Skip to content

RiveryIO/forkof-terraform-aws-eventbridge

BranchesTags
 
 

Repository files navigation

AWS EventBridge Terraform module

Terraform module to create EventBridge resources.

Supported Features

  • Creates AWS EventBridge Resources (bus, rules, targets, permissions, connections, destinations, pipes, schedules and schedule groups)
  • Attach resources to an existing EventBridge bus
  • Support AWS EventBridge Archives and Replays
  • Conditional creation for many types of resources
  • Support IAM policy attachments and various ways to create and attach additional policies

Usage

EventBridge Complete

Most common use-case which creates custom bus, rules and targets.

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  rules = {
    orders = {
      description   = "Capture all order data"
      event_pattern = jsonencode({ "source" : ["myapp.orders"] })
      enabled       = true
    }
  }

  targets = {
    orders = [
      {
        name            = "send-orders-to-sqs"
        arn             = aws_sqs_queue.queue.arn
        dead_letter_arn = aws_sqs_queue.dlq.arn
      },
      {
        name              = "send-orders-to-kinesis"
        arn               = aws_kinesis_stream.this.arn
        dead_letter_arn   = aws_sqs_queue.dlq.arn
        input_transformer = local.kinesis_input_transformer
      },
      {
        name = "log-orders-to-cloudwatch"
        arn  = aws_cloudwatch_log_group.this.arn
      }
    ]
  }

  tags = {
    Name = "my-bus"
  }
}

EventBridge Bus

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  tags = {
    Name = "my-bus"
  }
}

EventBridge Rule

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_targets = false

  rules = {
    logs = {
      description   = "Capture log data"
      event_pattern = jsonencode({ "source" : ["my.app.logs"] })
    }
  }
}

EventBridge Target

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  rules = {
    logs = {
      description   = "Capture log data"
      event_pattern = jsonencode({ "source" : ["my.app.logs"] })
    }
  }

  targets = {
    logs = [
      {
        name = "send-logs-to-sqs"
        arn  = aws_sqs_queue.queue.arn
      },
      {
        name = "send-logs-to-cloudwatch"
        arn  = aws_cloudwatch_log_stream.logs.arn
      }
    ]
  }
}

EventBridge Archive

module "eventbridge_with_archive" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_archives = true

  archives = {
    "my-bus-launch-archive" = {
      description    = "EC2 AutoScaling Event archive",
      retention_days = 1
      event_pattern  = <<PATTERN
      {
        "source": ["aws.autoscaling"],
        "detail-type": ["EC2 Instance Launch Successful"]
      }
      PATTERN
    }
  }

  tags = {
    Name = "my-bus"
  }
}

EventBridge Permission

module "eventbridge_with_permissions" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_permissions = true

  permissions = {
    "099720109477 DevAccess" = {}
    "099720109466 ProdAccess" = {}
  }

  tags = {
    Name = "my-bus"
  }
}

EventBridge with schedule rule and Lambda target

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  create_bus = false

  rules = {
    crons = {
      description         = "Trigger for a Lambda"
      schedule_expression = "rate(5 minutes)"
    }
  }

  targets = {
    crons = [
      {
        name  = "lambda-loves-cron"
        arn   = "arn:aws:lambda:ap-southeast-1:135367859851:function:resolved-penguin-lambda"
        input = jsonencode({"job": "cron-by-rate"})
      }
    ]
  }
}

EventBridge with schedule rule and Step Functions target

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  create_bus = false

  rules = {
    crons = {
      description         = "Run state machine everyday 10:00 UTC"
      schedule_expression = "cron(0 10 * * ? *)"
    }
  }

  targets = {
    crons = [
      {
        name            = "your-awesome-state-machine"
        arn             = "arn:aws:states:us-east-1:123456789012:stateMachine:your-awesome-state-machine"
        attach_role_arn = true
      }
    ]
  }

  sfn_target_arns   = ["arn:aws:states:us-east-1:123456789012:stateMachine:your-awesome-state-machine"]
  attach_sfn_policy = true
}

EventBridge Scheduler which triggers Lambda Function

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "example" # "default" bus already support schedule_expression in rules

  attach_lambda_policy = true
  lambda_target_arns   = ["arn:aws:lambda:us-east-1:135367859851:function:resolved-penguin-lambda"]

  schedules = {
    lambda-cron = {
      description         = "Trigger for a Lambda"
      schedule_expression = "rate(1 day)"
      timezone            = "Europe/London"
      arn                 = "arn:aws:lambda:us-east-1:135367859851:function:resolved-penguin-lambda"
      input               = jsonencode({ "job" : "cron-by-rate" })
    }
  }
}

EventBridge API Destination

module "eventbridge_with_api_destination" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_connections      = true
  create_api_destinations = true

  attach_api_destination_policy = true

  connections = {
    smee = {
      authorization_type = "OAUTH_CLIENT_CREDENTIALS"
      auth_parameters = {
        oauth = {
          authorization_endpoint = "https://oauth.endpoint.com"
          http_method            = "GET"

          client_parameters = {
            client_id     = "1234567890"
            client_secret = "Pass1234!"
          }

          oauth_http_parameters = {
            body = [{
              key             = "body-parameter-key"
              value           = "body-parameter-value"
              is_value_secret = false
            }]

            header = [{
              key   = "header-parameter-key1"
              value = "header-parameter-value1"
            }, {
              key             = "header-parameter-key2"
              value           = "header-parameter-value2"
              is_value_secret = true
            }]

            query_string = [{
              key             = "query-string-parameter-key"
              value           = "query-string-parameter-value"
              is_value_secret = false
            }]
          }
        }
      }
    }
  }

  api_destinations = {
    smee = {
      description                      = "my smee endpoint"
      invocation_endpoint              = "https://smee.io/hgoubgoibwekt331"
      http_method                      = "POST"
      invocation_rate_limit_per_second = 200
    }
  }
}

Additional IAM policies for Step Function

In addition to all supported AWS service integrations you may want to create and attach additional policies.

There are 5 supported ways to attach additional IAM policies to IAM role used by Step Function:

  1. policy_json - JSON string or heredoc, when attach_policy_json = true.
  2. policy_jsons - List of JSON strings or heredoc, when attach_policy_jsons = true and number_of_policy_jsons > 0.
  3. policy - ARN of existing IAM policy, when attach_policy = true.
  4. policies - List of ARNs of existing IAM policies, when attach_policies = true and number_of_policies > 0.
  5. policy_statements - Map of maps to define IAM statements which will be generated as IAM policy. Requires attach_policy_statements = true. See examples/complete for more information.

Conditional creation

Sometimes you need to have a way to create resources conditionally but Terraform does not allow usage of count inside module block, so the solution is to specify create arguments.

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  create = false # to disable all resources

  create_bus              = false  # to control creation of the EventBridge Bus and related resources
  create_rules            = false  # to control creation of EventBridge Rules and related resources
  create_targets          = false  # to control creation of EventBridge Targets and related resources
  create_archives         = false  # to control creation of EventBridge Archives
  create_permissions      = false  # to control creation of EventBridge Permissions
  create_role             = false  # to control creation of the IAM role and policies required for EventBridge
  create_connections      = false  # to control creation of EventBridge Connection resources
  create_api_destinations = false  # to control creation of EventBridge Destination resources
  create_schedule_groups  = false  # to control creation of EventBridge Schedule Group resources
  create_schedules        = false  # to control creation of EventBridge Schedule resources
  create_pipes            = false  # to control creation of EventBridge Pipes resources

  attach_cloudwatch_policy       = false
  attach_ecs_policy              = false
  attach_kinesis_policy          = false
  attach_kinesis_firehose_policy = false
  attach_lambda_policy           = false
  attach_sfn_policy              = false
  attach_sqs_policy              = false
  attach_tracing_policy          = false
  attach_api_destination_policy  = false

  # ... omitted
}

Examples

  • Complete - Creates EventBridge resources (bus, rules and targets) and connect with SQS queues, Kinesis Stream, Step Function, CloudWatch Logs, Lambda Functions, and more.
  • HTTP API Gateway - Creates an integration with HTTP API Gateway as event source.
  • Using Default Bus - Creates resources in the default bus.
  • Archive - EventBridge Archives resources in various configurations.
  • Permissions - Controls permissions to EventBridge.
  • Scheduler - EventBridge Scheduler which works with any bus (recommended way).
  • ECS Scheduling Events - Use default bus to schedule events on ECS.
  • Lambda Scheduling Events - Trigger Lambda functions on schedule (works only with default bus).
  • API Destination - Control access to EventBridge using API destinations.
  • Pipes - EventBridge Pipes with lots of configurations.

Requirements

Name Version
terraform >= 1.0
aws >= 5.61

Providers

Name Version
aws >= 5.61

Modules

No modules.

Resources

Name Type
aws_cloudwatch_event_api_destination.this resource
aws_cloudwatch_event_archive.this resource
aws_cloudwatch_event_bus.this resource
aws_cloudwatch_event_connection.this resource
aws_cloudwatch_event_permission.this resource
aws_cloudwatch_event_rule.this resource
aws_cloudwatch_event_target.this resource
aws_iam_policy.additional_inline resource
aws_iam_policy.additional_json resource
aws_iam_policy.additional_jsons resource
aws_iam_policy.api_destination resource
aws_iam_policy.cloudwatch resource
aws_iam_policy.ecs resource
aws_iam_policy.kinesis resource
aws_iam_policy.kinesis_firehose resource
aws_iam_policy.lambda resource
aws_iam_policy.service resource
aws_iam_policy.sfn resource
aws_iam_policy.sns resource
aws_iam_policy.sqs resource
aws_iam_policy.tracing resource
aws_iam_policy_attachment.additional_inline resource
aws_iam_policy_attachment.additional_json resource
aws_iam_policy_attachment.additional_jsons resource
aws_iam_policy_attachment.api_destination resource
aws_iam_policy_attachment.cloudwatch resource
aws_iam_policy_attachment.ecs resource
aws_iam_policy_attachment.kinesis resource
aws_iam_policy_attachment.kinesis_firehose resource
aws_iam_policy_attachment.lambda resource
aws_iam_policy_attachment.service resource
aws_iam_policy_attachment.sfn resource
aws_iam_policy_attachment.sns resource
aws_iam_policy_attachment.sqs resource
aws_iam_policy_attachment.tracing resource
aws_iam_role.eventbridge resource
aws_iam_role.eventbridge_pipe resource
aws_iam_role_policy_attachment.additional_many resource
aws_iam_role_policy_attachment.additional_one resource
aws_pipes_pipe.this resource
aws_scheduler_schedule.this resource
aws_scheduler_schedule_group.this resource
aws_schemas_discoverer.this resource
aws_caller_identity.current data source
aws_cloudwatch_event_bus.this data source
aws_iam_policy.tracing data source
aws_iam_policy_document.additional_inline data source
aws_iam_policy_document.api_destination data source
aws_iam_policy_document.assume_role data source
aws_iam_policy_document.assume_role_pipe data source
aws_iam_policy_document.cloudwatch data source
aws_iam_policy_document.ecs data source
aws_iam_policy_document.kinesis data source
aws_iam_policy_document.kinesis_firehose data source
aws_iam_policy_document.lambda data source
aws_iam_policy_document.service data source
aws_iam_policy_document.sfn data source
aws_iam_policy_document.sns data source
aws_iam_policy_document.sqs data source
aws_partition.current data source
aws_region.current data source

Inputs

Name Description Type Default Required
api_destinations A map of objects with EventBridge Destination definitions. map(any) {} no
append_connection_postfix Controls whether to append '-connection' to the name of the connection bool true no
append_destination_postfix Controls whether to append '-destination' to the name of the destination bool true no
append_pipe_postfix Controls whether to append '-pipe' to the name of the pipe bool true no
append_rule_postfix Controls whether to append '-rule' to the name of the rule bool true no
append_schedule_group_postfix Controls whether to append '-group' to the name of the schedule group bool true no
append_schedule_postfix Controls whether to append '-schedule' to the name of the schedule bool true no
archives A map of objects with the EventBridge Archive definitions. map(any) {} no
attach_api_destination_policy Controls whether the API Destination policy should be added to IAM role for EventBridge Target bool false no
attach_cloudwatch_policy Controls whether the Cloudwatch policy should be added to IAM role for EventBridge Target bool false no
attach_ecs_policy Controls whether the ECS policy should be added to IAM role for EventBridge Target bool false no
attach_kinesis_firehose_policy Controls whether the Kinesis Firehose policy should be added to IAM role for EventBridge Target bool false no
attach_kinesis_policy Controls whether the Kinesis policy should be added to IAM role for EventBridge Target bool false no
attach_lambda_policy Controls whether the Lambda Function policy should be added to IAM role for EventBridge Target bool false no
attach_policies Controls whether list of policies should be added to IAM role bool false no
attach_policy Controls whether policy should be added to IAM role bool false no
attach_policy_json Controls whether policy_json should be added to IAM role bool false no
attach_policy_jsons Controls whether policy_jsons should be added to IAM role bool false no
attach_policy_statements Controls whether policy_statements should be added to IAM role bool false no
attach_sfn_policy Controls whether the StepFunction policy should be added to IAM role for EventBridge Target bool false no
attach_sns_policy Controls whether the SNS policy should be added to IAM role for EventBridge Target bool false no
attach_sqs_policy Controls whether the SQS policy should be added to IAM role for EventBridge Target bool false no
attach_tracing_policy Controls whether X-Ray tracing policy should be added to IAM role for EventBridge bool false no
bus_name A unique name for your EventBridge Bus string "default" no
cloudwatch_target_arns The Amazon Resource Name (ARN) of the Cloudwatch Log Streams you want to use as EventBridge targets list(string) [] no
connections A map of objects with EventBridge Connection definitions. any {} no
create Controls whether resources should be created bool true no
create_api_destinations Controls whether EventBridge Destination resources should be created bool false no
create_archives Controls whether EventBridge Archive resources should be created bool false no
create_bus Controls whether EventBridge Bus resource should be created bool true no
create_connections Controls whether EventBridge Connection resources should be created bool false no
create_permissions Controls whether EventBridge Permission resources should be created bool true no
create_pipes Controls whether EventBridge Pipes resources should be created bool true no
create_role Controls whether IAM roles should be created bool true no
create_rules Controls whether EventBridge Rule resources should be created bool true no
create_schedule_groups Controls whether EventBridge Schedule Group resources should be created bool true no
create_schedules Controls whether EventBridge Schedule resources should be created bool true no
create_schemas_discoverer Controls whether default schemas discoverer should be created bool false no
create_targets Controls whether EventBridge Target resources should be created bool true no
ecs_pass_role_resources List of approved roles to be passed list(string) [] no
ecs_target_arns The Amazon Resource Name (ARN) of the AWS ECS Tasks you want to use as EventBridge targets list(string) [] no
event_source_name The partner event source that the new event bus will be matched with. Must match name. string null no
kinesis_firehose_target_arns The Amazon Resource Name (ARN) of the Kinesis Firehose Delivery Streams you want to use as EventBridge targets list(string) [] no
kinesis_target_arns The Amazon Resource Name (ARN) of the Kinesis Streams you want to use as EventBridge targets list(string) [] no
kms_key_identifier The identifier of the AWS KMS customer managed key for EventBridge to use, if you choose to use a customer managed key to encrypt events on this event bus. The identifier can be the key Amazon Resource Name (ARN), KeyId, key alias, or key alias ARN. string null no
lambda_target_arns The Amazon Resource Name (ARN) of the Lambda Functions you want to use as EventBridge targets list(string) [] no
number_of_policies Number of policies to attach to IAM role number 0 no
number_of_policy_jsons Number of policies JSON to attach to IAM role number 0 no
permissions A map of objects with EventBridge Permission definitions. map(any) {} no
pipes A map of objects with EventBridge Pipe definitions. any {} no
policies List of policy statements ARN to attach to IAM role list(string) [] no
policy An additional policy document ARN to attach to IAM role string null no
policy_json An additional policy document as JSON to attach to IAM role string null no
policy_jsons List of additional policy documents as JSON to attach to IAM role list(string) [] no
policy_path Path of IAM policy to use for EventBridge string null no
policy_statements Map of dynamic policy statements to attach to IAM role any {} no
role_description Description of IAM role to use for EventBridge string null no
role_force_detach_policies Specifies to force detaching any policies the IAM role has before destroying it. bool true no
role_name Name of IAM role to use for EventBridge string null no
role_path Path of IAM role to use for EventBridge string null no
role_permissions_boundary The ARN of the policy that is used to set the permissions boundary for the IAM role used by EventBridge string null no
role_tags A map of tags to assign to IAM role map(string) {} no
rules A map of objects with EventBridge Rule definitions. map(any) {} no
schedule_group_timeouts A map of objects with EventBridge Schedule Group create and delete timeouts. map(string) {} no
schedule_groups A map of objects with EventBridge Schedule Group definitions. any {} no
schedules A map of objects with EventBridge Schedule definitions. map(any) {} no
schemas_discoverer_description Default schemas discoverer description string "Auto schemas discoverer event" no
sfn_target_arns The Amazon Resource Name (ARN) of the StepFunctions you want to use as EventBridge targets list(string) [] no
sns_kms_arns The Amazon Resource Name (ARN) of the AWS KMS's configured for AWS SNS you want Decrypt/GenerateDataKey for list(string) 
[
  "*"
]
 no
sns_target_arns The Amazon Resource Name (ARN) of the AWS SNS's you want to use as EventBridge targets list(string) [] no
sqs_target_arns The Amazon Resource Name (ARN) of the AWS SQS Queues you want to use as EventBridge targets list(string) [] no
tags A map of tags to assign to resources. map(string) {} no
targets A map of objects with EventBridge Target definitions. any {} no
trusted_entities Additional trusted entities for assuming roles (trust relationship) list(string) [] no

Outputs

Name Description
eventbridge_api_destination_arns The EventBridge API Destination ARNs
eventbridge_api_destinations The EventBridge API Destinations created and their attributes
eventbridge_archive_arns The EventBridge Archive ARNs
eventbridge_archives The EventBridge Archives created and their attributes
eventbridge_bus The EventBridge Bus created and their attributes
eventbridge_bus_arn The EventBridge Bus ARN
eventbridge_bus_name The EventBridge Bus Name
eventbridge_connection_arns The EventBridge Connection Arns
eventbridge_connection_ids The EventBridge Connection IDs
eventbridge_connections The EventBridge Connections created and their attributes
eventbridge_iam_roles The EventBridge IAM roles created and their attributes
eventbridge_permission_ids The EventBridge Permission IDs
eventbridge_permissions The EventBridge Permissions created and their attributes
eventbridge_pipe_arns The EventBridge Pipes ARNs
eventbridge_pipe_ids The EventBridge Pipes IDs
eventbridge_pipe_role_arns The ARNs of the IAM role created for EventBridge Pipes
eventbridge_pipe_role_names The names of the IAM role created for EventBridge Pipes
eventbridge_pipes The EventBridge Pipes created and their attributes
eventbridge_pipes_iam_roles The EventBridge Pipes IAM roles created and their attributes
eventbridge_role_arn The ARN of the IAM role created for EventBridge
eventbridge_role_name The name of the IAM role created for EventBridge
eventbridge_rule_arns The EventBridge Rule ARNs
eventbridge_rule_ids The EventBridge Rule IDs
eventbridge_rules The EventBridge Rules created and their attributes
eventbridge_schedule_arns The EventBridge Schedule ARNs created
eventbridge_schedule_group_arns The EventBridge Schedule Group ARNs
eventbridge_schedule_group_ids The EventBridge Schedule Group IDs
eventbridge_schedule_group_states The EventBridge Schedule Group states
eventbridge_schedule_groups The EventBridge Schedule Groups created and their attributes
eventbridge_schedule_ids The EventBridge Schedule IDs created
eventbridge_schedules The EventBridge Schedules created and their attributes
eventbridge_targets The EventBridge Targets created and their attributes

Authors

Module managed by Sven Lito. Check out serverless.tf to learn more about doing serverless with Terraform.

License

Apache 2 Licensed. See LICENSE for full details.

About

Terraform module to create AWS EventBridge resources 🇺🇦

registry.terraform.io/modules/terraform-aws-modules/eventbridge/aws

Resources

Readme

License

View license
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

55 tags

Packages

No packages published

Languages

  • HCL 100.0%