xdr-terraform-modules/base/customer_portal_lambda/sqs.tf

resource "aws_sqs_queue" "sqs_queue" {
  name                              = "portal-scheduler.fifo"
  visibility_timeout_seconds        = 900    # wait 15 minutes; this should always be equal or greater than the lambda timeout or we can get duplicate messages
  message_retention_seconds         = 604800 # Keep a message in the queue for 7 days
  receive_wait_time_seconds         = 0      # how long to wait for a message before returning
  redrive_policy                    = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.sqs_queue_dlq.arn}\",\"maxReceiveCount\":1}"
  fifo_queue                        = true
  content_based_deduplication       = true
  deduplication_scope               = "queue"
  fifo_throughput_limit             = "perQueue"
  tags                              = merge(local.standard_tags, var.tags)
  kms_master_key_id                 = aws_kms_key.sqs_key.id
  kms_data_key_reuse_period_seconds = 3600
}

# Dead Letter queue
resource "aws_sqs_queue" "sqs_queue_dlq" {
  name                              = "portal-scheduler-dlq.fifo"
  fifo_queue                        = true
  tags                              = merge(local.standard_tags, var.tags)
  kms_master_key_id                 = aws_kms_key.sqs_key.id
  kms_data_key_reuse_period_seconds = 3600
}

data "aws_iam_policy_document" "sqs_policy" {
  statement {
    effect = "Allow"

    principals {
      identifiers = ["arn:${var.aws_partition}:iam::${var.aws_account_id}:root"]
      type        = "AWS"
    }

    actions = ["SQS:*"]

    resources = [aws_sqs_queue.sqs_queue.arn]

  }
}

resource "aws_sqs_queue_policy" "sqs_policy_attach" {
  policy    = data.aws_iam_policy_document.sqs_policy.json
  queue_url = aws_sqs_queue.sqs_queue.id
}

resource "aws_kms_key" "sqs_key" {
  description         = "Encryption of SQS queue for portal-scheduler"
  policy              = data.aws_iam_policy_document.sqs_kms_policy.json
  enable_key_rotation = true
}

data "aws_iam_policy_document" "sqs_kms_policy" {
	# checkov:skip=CKV_AWS_109: see tfsec aws-iam-no-policy-wildcard ignore comment
	# checkov:skip=CKV_AWS_111: see tfsec aws-iam-no-policy-wildcard ignore comment
  statement {
    sid    = "AllowServices"
    effect = "Allow"
    principals {
      identifiers = ["cloudwatch.amazonaws.com", "sqs.amazonaws.com", "lambda.amazonaws.com"]
      type        = "Service"
    }
    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ]
    # tfsec:ignore:aws-iam-no-policy-wildcards This is read-only access
    resources = ["*"]
  }
  # allow account to modify/manage key
  statement {
    sid    = "AllowThisAccount"
    effect = "Allow"
    principals {
      identifiers = ["arn:${var.aws_partition}:iam::${var.aws_account_id}:root"]
      type        = "AWS"
    }
    actions = [
      "kms:*"
    ]
    resources = ["*"]
  }
}

resource "aws_kms_alias" "sqs_key_alias" {
  name          = "alias/portal-scheduler-key"
  target_key_id = aws_kms_key.sqs_key.key_id
}