}-DynamoDbPipeSource"
+  policy   = data.aws_iam_policy_document.reduced_fees_dynamodb_source.json
+  role     = aws_iam_role.reduced_fees_pipe.id
+  provider = aws.region
+}
+
+data "aws_iam_policy_document" "reduced_fees_dynamodb_source" {
+  statement {
+    actions = [
+      "dynamodb:DescribeStream",
+      "dynamodb:GetRecords",
+      "dynamodb:GetShardIterator",
+      "dynamodb:ListStreams",
+    ]
+    effect    = "Allow"
+    resources = [aws_dynamodb_table.reduced_fees.stream_arn]
+  }
+  provider = aws.region
+}
+
+resource "aws_iam_role_policy" "reduced_fees_pipe_target" {
+  name     = "${data.aws_default_tags.current.tags.environment-name}-EventBusPipeTarget"
+  policy   = data.aws_iam_policy_document.reduced_fees_eventbus_target.json
+  role     = aws_iam_role.reduced_fees_pipe.id
+  provider = aws.global
+}
+
+data "aws_iam_policy_document" "reduced_fees_eventbus_target" {
+  statement {
+    actions = [
+      "events:PutEvents"
+    ]
+    effect    = "Allow"
+    resources = [aws_cloudwatch_event_bus.reduced_fees.arn]
+  }
+  provider = aws.region
+}
+
+# Send event to remote account event bus
+
+resource "aws_iam_role" "cross_account_put" {
+  name               = "${data.aws_default_tags.current.tags.environment-name}-cross-account-put"
+  assume_role_policy = data.aws_iam_policy_document.cross_account_put_assume_role.json
+  provider           = aws.region
+}
+
+resource "aws_iam_role_policy" "cross_account_put" {
+  name     = "${data.aws_default_tags.current.tags.environment-name}-cross-account-put"
+  policy   = data.aws_iam_policy_document.cross_account_put_access.json
+  role     = aws_iam_role.cross_account_put.id
+  provider = aws.region
+}
+
+data "aws_iam_policy_document" "cross_account_put_assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+  provider = aws.region
+}
+
+data "aws_iam_policy_document" "cross_account_put_access" {
+  statement {
+    sid    = "CrossAccountPutAccess"
+    effect = "Allow"
+    actions = [
+      "events:PutEvents",
+    ]
+    resources = [
+      var.target_event_bus_arn
+    ]
+  }
+  provider = aws.region
+}
+
+resource "aws_cloudwatch_event_rule" "cross_account_put" {
+  name        = "${data.aws_default_tags.current.tags.environment-name}-cross-account-put"
+  description = "forward dynamodb stream events to bus in remote account"
+
+  event_pattern = jsonencode({
+    source = ["aws.dynamodb"]
+  })
+  provider = aws.region
+}
+
+resource "aws_cloudwatch_event_target" "cross_account_put" {
+  target_id = "${data.aws_default_tags.current.tags.environment-name}-cross-account-put-event"
+  arn       = var.target_event_bus_arn
+  rule      = aws_cloudwatch_event_rule.cross_account_put.name
+  role_arn  = aws_iam_role.cross_account_put.arn
+  provider  = aws.region
+}

terraform/environment/reduced_fees/terraform.tf

@@ -0,0 +1,29 @@
+terraform {
+  required_version = ">= 1.2.2"
+
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+      configuration_aliases = [
+        aws.region,
+        aws.global,
+      ]
+    }
+  }
+}
+
+data "aws_region" "current" {
+  provider = aws.region
+}
+
+data "aws_caller_identity" "current" {
+  provider = aws.region
+}
+
+data "aws_default_tags" "current" {
+  provider = aws.region
+}
+
+data "aws_region" "global" {
+  provider = aws.global
+}

terraform/environment/reduced_fees/variables.tf

@@ -0,0 +1,7 @@
+variable "target_event_bus_arn" {
+  type = string
+}
+
+# variable "dynamodb_encryption_key_arn" {
+#   type = string
+# }

terraform/environment/terraform.tf

@@ -10,7 +10,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "4.67.0"
+      version = "~> 4.65"
     }
     pagerduty = {
       source  = "PagerDuty/pagerduty"

terraform/environment/terraform.tfvars.json

@@ -41,7 +41,11 @@
         "deletion_protection_enabled": false
       },
       "cloudwatch_application_insights_enabled": false,
-      "pagerduty_service_name": "OPG Modernising LPA Non-Production"
+      "pagerduty_service_name": "OPG Modernising LPA Non-Production",
+      "reduced_fees": {
+        "enabled": false,
+        "target_event_bus_arn": "arn:aws:events:eu-west-1:288342028542:event-bus/default"
+      }
     },
     "dualdemo": {
       "account_id": "653761790766",
@@ -85,7 +89,11 @@
         "deletion_protection_enabled": false
       },
       "cloudwatch_application_insights_enabled": false,
-      "pagerduty_service_name": "OPG Modernising LPA Non-Production"
+      "pagerduty_service_name": "OPG Modernising LPA Non-Production",
+      "reduced_fees": {
+        "enabled": false,
+        "target_event_bus_arn": "arn:aws:events:eu-west-1:288342028542:event-bus/default"
+      }
     },
     "ur": {
       "account_id": "653761790766",
@@ -128,7 +136,11 @@
         "deletion_protection_enabled": false
       },
       "cloudwatch_application_insights_enabled": true,
-      "pagerduty_service_name": "OPG Modernising LPA Non-Production"
+      "pagerduty_service_name": "OPG Modernising LPA Non-Production",
+      "reduced_fees": {
+        "enabled": false,
+        "target_event_bus_arn": "arn:aws:events:eu-west-1:288342028542:event-bus/default"
+      }
     },
     "preproduction": {
       "account_id": "792093328875",
@@ -171,7 +183,11 @@
         "deletion_protection_enabled": false
       },
       "cloudwatch_application_insights_enabled": true,
-      "pagerduty_service_name": "OPG Modernising LPA Non-Production"
+      "pagerduty_service_name": "OPG Modernising LPA Non-Production",
+      "reduced_fees": {
+        "enabled": false,
+        "target_event_bus_arn": "arn:aws:events:eu-west-1:288342028542:event-bus/default"
+      }
     },
     "production": {
       "account_id": "313879017102",
@@ -214,7 +230,11 @@
         "deletion_protection_enabled": true
       },
       "cloudwatch_application_insights_enabled": true,
-      "pagerduty_service_name": "OPG Modernising LPA Non-Production"
+      "pagerduty_service_name": "OPG Modernising LPA Non-Production",
+      "reduced_fees": {
+        "enabled": true,
+        "target_event_bus_arn": "arn:aws:events:eu-west-1:288342028542:event-bus/default"
+      }
     }
   }
 }

terraform/environment/variables.tf

@@ -68,6 +68,10 @@ variable "environments" {
       })
       cloudwatch_application_insights_enabled = bool
       pagerduty_service_name                  = string
+      reduced_fees = object({
+        enabled              = bool
+        target_event_bus_arn = string
+      })
     })
   )
 }