xdr-terraform-modules/base/account_standards_c2/config_aggregator.tf

resource "aws_config_configuration_aggregator" "account" {
  name = "xdr-aggregator-${var.environment}"

  account_aggregation_source {
    account_ids = local.responsible_accounts[var.environment]
    all_regions = true
  }
}

# tfsec:ignore:aws-sns-enable-topic-encryption
resource "aws_sns_topic" "config-notifications" {
  name = "config-notifications"
  #kms_master_key_id = aws_kms_key.config-notifications-key.id # TODO
}

resource "aws_sns_topic_policy" "config-notifications" {
  arn    = aws_sns_topic.config-notifications.arn
  policy = data.aws_iam_policy_document.config-sns.json
}

data "aws_iam_policy_document" "config-sns" {
  statement {
    sid       = "AllowConfig"
    actions   = ["SNS:Publish"]
    effect    = "Allow"
    resources = [aws_sns_topic.config-notifications.arn]
    principals {
      type        = "AWS"
      identifiers = [for a in local.responsible_accounts[var.environment] : "arn:${var.aws_partition}:iam::${a}:root"]
    }
  }
}

resource "aws_sqs_queue" "config-notifications" {
  name                              = "config-notifications"
  visibility_timeout_seconds        = 300    # wait 5 minutes before allowing a different splunk instance to process the same message
  message_retention_seconds         = 604800 # Keep a message in the queue for 7 days
  receive_wait_time_seconds         = 0      # how long to wait for a message before returning
  redrive_policy                    = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.config-notifications-dlq.arn}\",\"maxReceiveCount\":4}"
  tags                              = merge(local.standard_tags, var.tags)
  kms_master_key_id                 = aws_kms_key.config-notifications-key.id
  kms_data_key_reuse_period_seconds = 3600
}

data "aws_iam_policy_document" "config-notifications-sns-topic-can-publish" {
  statement {
    effect = "Allow"

    principals {
      identifiers = ["*"]
      type        = "AWS"
    }

    actions = ["SQS:SendMessage"]

    resources = [aws_sqs_queue.config-notifications.arn]

    condition {
      test     = "ArnEquals"
      values   = [aws_sns_topic.config-notifications.arn]
      variable = "aws:SourceArn"
    }
  }
}

// Dead Letter queue, use same parameters as main queue
resource "aws_sqs_queue" "config-notifications-dlq" {
  name                              = "config-notifications-dlq"
  message_retention_seconds         = 300
  receive_wait_time_seconds         = 0
  tags                              = merge(local.standard_tags, var.tags)
  kms_master_key_id                 = aws_kms_key.config-notifications-key.id
  kms_data_key_reuse_period_seconds = 3600
}

resource "aws_sqs_queue_policy" "config-notifications-can-publish" {
  policy    = data.aws_iam_policy_document.config-notifications-sns-topic-can-publish.json
  queue_url = aws_sqs_queue.config-notifications.id
}

resource "aws_sns_topic_subscription" "config-notifications-to-queue" {
  topic_arn = aws_sns_topic.config-notifications.arn
  protocol  = "sqs"
  endpoint  = aws_sqs_queue.config-notifications.arn
}

resource "aws_kms_key" "config-notifications-key" {
  description         = "Encryption of SNS and SQS queue for config change notifications"
  policy              = data.aws_iam_policy_document.config-notifications-kms-policy.json
  enable_key_rotation = true
}

data "aws_iam_policy_document" "config-notifications-kms-policy" {
  statement {
    sid    = "AllowServices"
    effect = "Allow"
    principals {
      identifiers = ["config.amazonaws.com", "sns.amazonaws.com", "sqs.amazonaws.com"]
      type        = "Service"
    }
    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "AllowOtherAccounts"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [for a in local.responsible_accounts[var.environment] : "arn:${var.aws_partition}:iam::${a}:root"]
    }
    actions = [
      "kms:GenerateDataKey",
      "kms:Encrypt"
    ]
    resources = ["*"]
  }
  # allow account to modify/manage key
  statement {
    sid    = "AllowThisAccount"
    effect = "Allow"
    principals {
      identifiers = ["arn:${var.aws_partition}:iam::${var.aws_account_id}:root"]
      type        = "AWS"
    }
    actions = [
      "kms:*"
    ]
    resources = ["*"]
  }
}

resource "aws_kms_alias" "config-notifications-key-alias" {
  name          = "alias/config-notifications-key"
  target_key_id = aws_kms_key.config-notifications-key.key_id
}