Terraform AWS Notifications module

Description

The purpose of this module is to provide a building block for processing and delivering notifications, sourced from SNS and forwarded to one or more endpoints (email, slack, teams and or custom subscribers).

Usage

module "notifications" {
  source = "../.."

  allowed_aws_services = ["cloudwatch.amazonaws.com"]
  create_sns_topic     = true
  sns_topic_name       = var.sns_topic_name
  tags                 = var.tags

  subscribers = {
    "opsgenie" = {
      protocol               = "https"
      endpoint               = "https://api.opsgenie.com/v2/alerts"
      endpoint_auto_confirms = true
      raw_message_delivery   = true
    }
  }
}

Update Documentation

The terraform-docs utility is used to generate this README. Follow the below steps to update:

1. Make changes to the .terraform-docs.yml file
2. Fetch the terraform-docs binary (https://terraform-docs.io/user-guide/installation/)
3. Run terraform-docs markdown table --output-file ${PWD}/README.md --output-mode inject .

Using Secrets Manager

The slack configuration can be sourced from AWS Secrets Manager, using the var.slack.secret_name. The secret should be a JSON object reassembling the slack configuration.

{
  "channel": "#channel",
  "username": "username",
  "webhook_url": "https://hooks.slack.com/services/..."
}

Requirements

Name	Version
terraform	>= 1.0.7
aws	>= 5.0.0

Providers

Name	Version
aws	>= 5.0.0

Modules

Name	Source	Version
slack	terraform-aws-modules/notify-slack/aws	6.4.0
sns	terraform-aws-modules/sns/aws	v6.0.1

Resources

Name	Type
aws_sns_topic_subscription.email	resource
aws_sns_topic_subscription.subscribers	resource
aws_caller_identity.current	data source
aws_iam_policy_document.current	data source
aws_region.current	data source
aws_secretsmanager_secret.slack	data source
aws_secretsmanager_secret_version.slack	data source

Inputs

Name	Description	Type	Default	Required
sns_topic_name	The name of the source sns topic where events are published	string	n/a	yes
tags	Tags to apply to all resources	map(string)	n/a	yes
allowed_aws_principals	Optional, list of AWS accounts able to publish via the SNS topic (when creating topic) e.g 123456789012	list(string)	[]	no
allowed_aws_services	Optional, list of AWS services able to publish via the SNS topic (when creating topic) e.g cloudwatch.amazonaws.com	list(string)	[]	no
cloudwatch_log_group_kms_key_id	The KMS key id to use for encrypting the cloudwatch log group (default is none)	string	null	no
cloudwatch_log_group_retention	The retention period for the cloudwatch log group (for lambda function logs) in days	string	"3"	no
create_sns_topic	Whether to create an SNS topic for notifications	bool	false	no
email	The configuration for Email notifications	object({ addresses = optional(list(string)) # The email addresses to send notifications to })	null	no
slack	The configuration for Slack notifications	object({ channel = optional(string) # The channel to post to lambda_name = optional(string, "slack-notify") # The name of the lambda function to create secret_name = optional(string) # An optional secret name in secrets manager to use for the slack configuration username = optional(string, ":aws: Notification") # The username to post as webhook_url = optional(string) # The webhook url to post to })	null	no
sns_topic_policy	The policy to attach to the sns topic, else we default to account root	string	null	no
subscribers	Optional list of custom subscribers to the SNS topic	map(object({ protocol = string # The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially supported, see below). endpoint = string # The endpoint to send data to, the contents will vary with the protocol. (see below for more information) endpoint_auto_confirms = bool # Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty (default is false) raw_message_delivery = bool # Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property) (default is false) }))	{}	no

Outputs

Name	Description
sns_topic_arn	The ARN of the SNS topic