xdr-terraform-modules/base/customer_portal_lambda/sqs.tf

resource "aws_sqs_queue" "sqs_queue" {
  name                        = "portal-scheduler.fifo"
  visibility_timeout_seconds  = 900 # wait 15 minutes; this should always be equal or greater than the lambda timeout or we can get duplicate messages
  message_retention_seconds   = 604800 # Keep a message in the queue for 7 days
  receive_wait_time_seconds   = 0 # how long to wait for a message before returning
  redrive_policy              = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.sqs_queue_dlq.arn}\",\"maxReceiveCount\":1}"
  fifo_queue                  = true
  content_based_deduplication = true
  deduplication_scope         = "queue"
  fifo_throughput_limit       = "perQueue"
  tags                        = merge(var.standard_tags, var.tags)
  kms_master_key_id           = aws_kms_key.sqs_key.id
  kms_data_key_reuse_period_seconds = 3600
}

# Dead Letter queue
resource "aws_sqs_queue" "sqs_queue_dlq" {
  name                      = "portal-scheduler-dlq.fifo"
  fifo_queue                 = true
  tags                      = merge(var.standard_tags, var.tags)
  kms_master_key_id         = aws_kms_key.sqs_key.id
  kms_data_key_reuse_period_seconds = 3600
}

data "aws_iam_policy_document" "sqs_policy" {
  statement {
    effect = "Allow"

    principals {
      identifiers = [ "arn:${var.aws_partition}:iam::${var.aws_account_id}:root" ]
      type = "AWS"
    }

    actions = [ "SQS:*" ]

    resources = [ aws_sqs_queue.sqs_queue.arn ]

  }
}

resource "aws_sqs_queue_policy" "sqs_policy_attach" {
  policy    = data.aws_iam_policy_document.sqs_policy.json
  queue_url = aws_sqs_queue.sqs_queue.id
}

resource "aws_kms_key" "sqs_key" {
  description             = "Encryption of SQS queue for portal-scheduler"
  policy                  = data.aws_iam_policy_document.sqs_kms_policy.json
  enable_key_rotation     = true
}

data "aws_iam_policy_document" "sqs_kms_policy" {
  statement {
    sid = "AllowServices"
    effect = "Allow"
    principals {
      identifiers = ["cloudwatch.amazonaws.com", "sqs.amazonaws.com", "lambda.amazonaws.com"]
      type = "Service"
    }
    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ]
    resources = [ "*" ]
  }
  # allow account to modify/manage key
  statement {
    sid = "AllowThisAccount"
    effect = "Allow"
    principals {
      identifiers = ["arn:${var.aws_partition}:iam::${var.aws_account_id}:root"]
      type = "AWS"
    }
    actions = [
      "kms:*"
    ]
    resources = ["*"]
  }
}

resource "aws_kms_alias" "sqs_key_alias" {
  name          = "alias/portal-scheduler-key"
  target_key_id = aws_kms_key.sqs_key.key_id
}