terraform-aws-modules / terraform-aws-sns

Terraform module to create AWS SNS resources 🇺🇦

AWS SNS Topic Terraform module

Terraform module which creates SNS resources on AWS

Usage

Simple Topic

module "sns_topic" {
  source  = "terraform-aws-modules/sns/aws"

  name  = "simple"

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

Topic w/ SQS Subscription

module "sns_topic" {
  source  = "terraform-aws-modules/sns/aws"

  name  = "pub-sub"

  topic_policy_statements = {
    pub = {
      actions = ["sns:Publish"]
      principals = [{
        type        = "AWS"
        identifiers = ["arn:aws:iam::66666666666:role/publisher"]
      }]
    },

    sub = {
      actions = [
        "sns:Subscribe",
        "sns:Receive",
      ]

      principals = [{
        type        = "AWS"
        identifiers = ["*"]
      }]

      conditions = [{
        test     = "StringLike"
        variable = "sns:Endpoint"
        values   = ["arn:aws:sqs:eu-west-1:11111111111:subscriber"]
      }]
    }
  }

  subscriptions = {
    sqs = {
      protocol = "sqs"
      endpoint = "arn:aws:sqs:eu-west-1:11111111111:subscriber"
    }
  }

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

FIFO Topic w/ FIFO SQS Subscription

module "sns_topic" {
  source  = "terraform-aws-modules/sns/aws"

  name  = "my-topic"

  # SQS queue must be FIFO as well
  fifo_topic                  = true
  content_based_deduplication = true

  topic_policy_statements = {
    pub = {
      actions = ["sns:Publish"]
      principals = [{
        type        = "AWS"
        identifiers = ["arn:aws:iam::66666666666:role/publisher"]
      }]
    },

    sub = {
      actions = [
        "sns:Subscribe",
        "sns:Receive",
      ]

      principals = [{
        type        = "AWS"
        identifiers = ["*"]
      }]

      conditions = [{
        test     = "StringLike"
        variable = "sns:Endpoint"
        values   = ["arn:aws:sqs:eu-west-1:11111111111:subscriber.fifo"]
      }]
    }
  }

  subscriptions = {
    sqs = {
      protocol = "sqs"
      endpoint = "arn:aws:sqs:eu-west-1:11111111111:subscriber.fifo"
    }
  }

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

Examples

• Complete

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.25

Providers

Name	Version
aws	>= 5.25

Modules

No modules.

Resources

Name	Type
aws_sns_topic.this	resource
aws_sns_topic_data_protection_policy.this	resource
aws_sns_topic_policy.this	resource
aws_sns_topic_subscription.this	resource
aws_caller_identity.current	data source
aws_iam_policy_document.this	data source

Inputs

Name	Description	Type	Default	Required
application_feedback	Map of IAM role ARNs and sample rate for success and failure feedback	map(string)	{}	no
archive_policy	The message archive policy for FIFO topics.	string	null	no
content_based_deduplication	Boolean indicating whether or not to enable content-based deduplication for FIFO topics.	bool	false	no
create	Determines whether resources will be created (affects all resources)	bool	true	no
create_subscription	Determines whether an SNS subscription is created	bool	true	no
create_topic_policy	Determines whether an SNS topic policy is created	bool	true	no
data_protection_policy	A map of data protection policy statements	string	null	no
delivery_policy	The SNS delivery policy	string	null	no
display_name	The display name for the SNS topic	string	null	no
enable_default_topic_policy	Specifies whether to enable the default topic policy. Defaults to true	bool	true	no
fifo_topic	Boolean indicating whether or not to create a FIFO (first-in-first-out) topic	bool	false	no
firehose_feedback	Map of IAM role ARNs and sample rate for success and failure feedback	map(string)	{}	no
http_feedback	Map of IAM role ARNs and sample rate for success and failure feedback	map(string)	{}	no
kms_master_key_id	The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK	string	null	no
lambda_feedback	Map of IAM role ARNs and sample rate for success and failure feedback	map(string)	{}	no
name	The name of the SNS topic to create	string	null	no
override_topic_policy_documents	List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid	list(string)	[]	no
signature_version	If SignatureVersion should be 1 (SHA1) or 2 (SHA256). The signature version corresponds to the hashing algorithm used while creating the signature of the notifications, subscription confirmations, or unsubscribe confirmation messages sent by Amazon SNS.	number	null	no
source_topic_policy_documents	List of IAM policy documents that are merged together into the exported document. Statements must have unique sids	list(string)	[]	no
sqs_feedback	Map of IAM role ARNs and sample rate for success and failure feedback	map(string)	{}	no
subscriptions	A map of subscription definitions to create	any	{}	no
tags	A map of tags to add to all resources	map(string)	{}	no
topic_policy	An externally created fully-formed AWS policy as JSON	string	null	no
topic_policy_statements	A map of IAM policy statements for custom permission usage	any	{}	no
tracing_config	Tracing mode of an Amazon SNS topic. Valid values: PassThrough, Active.	string	null	no
use_name_prefix	Determines whether name is used as a prefix	bool	false	no

Outputs

Name	Description
subscriptions	Map of subscriptions created and their attributes
topic_arn	The ARN of the SNS topic, as a more obvious property (clone of id)
topic_beginning_archive_time	The oldest timestamp at which a FIFO topic subscriber can start a replay
topic_id	The ARN of the SNS topic
topic_name	The name of the topic
topic_owner	The AWS Account ID of the SNS topic owner

Authors

Module is maintained by Anton Babenko with help from these awesome contributors.

License

Apache 2 Licensed. See LICENSE for full details.

terraform-aws-sns's Issues

Missing SNS Topic policy action: "sns:Receive"

Description

AWS recently updated their SNS Topic policy actions by including additional action: "sns:Receive". You are missing this action in your module, hence those that use the module have a reported change where Terraform wants to remove this action from the policy.

Line: https://github.com/terraform-aws-modules/terraform-aws-sns/blob/master/main.tf#L62C13-L62C13

Expected behavior

Actual behavior

Additional context

Please fix it ASAP.

example is not related to the sns module

Not sure, how the example is related to the SNS module
https://github.com/terraform-aws-modules/terraform-aws-sns/blob/master/examples/complete/main.tf
Seems that it's an example of KMS.
Please, check it out.

Missing property on module

Hi there
I was testing this module and noticed that the "firehose_success_feedback_sample_rate" property is missing from the "aws_sns_topic" resource.

Cannot reference module.<name>.topic_arn inside aws_iam_policy_document as value for topic_policy

Description

When creating a totally custom SNS policy using a terraform aws_iam_policy_document as the topic_policy value, terraform throws a Error: Cycle Error if the module output of the module the policy is being attached to is referenced in the SNS topics policy.

The policy works fine if I remove the module reference and hardcode the ARN, however since this behaviour works in other Terraform modules for example https://github.com/terraform-aws-modules/terraform-aws-s3-bucket I figured it would work in this one

Versions

• Module version [Required]: 6.0.1

• Terraform version: v1.5.7

• Provider version(s):
  • registry.terraform.io/hashicorp/aws v5.43.0

Reproduction Code [Required]

data "aws_iam_policy_document" "sns_policy" {

  statement {
    sid       = "sub"
    effect    = "Allow"
    resources = [
      "${module.sns.topic_arn}/*",
    ]

    actions = [
      "sns:Subscribe"
    ]
    principals {
      type        = "AWS"
      identifiers = ["*"]

    }
  }
}

module "sns" {

  source = "terraform-aws-modules/sns/aws"

  name = "bug-report-sns-topic"

  create_topic_policy     = false
  topic_policy            = data.aws_iam_policy_document.sns_policy.json
}

Steps to reproduce the behaviour:

1. run terraform init
2. run terraform validate

Expected behavior

The validation should pass with no errors.

Actual behavior

The validation fails with the following error:

╷
│ Error: Cycle: module.sns.output.topic_arn (expand), data.aws_iam_policy_document.sns_policy, module.sns.var.topic_policy (expand), module.sns.aws_sns_topic.this
│ 
│ 
╵

Terminal Output Screenshot(s)

Additional context

I've done similar things with terraform modules for example https://github.com/terraform-aws-modules/terraform-aws-s3-bucket where doing the following:

data "aws_iam_policy_document" "bucket_policy" {

  statement {
    sid    = "AllowReadWriteAccess"
    effect = "Allow"
    resources = [
      module.s3.s3_bucket_arn,
      "${module.s3.s3_bucket_arn}/*"
    ]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    actions = [
      "s3:List*",
      "s3:Get*",
      "s3:DeleteObject"
    ]
  }
}



module "s3" {
  source = "terraform-aws-modules/s3-bucket/aws"

  bucket        = "s3-bucket"
  attach_policy = true
  policy        = data.aws_iam_policy_document.bucket_policy.json

}

No subscription option

No subscription option to subscribe an email to get notified

"Receive" IAM action unknown

terraform-aws-sns/main.tf

Line 66 in a75132b

"sns:Receive",

sns:Receive is not a recognized IAM action, as seen in the docs.

I haven't experienced an error from this, but from a security perspective it's unclear what its purpose is. Why is it there?

`Error: invalid topic name` when creating a FIFO Topic

Description

When enabling FIFO SNS topic by using:

  fifo_topic                  = true
  content_based_deduplication = true

If I don't append the .fifo suffix in my topic name it throws an error: Error: invalid topic name: my-topic.

In terraform-aws-sqs module the .fifo suffix is appended automatically when creating a FIFO queue.

Let me know if I can open a PR with the change in case you think it would be better to do something similar for this module too.

Tags input is missing in documentation

Tags input is missing in documentation.

Policy Deletes and Recreate on its own

When creating a multiple statements policy Terraform deletes or creates the second policy every time.

When running first apply the policy created successfully (as it should be):

when running the second apply command (without any code changes) the result is the second statement will be deleted:

The required outcome should be that the second statement won't deleted in the second apply command and there will be no changes to apply.

Add wrapper module generated with pre-commit

Is your request related to a problem? Please describe.

Describe the solution you'd like.

Add wrapper module same as in SQS module

Describe alternatives you've considered.

Additional context

count = "true" for teraform011 branch

For the master branch you'e changed the "count" line to evaluate to a number, but for the teraform11 branch, this evaluates by default to a string value of "true".