sqs_fair_queueing/main.tf

######################################
# The fair queueing module example
module "sqs_fair_queue" {
  source = "./module_sqs_fair_queueing"

  source_sqs_arn = aws_sqs_queue.queue.arn
  source_sqs_url = aws_sqs_queue.queue.url
  lambda_timeout = aws_sqs_queue.queue.visibility_timeout_seconds - 5
  sqs_prefix     = "mbox-fair-queueing-test-fq"
  num_queues     = 4
  hash_jsonpath  = "$" # This will evenly distribute all messages
  tags           = local.tags
}

######################################
# Example Resources for testing

# tfsec:ignore:aws-s3-enable-bucket-logging Logging is a good idea, but we don't here.
# tfsec:ignore:aws-s3-enable-versioning Versioning is a good idea, but we don't here.
resource "aws_s3_bucket" "bucket" {
  bucket        = "mbox-fair-queueing-test"
  force_destroy = true

  tags = merge(local.tags, {
    Name        = "mbox-fair-queueing-test"
    Environment = "Dev"
    Purpose     = "POC bucket for S3 fair queueing"
  })
}

resource "aws_s3_bucket_acl" "bucket" {
  bucket = aws_s3_bucket.bucket.id
  acl    = "private"
}

resource "aws_s3_bucket_public_access_block" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# tfsec:ignore:aws-s3-encryption-customer-key AWS managed key is sufficient
resource "aws_s3_bucket_server_side_encryption_configuration" "bucket" {
  bucket = aws_s3_bucket.bucket.bucket

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}


# SNS and SQS configuration for the root bucket
# 
# NOTE! Only this first sns/sqs needs to be set up.
# The module will set up the sqs queues for FIFO.
# 
# Remember that the consumer service needs access to the FIFO queues,
# not these.
resource "aws_sqs_queue" "queue" {
  name = "mbox-bucket-notification"

  sqs_managed_sse_enabled = true

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:*:*:mbox-bucket-notification",
      "Condition": {
        "ArnEquals": { "aws:SourceArn": "${aws_s3_bucket.bucket.arn}" }
      }
    }
  ]
}
POLICY

  depends_on = [aws_s3_bucket.bucket]

  tags = local.tags
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.bucket.id

  queue {
    queue_arn     = aws_sqs_queue.queue.arn
    events        = ["s3:ObjectCreated:*"]
    filter_prefix = "incoming/"
  }

  depends_on = [aws_sqs_queue.queue, aws_s3_bucket.bucket]
}