mobile file icon

README.md

close sidebar menu icon

Browse the Repo

file-type-icon.circleci
file-type-icon.github
file-type-iconexamples
file-type-iconmodules
file-type-iconkinesis-firehose
file-type-iconkinesis
file-type-iconmsk
file-type-iconsns-sqs-connection
file-type-iconsns
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconsqs-lambda-connection
file-type-iconsqs
file-type-icontest
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.md
file-type-iconterraform-cloud-enterprise-private-module-...

Browse the Repo

file-type-icon.circleci
file-type-icon.github
file-type-iconexamples
file-type-iconmodules
file-type-iconkinesis-firehose
file-type-iconkinesis
file-type-iconmsk
file-type-iconsns-sqs-connection
file-type-iconsns
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconsqs-lambda-connection
file-type-iconsqs
file-type-icontest
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.md
file-type-iconterraform-cloud-enterprise-private-module-...
SNS

SNS

Create SNS topics with configurable IAM and delivery policies.

Code Preview

View on GitHub:

https://github.com/gruntwork-i...aging/tree/v0.12.5/modules/sns

Preview the Code

mobile file icon

README.md

down

Simple Notification Service (SNS) Topic Module

This module makes it easy to deploy a SNS topic along with the publisher and subscriber policies for the topic.

How do you use this module?

  • See the root README for instructions on using Terraform modules.
  • See the examples folder for example usage.
  • See variables.tf for all the variables you can set on this module.

Here is an example of how you might deploy an SNS topic with this module:

module "sns" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-messaging.git//modules/sns?ref=vx.y.z"

  name         = "my-topic"
  display_name = "my-display"
  allow_publish_accounts = [
    "arn:aws:iam::123456789012:user/Bill",
    "arn:aws:iam::123456789012:user/Ted"
  ]

  allow_subscribe_accounts = [
    "arn:aws:iam::123456789012:user/AbeLincoln"
  ]

  allow_subscribe_protocols = [
    "https"
  ]

  allow_publish_services = [
    "events.amazonaws.com",
    "rds.amazonaws.com"
  ]
  
  delivery_policy = <<EOF
                {
                  "http": {
                    "defaultHealthyRetryPolicy": {
                      "minDelayTarget": 20,
                      "maxDelayTarget": 30,
                      "numRetries": 3,
                      "numMaxDelayRetries": 0,
                      "numNoDelayRetries": 0,
                      "numMinDelayRetries": 0,
                      "backoffFunction": "linear"
                    },
                    "disableSubscriptionOverrides": false
                  }
                }
                EOF
}

  http_success_feedback_role_arn = arn:aws:iam::1234567890:role/HTTPSuccessFeedbackRole
  http_failure_feedback_role_arn = arn:aws:iam::1234567890:role/HTTPFailureFeedbackRole

Delivery policy

SNS supports custom delivery policies when using HTTP/S. In the example above, we use default policy that AWS creates for new topics. The only difference is maxDelayTarget which has default value 20, was changed to 30 for testing.

Details for customizing the policy are here: https://docs.aws.amazon.com/sns/latest/dg/sns-message-delivery-retries.html#creating-delivery-policy

For HTTP delivery policy, you may also provide two IAM role ARNs. These ARNs (created outside of this module) allow SNS to send logs to cloudwatch for success and failure deliveries.

Feedback roles should be created as trust policy below

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "sns.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

The roles should use AmazonSNSRole AWS managed policy, which gives SNS access to cloudwatch

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:PutMetricFilter",
                "logs:PutRetentionPolicy"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Destroying Fifo Topics with an archive policy

If creating a FIFO Topic with message_retention_period set, you will have to unset this variable via an apply with message_retention_period set to null before you can destroy the topic.

To delete a topic with an archive policy, you must first deactivate the archive policy as previously described.

How do I access the SNS topic?

This module includes several Terraform outputs, including:

  1. topic_name: The Name of the created topic
  2. topic_display_name: The Display Name of the created topic
  3. topic_arn: The ARN of the created topic
  4. topic_policy: The Access policy of the created topic

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Contact Us

Ready to hand off the Gruntwork?

Buy Now