Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(terraform): vol5223 add iam policy statement to allow eventbridge #221

Merged
merged 8 commits into from
Aug 7, 2024
Merged

fix(terraform): vol5223 add iam policy statement to allow eventbridge #221

merged 8 commits into from
Aug 7, 2024

Conversation

matbeales
Copy link
Contributor

… to kick off batch jobs

Related issue: https://dvsa.atlassian.net/browse/VOL-5223

Before submitting (or marking as "ready for review")

  • Does the pull request title follow the conventional commit specification?
  • Have you performed a self-review of the code
  • Have you have added tests that prove the fix or feature is effective and working
  • Did you make sure to update any documentation relating to this change?

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 7, 2024 •
edited
Loading

Terraform plan for environment: dev

Commit: accbcc3

API version: 418eb0c
CLI version: 418eb0c
Selfserve version: 418eb0c
Internal version: 418eb0c

Plan summary

2 to add, 35 to change, 1 to destroy

🆕 Creates

module.service.module.eventbridge.aws_iam_policy.additional_inline[0]
module.service.module.eventbridge.aws_iam_policy_attachment.additional_inline[0]

🗑️ Deletes

module.service.module.eventbridge.aws_iam_role.eventbridge[0]

🔄 Updates

module.service.aws_s3_bucket_policy.bucket_policy
module.service.module.eventbridge.aws_scheduler_schedule.this["clean-up-variations"]
module.service.module.eventbridge.aws_scheduler_schedule.this["close-expired-windows"]
module.service.module.eventbridge.aws_scheduler_schedule.this["cns"]
module.service.module.eventbridge.aws_scheduler_schedule.this["company-profile-dlq"]
module.service.module.eventbridge.aws_scheduler_schedule.this["create-psv-licence-surrender-task"]
module.service.module.eventbridge.aws_scheduler_schedule.this["digital-continuation-reminders"]
module.service.module.eventbridge.aws_scheduler_schedule.this["duplicate-vehicle-warning"]
module.service.module.eventbridge.aws_scheduler_schedule.this["enqueue-ch-compare"]
module.service.module.eventbridge.aws_scheduler_schedule.this["expire-bus-registration"]
module.service.module.eventbridge.aws_scheduler_schedule.this["flag-urgent-tasks"]
module.service.module.eventbridge.aws_scheduler_schedule.this["inspection-request-email"]
module.service.module.eventbridge.aws_scheduler_schedule.this["interim-end-date-enforcement"]
module.service.module.eventbridge.aws_scheduler_schedule.this["international-goods-export"]
module.service.module.eventbridge.aws_scheduler_schedule.this["last-tm-letter"]
module.service.module.eventbridge.aws_scheduler_schedule.this["licence-status-rules"]
module.service.module.eventbridge.aws_scheduler_schedule.this["mark-expired-permits"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-company-profile"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-inbox"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-insolvency"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-insolvency-dlq"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-ntu"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-community-licences"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-disc-generation"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-disc-print"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-ecmt-accept"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-general"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-irhp-allocate"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-permit-generation"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-permit-print"]
module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-print"]
module.service.module.eventbridge.aws_scheduler_schedule.this["psv-operator-list-export"]
module.service.module.eventbridge.aws_scheduler_schedule.this["remove-read-audit"]
module.service.module.eventbridge.aws_scheduler_schedule.this["resolve-payments"]
module.service.module.eventbridge.aws_scheduler_schedule.this["transxchange-consumer"]
Show full plan 
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.service.aws_s3_bucket_policy.bucket_policy will be updated in-place
  ~ resource "aws_s3_bucket_policy" "bucket_policy" {
        id     = "vol-app-assets"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringEquals = {
                              ~ "aws:SourceArn" = "arn:aws:cloudfront::054614622558:distribution/E1GZYPKGUFNMP4" -> "arn:aws:cloudfront::054614622558:distribution/E3R9S2AKJG4ZTR"
                            }
                        }
                        # (4 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # module.service.module.eventbridge.aws_iam_policy.additional_inline[0] will be created
  + resource "aws_iam_policy" "additional_inline" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = "vol-app-dev-batch-scheduler-inline"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "batch:SubmitJob"
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-transxchange-consumer:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-system-parameter:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-resolve-payments:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-remove-read-audit:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-psv-operator-list-export:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-print:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-permit-print:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-permit-generation:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-irhp-allocate:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-general:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-ecmt-accept:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-disc-print:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-disc-generation:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-queue-community-licences:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-ntu:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-insolvency:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-insolvency-dlq:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-inbox:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-company-profile:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-process-cl:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-mark-expired-permits:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-licence-status-rules:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-last-tm-letter:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-international-goods-export:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-interim-end-date-enforcement:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-inspection-request-email:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-import-users-from-csv:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-flag-urgent-tasks:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-expire-bus-registration:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-enqueue-ch-compare:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-duplicate-vehicle-warning:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-digital-continuation-reminders:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-database-maintenance:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-data-retention-precheck:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-data-retention-postcheck:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-data-retention-populate:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-data-retention-delete:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-create-psv-licence-surrender-task:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-company-profile-dlq:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-cns:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-close-expired-windows:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-clean-up-variations:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-ch-vs-olcs-diffs:3",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-dev-cancel-unsubmitted-bilateral:3",
                        ]
                      + Sid      = "batch"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags             = {
          + "Name" = "vol-app-dev-batch-scheduler-inline"
        }
      + tags_all         = {
          + "Environment" = "dev"
          + "Name"        = "vol-app-dev-batch-scheduler-inline"
          + "Repository"  = "https://github.com/dvsa/vol-app"
        }
    }

  # module.service.module.eventbridge.aws_iam_policy_attachment.additional_inline[0] will be created
  + resource "aws_iam_policy_attachment" "additional_inline" {
      + id         = (known after apply)
      + name       = "vol-app-dev-batch-scheduler"
      + policy_arn = (known after apply)
      + roles      = [
          + "vol-app-dev-batch-scheduler",
        ]
    }

  # module.service.module.eventbridge.aws_iam_role.eventbridge[0] must be replaced
-/+ resource "aws_iam_role" "eventbridge" {
      ~ arn                   = "arn:aws:iam::054614622558:role/default" -> (known after apply)
      ~ create_date           = "2024-08-06T10:59:18Z" -> (known after apply)
      ~ id                    = "default" -> (known after apply)
      ~ managed_policy_arns   = [] -> (known after apply)
      ~ name                  = "default" -> "vol-app-dev-batch-scheduler" # forces replacement
      + name_prefix           = (known after apply)
      ~ tags                  = {
          ~ "Name" = "default" -> "vol-app-dev-batch-scheduler"
        }
      ~ tags_all              = {
          ~ "Name"        = "default" -> "vol-app-dev-batch-scheduler"
            # (2 unchanged elements hidden)
        }
      ~ unique_id             = "AROAQZN2JAFPHPMRSDAJI" -> (known after apply)
        # (6 unchanged attributes hidden)

      ~ inline_policy {
          + arn                   = (known after apply)
          + assume_role_policy    = (known after apply)
          + create_date           = (known after apply)
          + description           = (known after apply)
          + force_detach_policies = (known after apply)
          + id                    = (known after apply)
          + managed_policy_arns   = (known after apply)
          + max_session_duration  = (known after apply)
          + name                  = (known after apply)
          + name_prefix           = (known after apply)
          + path                  = (known after apply)
          + permissions_boundary  = (known after apply)
          + tags                  = (known after apply)
          + tags_all              = (known after apply)
          + unique_id             = (known after apply)
        } -> (known after apply)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["clean-up-variations"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/clean-up-variations-schedule"
        name                         = "clean-up-variations-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["close-expired-windows"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/close-expired-windows-schedule"
        name                         = "close-expired-windows-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["cns"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/cns-schedule"
        name                         = "cns-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["company-profile-dlq"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/company-profile-dlq-schedule"
        name                         = "company-profile-dlq-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["create-psv-licence-surrender-task"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/create-psv-licence-surrender-task-schedule"
        name                         = "create-psv-licence-surrender-task-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["digital-continuation-reminders"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/digital-continuation-reminders-schedule"
        name                         = "digital-continuation-reminders-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["duplicate-vehicle-warning"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/duplicate-vehicle-warning-schedule"
        name                         = "duplicate-vehicle-warning-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["enqueue-ch-compare"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/enqueue-ch-compare-schedule"
        name                         = "enqueue-ch-compare-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["expire-bus-registration"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/expire-bus-registration-schedule"
        name                         = "expire-bus-registration-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["flag-urgent-tasks"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/flag-urgent-tasks-schedule"
        name                         = "flag-urgent-tasks-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["inspection-request-email"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/inspection-request-email-schedule"
        name                         = "inspection-request-email-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["interim-end-date-enforcement"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/interim-end-date-enforcement-schedule"
        name                         = "interim-end-date-enforcement-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["international-goods-export"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/international-goods-export-schedule"
        name                         = "international-goods-export-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["last-tm-letter"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/last-tm-letter-schedule"
        name                         = "last-tm-letter-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["licence-status-rules"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/licence-status-rules-schedule"
        name                         = "licence-status-rules-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["mark-expired-permits"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/mark-expired-permits-schedule"
        name                         = "mark-expired-permits-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-company-profile"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-company-profile-schedule"
        name                         = "process-company-profile-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-inbox"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-inbox-schedule"
        name                         = "process-inbox-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-insolvency"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-insolvency-schedule"
        name                         = "process-insolvency-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-insolvency-dlq"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-insolvency-dlq-schedule"
        name                         = "process-insolvency-dlq-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-ntu"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-ntu-schedule"
        name                         = "process-ntu-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-community-licences"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-community-licences-schedule"
        name                         = "process-queue-community-licences-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-disc-generation"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-disc-generation-schedule"
        name                         = "process-queue-disc-generation-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-disc-print"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-disc-print-schedule"
        name                         = "process-queue-disc-print-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-ecmt-accept"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-ecmt-accept-schedule"
        name                         = "process-queue-ecmt-accept-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-general"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-general-schedule"
        name                         = "process-queue-general-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-irhp-allocate"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-irhp-allocate-schedule"
        name                         = "process-queue-irhp-allocate-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-permit-generation"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-permit-generation-schedule"
        name                         = "process-queue-permit-generation-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-permit-print"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-permit-print-schedule"
        name                         = "process-queue-permit-print-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["process-queue-print"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/process-queue-print-schedule"
        name                         = "process-queue-print-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["psv-operator-list-export"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/psv-operator-list-export-schedule"
        name                         = "psv-operator-list-export-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["remove-read-audit"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/remove-read-audit-schedule"
        name                         = "remove-read-audit-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["resolve-payments"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/resolve-payments-schedule"
        name                         = "resolve-payments-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.service.module.eventbridge.aws_scheduler_schedule.this["transxchange-consumer"] will be updated in-place
  ~ resource "aws_scheduler_schedule" "this" {
        id                           = "default/transxchange-consumer-schedule"
        name                         = "transxchange-consumer-schedule"
        # (10 unchanged attributes hidden)

      ~ target {
          ~ role_arn = "arn:aws:iam::054614622558:role/default" -> (known after apply)
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 3 to add, 35 to change, 1 to destroy.

cmarstondvsa
cmarstondvsa previously approved these changes Aug 7, 2024
View reviewed changes
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 7, 2024

Terraform plan for environment: int

Commit: accbcc3

API version: 418eb0c
CLI version: 418eb0c
Selfserve version: 418eb0c
Internal version: 418eb0c

Plan summary

3 to add, 0 to change, 0 to destroy

🆕 Creates

module.service.module.eventbridge.aws_iam_policy.additional_inline[0]
module.service.module.eventbridge.aws_iam_policy_attachment.additional_inline[0]
module.service.module.eventbridge.aws_iam_role.eventbridge[0]
Show full plan 
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.service.module.eventbridge.aws_iam_policy.additional_inline[0] will be created
  + resource "aws_iam_policy" "additional_inline" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = "vol-app-int-batch-scheduler-inline"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "batch:SubmitJob"
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-transxchange-consumer:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-system-parameter:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-resolve-payments:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-remove-read-audit:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-psv-operator-list-export:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-print:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-permit-print:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-permit-generation:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-irhp-allocate:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-general:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-ecmt-accept:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-disc-print:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-disc-generation:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-queue-community-licences:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-ntu:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-insolvency:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-insolvency-dlq:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-inbox:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-company-profile:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-process-cl:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-mark-expired-permits:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-licence-status-rules:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-last-tm-letter:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-international-goods-export:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-interim-end-date-enforcement:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-inspection-request-email:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-import-users-from-csv:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-flag-urgent-tasks:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-expire-bus-registration:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-enqueue-ch-compare:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-duplicate-vehicle-warning:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-digital-continuation-reminders:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-database-maintenance:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-data-retention-precheck:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-data-retention-postcheck:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-data-retention-populate:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-data-retention-delete:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-create-psv-licence-surrender-task:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-company-profile-dlq:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-cns:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-close-expired-windows:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-clean-up-variations:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-ch-vs-olcs-diffs:1",
                          + "arn:aws:batch:eu-west-1:054614622558:job-definition/vol-app-int-cancel-unsubmitted-bilateral:1",
                        ]
                      + Sid      = "batch"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags             = {
          + "Name" = "vol-app-int-batch-scheduler-inline"
        }
      + tags_all         = {
          + "Environment" = "int"
          + "Name"        = "vol-app-int-batch-scheduler-inline"
          + "Repository"  = "https://github.com/dvsa/vol-app"
        }
    }

  # module.service.module.eventbridge.aws_iam_policy_attachment.additional_inline[0] will be created
  + resource "aws_iam_policy_attachment" "additional_inline" {
      + id         = (known after apply)
      + name       = "vol-app-int-batch-scheduler"
      + policy_arn = (known after apply)
      + roles      = [
          + "vol-app-int-batch-scheduler",
        ]
    }

  # module.service.module.eventbridge.aws_iam_role.eventbridge[0] will be created
  + resource "aws_iam_role" "eventbridge" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "events.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "vol-app-int-batch-scheduler"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "Name" = "vol-app-int-batch-scheduler"
        }
      + tags_all              = {
          + "Environment" = "int"
          + "Name"        = "vol-app-int-batch-scheduler"
          + "Repository"  = "https://github.com/dvsa/vol-app"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

Plan: 3 to add, 0 to change, 0 to destroy.

@matbeales matbeales merged commit e29d53a into main Aug 7, 2024
2 checks passed
@matbeales matbeales deleted the VOL-5223-scheduler-iam branch August 7, 2024 14:03
@github-actions github-actions bot mentioned this pull request Aug 7, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@JoshuaLicense JoshuaLicense JoshuaLicense approved these changes

@cmarstondvsa cmarstondvsa cmarstondvsa approved these changes

@barkerl barkerl barkerl approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@matbeales @JoshuaLicense @cmarstondvsa @barkerl