terraform-aws-sqs/main.tf at main · microsoftexpert/terraform-aws-sqs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
###############################################################################
# Local values
#
# Keeps the resource blocks below thin and for_each-driven, free of count.
###############################################################################

locals {
 # Single-key maps used to render the DLQ and its redrive resources with
 # for_each instead of count, keyed off enable_dlq.
 dlq = var.enable_dlq ? { this = true }: {}

 # Single-key map used to render the optional queue policy with for_each
 # instead of count, keyed off whether a policy document was supplied.
 queue_policy = var.queue_policy != null ? { this = var.queue_policy }: {}

 # DLQ name: caller override, or derived from the primary queue name with the
 # ".fifo" suffix repositioned so FIFO parity holds.
 dlq_name_effective = var.dlq_name != null ? var.dlq_name: (var.fifo_queue ? "${trimsuffix(var.name, ".fifo")}-dlq.fifo": "${var.name}-dlq")

 # Redrive-allow source ARNs: caller-supplied list, or fall back to this
 # module's own primary queue ARN (the minimum viable, always-safe default).
 redrive_allow_source_queue_arns = (length(var.redrive_allow_source_queue_arns) > 0
 ? var.redrive_allow_source_queue_arns
: [aws_sqs_queue.this.arn])
}

###############################################################################
# Primary queue (keystone)
###############################################################################

resource "aws_sqs_queue" "this" {
 name = var.name

 fifo_queue = var.fifo_queue
 content_based_deduplication = var.fifo_queue ? var.content_based_deduplication: null
 deduplication_scope = var.fifo_queue ? var.deduplication_scope: null
 fifo_throughput_limit = var.fifo_queue ? var.fifo_throughput_limit: null

 delay_seconds = var.delay_seconds
 max_message_size = var.max_message_size
 message_retention_seconds = var.message_retention_seconds
 receive_wait_time_seconds = var.receive_wait_time_seconds
 visibility_timeout_seconds = var.visibility_timeout_seconds

 # Secure by default: SSE-SQS (Amazon-managed) unless a CMK is supplied, in
 # which case SSE-KMS takes over. SQS cannot be created with encryption fully
 # disabled by this module.
 sqs_managed_sse_enabled = var.kms_key_arn == null ? true: null
 kms_master_key_id = var.kms_key_arn
 kms_data_key_reuse_period_seconds = var.kms_key_arn != null ? var.kms_data_key_reuse_period_seconds: null

 tags = var.tags

 timeouts {
 create = try(var.timeouts.create, null)
 update = try(var.timeouts.update, null)
 delete = try(var.timeouts.delete, null)
 }
}

###############################################################################
# Dead-letter queue (secure by default — enable_dlq = true)
#
# Always mirrors fifo_queue and the encryption posture of the primary queue so
# queue-type parity (an API-enforced redrive requirement) can never drift.
###############################################################################

resource "aws_sqs_queue" "dlq" {
 for_each = local.dlq

 name = local.dlq_name_effective

 fifo_queue = var.fifo_queue

 message_retention_seconds = var.dlq_message_retention_seconds

 sqs_managed_sse_enabled = var.kms_key_arn == null ? true: null
 kms_master_key_id = var.kms_key_arn
 kms_data_key_reuse_period_seconds = var.kms_key_arn != null ? var.kms_data_key_reuse_period_seconds: null

 tags = var.tags

 timeouts {
 create = try(var.timeouts.create, null)
 update = try(var.timeouts.update, null)
 delete = try(var.timeouts.delete, null)
 }
}

###############################################################################
# Redrive policy — binds the primary queue to the DLQ (dedicated resource,
# not the inline redrive_policy argument; see SCOPE.md Design decisions).
###############################################################################

resource "aws_sqs_queue_redrive_policy" "this" {
 for_each = local.dlq

 queue_url = aws_sqs_queue.this.id

 redrive_policy = jsonencode({
 deadLetterTargetArn = aws_sqs_queue.dlq[each.key].arn
 maxReceiveCount = var.max_receive_count
 })
}

###############################################################################
# Redrive-allow policy — scopes which source queue ARNs may redrive into the
# DLQ (dedicated resource, not the inline redrive_allow_policy argument; see
# SCOPE.md Design decisions). Defaults to byQueue, never allowAll.
###############################################################################

resource "aws_sqs_queue_redrive_allow_policy" "dlq" {
 for_each = local.dlq

 queue_url = aws_sqs_queue.dlq[each.key].id

 redrive_allow_policy = jsonencode(merge({ redrivePermission = var.redrive_allow_policy_type },
 var.redrive_allow_policy_type == "byQueue" ? { sourceQueueArns = local.redrive_allow_source_queue_arns }: {}))
}

###############################################################################
# Queue access policy (optional — rendered only when var.queue_policy is set)
###############################################################################

resource "aws_sqs_queue_policy" "this" {
 for_each = local.queue_policy

 queue_url = aws_sqs_queue.this.id
 policy = each.value
}