firehose terraform code

Author: Karthikeyannhs

infrastructure/modules/kinesis_firehose/kinesis_firehose_delivery_stream.tf

@@ -0,0 +1,13 @@
+resource "aws_kinesis_firehose_delivery_stream" "eligibility_audit_firehose_delivery_stream" {
+  name        = var.audit_firehose_delivery_stream_name
+  destination = "extended_s3"
+
+  extended_s3_configuration {
+    role_arn   = var.audit_firehose_role_arn
+    bucket_arn = var.s3_audit_bucket_arn
+
+    buffering_size = 1
+    buffering_interval = 60
+    compression_format = "UNCOMPRESSED"
+  }
+}

infrastructure/modules/kinesis_firehose/outputs.tf

@@ -0,0 +1,3 @@
+output "firehose_stream_name" {
+  value = aws_kinesis_firehose_delivery_stream.eligibility_audit_firehose_delivery_stream.name
+}

infrastructure/modules/kinesis_firehose/variables.tf

@@ -0,0 +1,15 @@
+variable "audit_firehose_delivery_stream_name" {
+  description = "audit firehose delivery stream name"
+  type        = string
+}
+
+variable "audit_firehose_role_arn" {
+  description = "audit firehose role arn"
+  type        = string
+}
+
+variable "s3_audit_bucket_arn" {
+  description = "s3 audit bucket arn"
+  type        = string
+}
+

infrastructure/stacks/api-layer/iam_policies.tf

@@ -56,6 +56,13 @@ resource "aws_iam_role_policy" "lambda_s3_read_policy" {
   policy = data.aws_iam_policy_document.s3_rules_bucket_policy.json
 }
 
+# Attach s3 read policy to kinesis firehose role
+resource "aws_iam_role_policy" "kinesis_firehose_s3_read_policy" {
+  name   = "S3ReadAccess"
+  role   = aws_iam_role.eligibility_audit_firehose_role.id
+  policy = data.aws_iam_policy_document.s3_audit_bucket_policy.json
+}
+
 # Attach AWSLambdaVPCAccessExecutionRole to Lambda
 resource "aws_iam_role_policy_attachment" "AWSLambdaVPCAccessExecutionRole" {
   role       = aws_iam_role.eligibility_lambda_role.id
@@ -194,3 +201,23 @@ resource "aws_kms_key_policy" "s3_audit_kms_key" {
   key_id = module.s3_audit_bucket.storage_bucket_kms_key_arn
   policy = data.aws_iam_policy_document.s3_audit_kms_key_policy.json
 }
+
+data "aws_iam_policy_document" "lambda_firehose_write_policy" {
+  statement {
+    sid    = "AllowLambdaToPutToFirehose"
+    effect = "Allow"
+    actions = [
+      "firehose:PutRecord",
+      "firehose:PutRecordBatch"
+    ]
+    resources = [
+      "arn:aws:firehose:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:deliverystream/${module.eligibility_audit_firehose_delivery_stream.firehose_stream_name}"
+    ]
+  }
+}
+
+resource "aws_iam_role_policy" "lambda_firehose_policy" {
+  name   = "LambdaFirehoseWritePolicy"
+  role   = aws_iam_role.eligibility_lambda_role.id
+  policy = data.aws_iam_policy_document.lambda_firehose_write_policy.json
+}

infrastructure/stacks/api-layer/iam_roles.tf

@@ -22,6 +22,18 @@ data "aws_iam_policy_document" "dps_assume_role" {
   }
 }
 
+# Trust policy kinesis firehose
+data "aws_iam_policy_document" "firehose_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["firehose.amazonaws.com"]
+    }
+  }
+}
+
+# Roles
 
 resource "aws_iam_role" "eligibility_lambda_role" {
   name                 = "eligibility_lambda-role${terraform.workspace == "default" ? "" : "-${terraform.workspace}"}"
@@ -36,3 +48,8 @@ resource "aws_iam_role" "write_access_role" {
   assume_role_policy   = data.aws_iam_policy_document.dps_assume_role.json
   permissions_boundary = aws_iam_policy.assumed_role_permissions_boundary.arn
 }
+
+resource "aws_iam_role" "eligibility_audit_firehose_role" {
+  name               = "eligibility_audit_firehouse-role${terraform.workspace == "default" ? "" : "-${terraform.workspace}"}"
+  assume_role_policy = data.aws_iam_policy_document.firehose_assume_role.json
+}

infrastructure/stacks/api-layer/kinesis_firehose.tf

@@ -0,0 +1,6 @@
+module "eligibility_audit_firehose_delivery_stream" {
+  source                              = "../../modules/kinesis_firehose"
+  audit_firehose_delivery_stream_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}-"}eligibility_audit_stream"
+  audit_firehose_role_arn             = aws_iam_role.eligibility_audit_firehose_role.arn
+  s3_audit_bucket_arn                 = module.s3_audit_bucket.storage_bucket_arn
+}