BFD-4643: Encode IDR Queue and trust new Roles (#3065)

Author: malessi

ops/services/01-config/values/prod.sopsw.yaml

@@ -37,6 +37,14 @@
 /bfd/${env}/idr-pipeline/sensitive/idr_warehouse: ENC[AES256_GCM,data:Tc9eFpY0/bFvtoYq5QRcVA==,iv:N6vX8xfP/Ek3ir2x+bymiLvQ96PutJnv/Rn8aYlI+io=,tag:3u1Ic6iwwcAsavfFt/qwrg==,type:str]
 /bfd/${env}/idr-pipeline/sensitive/idr_schema: ENC[AES256_GCM,data:f3/iwiAAhKV8FJ6xrx+CnAlDIrT5,iv:6GpQvT8Ws05Rrvq6ON6Qzcr+dTIbZNLxRTFFE/EHIps=,tag:rrhG+2C/qryS5q4Fjo+tAg==,type:str]
 /bfd/${env}/idr-pipeline/sensitive/idr_private_key: ENC[AES256_GCM,data:EHE2/UTtMoxrIYZHSaQO3+QRpkxc0crMRtxeOjjk4BD6m/ddWVmlOih1stnSmoHaOoSuZWVa196Y8sKyStqmsx/UjLM/JpdIQM68yxnp/iXiWF4+Q8V3FSajqov7yq/2uC5i+mD1UH6BZ9ywBM5hAko9L7lbQcIvSkvzG0S/ZWDOna0Y0BFb3d+il/3l45KxtWq6V8XbcGBFIHNSd/wbz5vbPxGZZG/8L84MwdQG8vzE7VZHyE4sxHCmYCVvdGg2T/K4OlU94u7cDoLuHueavVjocingNIeyrmUnyRLyBpeDo2r2qFgQ3ZaKBzV7T53Fsfh4UTP7btNS+EtczHQRiyjaTa2+G8qythmplpb8eKX4z5cfGJOl+KzK1eFcXJMQoYJpxUJKq5Oiy6kBYbH9bdr6pQtICvQbtJzFUq9wi3BGPYyOkk+k8UIyo12cZDyP73e1LNgDMsxhBE99i06CjJldgAx6FYcgu8fHZR8PsqqWwj+BLwhwKCxa1r6vsPXWO3mwsWt5dvUoxhTQbKCLLb9vMMjeiHKUvSiVVo5Ki4Lc0h3yuVIINTcdi5MfLOlj9W+mwI85Le+eEhdGjJqXeMlG1jzFyJAhHObnXUC4doiwfu5BUztVqGgv5Mh8kGSOlLXVevttgdP/Mjsvq9eqNwXi5OE7D8BX//JE51vHVpd+7J9FdGABw/BdMbgbpIv72UXLOAeyc6DHvhEpkgObrTHmGfNS8SBpZE/pkKDM2FuDXQXaOZpWxcBFC0Db4gzbKNrU1okFjrXuXJGYbu6X73CieFnZRYD9/Ilgq+sFy6NXu2m2lsrRfI3mlT7LltK1f2qzPvSWXlAmR22OQYzaSwYXxInHXh/q2dpx8FZHK/9ngThDnqlrYX5YW2zMsBsoFbwBM4E4ELPvCprnaVPvoyfp2HDts95lS8OuX4z+MG+eWFrvlqeXMRekl+522O0imt+OUeiRKWSxcgV0jKPDK5UoBGjlh6FxWhSlzt1+Z6c1wUoewEvN8ydHhBgpbccK+slyNp3dSgjDUqV/6Gw0LxHCVvaLknNyhNKVXYc6b766F0jtFxP3G2zrnq91o3obAujikpAawU5qCHYCXq5bwtoscoVMGqHcrg1mhe0MUpLX2hwqgWu0sV7gF7mCwBGv111R/MrMraLDtyOsrIa2+SeCCfOB/XeMKsE5270NQoriC2D1kOQTD+evRYBZCBTeFIKz/VemSYVbJvu5QS+m50LCIklpzl/K9LDvkqG5oANztG6gJ9lN/aEhLaWOVLi2aRNcwUatTeKkzhm4iQmVtTRcmjKFj6tkxfbep9fe01/6P3GIQtVdTcSWlsAaYdHbYFv95QkCQqK4dM3wVv1L2VAgwKz8yYcm8JCRP8TGe9VJNLUh0/yDOfzkN7kQO0D+EfnwKkA7ctRU+erGlaBq9wA2xxLAhvkdbI4ARgZqYbFmG7e/JxZvLq1J+iSDPF/TeaqSx/LFy1IU12wFo8zdnzQ9ePwaWCbOoRklLfFnjSLbI597GyOmPckY4tj23CeDD3YeOHoBh5dbMElDC1VxPR33pGbIFVwSYqzLedyJOjstWkzKSJECdIRa7phfk1o04wfFtj/UyqGzYvfNGwdD5PltKpeKzuFHLp7yf8oVwFIof+1K7AysNK9mqN+v/n13y5VZWDmhd9KZ6R4z8UXrcVmhVVZmuVjPqH0fsegS6MX7qfn025DChLFXP9YbyqmtSC4kuXq2YPu6Xy0z5LXcunoLLJ0Z6A9kYAgk/VFym036MfFU03ErNW2UsLiYXOHwcQwKebst67uGr7RF4azmDoFRqDBGtzmG2bglTx1FFS1B/gXXY1R+hbFb5Z2Ew9RH7mBzNj/P+qVDfrNS2nOihj7PT5/7WWMc/dYskdb+1deD+eD0sXbjXEWVrKp14bBzccTnvgLXd8fuPaGxGnNVsl2Kg49YPziGt/xBGEhQhgj9NS9ljzhzOmi9vqKmLS3LmbdFPw7+NXOAAKuH6ugyw77/XKlwtPDHYZ8JW+GjMjht7Ea1D0iRuRC8kJbywKcmlU7E32pRewtmnUV86sWz8c7KlrbE+AII1llAdPGVvZoS7MYj5Hfrv2cvWryJYESyPt0vBEOW4GpQKJWsY2wgSjmGbKfJ2WMsN2+I2RXa3HK+0sQmi4YUg35LMmCDBW1IyqGDFZGe3OXF9L7oO/CO2xN1Ol3BzAmU7Diib40rUuIecRHGudDrRveAn/D/C+BFHb0XkvXJ64nQWHy23ZXGMMn5HRPz6aM=,iv:bzDTkn40uAVkDjmo7ZpTYWBI6oKnOiiFH/fz30IGJcQ=,tag:nWtcMVlmvN8eNoEFDXebhw==,type:str]
+#ENC[AES256_GCM,data:pCpJ6Jk2r+OPKxDjZqdUV/JBHqOnPH7vrdjG3Wd30E2F0+BrUd/c59V3lr+Linth47SPHCf2rtq5Pq4AFXVf4a3guKnJeyUBWa68KEJ4SaGkaEbf7SMfPAgD,iv:EuhRs+vk854QGFCIE9IZrWJ2r+G6dPzZSFCxD8WZio0=,tag:R+2KelQqkkyc4XtMOm8CVA==,type:comment]
+#ENC[AES256_GCM,data:rTj1oATAQN9IdgLM4bjojK/tsABwGk+S4o93v073BVEFttAGn6m1YJgwJFtwjDyrMMiOdo1WF8h4wxAL5MZ2VwGDVqLt0UFhOLgkO9wBtwH1AopJKoGwBh0BT1A=,iv:46pYoHfoEFwr59bGhrO6m3NStA2dXTZ50WGj47ixrDM=,tag:fhFqZGgvYjMJFl5shjVrfw==,type:comment]
+#ENC[AES256_GCM,data:z9HsAv+tJMSuM2Luoh3Q3jp8sduHKzyc29QxraWETso+cMLgrwwzF4lBHy3GIjE=,iv:yxC+SJqAWwRgrKNPbzNJq61vpbNNIOM+qTFVRt62Kyo=,tag:37BAnhpXsh/7puYe/1uiRw==,type:comment]
+#ENC[AES256_GCM,data:yNP7CnQXf6gNlvjqlDsFRGAwJuafTLunohJ6FdFECLpOqhZr/zr9ZUZ+l27G1t0eKM93DYa57yGns8ZlwUsIvxRFTrcl62jAodSdp2UzaIckN6EZTBiIy+SFE4ODNAsb,iv:+1l1nvr+8YEz1moHUywr1wHPlr8t5bhdEAHYpX+wiw0=,tag:Qyh2eJ8l6YAc2dXwtMrDoQ==,type:comment]
+#ENC[AES256_GCM,data:Jfc409d1xuWgeQOzB8CTNsbxzc3Euyx6IEXPWM0WbqfiPntFszrZSYnmyCNJTaCZEcsqFJn2utH0S5RceSgie+amR2MqazlrdeKa8n3DoWTucfT4cTjjY55ZAqTaqmUN,iv:1Nc+cavlzl8WDOIvmm7PVtlRbNyfIN9Iy79+LkscJTk=,tag:MfSTT7oIZFuQBrbJzaC4vA==,type:comment]
+#ENC[AES256_GCM,data:Rev3SAMLh2S8Ry/WYMAqXktBjEcdJiD6f75tGIV6s9aW6Nt5TW+cnsy5qJ4TAafZvbBNkkV1USVM4vfAhRMcAae0jCutp8TH5KCKkzPdM2+McFyzzhYKT88/wtE7+9U=,iv:nGGwQ7TF59x3VoDzHXt7v6HksjgV9y3lT7d3EOEH+KA=,tag:6z/SAecq1mWNehgqsUYKnQ==,type:comment]
+#ENC[AES256_GCM,data:DAQFMnUgbUm1+y1QuKLXSV+eI+kgV+L+n+KlCPjT8d2qL+umDOulsNe3YA5Ql14lpe44FllfxMrOEVcNMGnG7FjK4+88eSvi54hGZ7Bns7vWKT+gux83xGTrYMzpJ5idLYs=,iv:/a+V3Bv7+31fg6Szgi6qW9ea7Zl6drqpb+wodTaIqQc=,tag:7TxkgNxy+bo4Ksd738m72w==,type:comment]
+/bfd/${env}/idr-pipeline/sensitive/queue/authorized_roles_json: ENC[AES256_GCM,data:o5SA8pnhyRSa7JlZtLGHlBFPOu4msQ92q31escmAOtcH9LkVYNHDUz8ys68ETT826YiixX2x+x2YJlMkTfGTy1wmOm+qP60zu3j6MQANGOQzeUbeeE6ZUi+1pZxHRTFlrZe7MEoO830uVk9ZhhLccNV66gj5M+fpmP93fAEu+GXb6HeANa+9UYyGSiT2/JwyHnNiafg/Pv/kpHQw67n1/Og7jOjT1FYv5TuafdJ8oDO61A04AzwK6x6NQB5aC0e9Pv0QQkuqKMSH9QK52vkFTdI0KgErkIJ+DVCfYOX1nhcaCsQ5gqUdYV/VVIyaDo1vhWUDIQAeogaGx5McxQxaWHeP9u3I1tmbwgnN+KXJnp45FuPXmLRUap401ZZJye6G4CUYU1FLPdEUVVTNeXZ7xU7WHZpSVYzwMMLYNR6DAUw72NmfUNH2WsxoEI+qEQ==,iv:+5PCJnxmUy/zd3NTkOfM83mxvOFb6PK4G+F/gg75eR8=,tag:C2z/AST+rDG3Htwlx8Gu1Q==,type:str]
 /bfd/${env}/locust/sensitive/db/username: ENC[AES256_GCM,data:sVBEfHaf0fKJQ0uZ0YB5Jg==,iv:B7BSyFiEfcjwuHVtexxJkMXOD+LKC47lcWFljN99QRg=,tag:gUn0m38afE3OqGHFdZO0Fg==,type:str]
 /bfd/${env}/locust/sensitive/db/password: ENC[AES256_GCM,data:LinHkvQ8yLpMjszLNe7NttT9P70B2A1P,iv:Vd3KTMptphUEHnaBpq3T5oEvb3F4iAQ8d0jGQVsY8nk=,tag:e53OrbnYq1yAW3slSW7YIA==,type:str]
 /bfd/${env}/locust/sensitive/cert/pem_data: ENC[AES256_GCM,data:y78i9JMEOjw3PRSSqjiZ4ynY+wfd+4lGTI9nwqI1RK+f3n1Ww1W2OhVHupAFtHHWd2xN37BWFsm8JZnRDWCiA1iSJnqcv0jLKq77BYE8Xdngy3VINMfvhz9f6Awjj27UE9z9ntYjNk+/J3uYgGn6L510xHOdCkdPoWoHF67UMWjE9sh7uDXvtZK55el1YcfBeXbG1jw93TG1+0zkmJGBbwu8EiQwEHuE/De2v0hW7PdhVZPvi0XPzKJ4vTbG37m2UZooRIl0YGSycplOiTCytd/b89LJsy6II75TvKbzmPQ3Bfw3zlKaGxaI8Bes5CiCAk3I/uTpUllrP7z3byxNEcRXakr5S9qPAe1MSvfbGVyHnZ+qUYQ+TYnIzDzKd9yL7TUvgyl/xAxualVU5EW7FmOz6loRWRsuFGySHW6mLdaF/ouIY3/adBu685uryPMaGxjeF0dk+sl4rq5Eb1ypjIvSPFWlq6cB/y/zGUdL492EhZUaEGVse64ACTVliwJAYD+OYzoG+c6vP50bZ+SmAgMiFHmakti+M6iqyZgb6k3bHYm5aWaHWMumVJwyC/EHc8QfIA0hqI/iypsvd1RuZTAYUjCbzMUehcoUTtR+bQ+aRJ/zOTbHJRbWzKop0y0edQzcZr14SgnwP1Vg9XOi4T5kWZBL6hWlsD7BnWtSKj83Dp6VA0ygmpu/lryYF85lIwmD5Wt5z3wHS7PExOm1IOH8DvhNLHF2uQ4qdMIRssDW/8ziMPEM94VLfc3TUTw++7Fjzz7oFqlTtVNs6HjneA7bgGjv/myGFzqSR260TaOCvFqdLqxmcm0Ku4j7Fhc0saXb0XLo4rQ+7/qMMzoFzgNbiIAWMex50RjLqQuJS8UwYbdfs7lAKq2YkiXS6tfwiH6tcXEf+Tj8Q0NBn7xHJosAPWX0Ir5O224xr0Z/qhOFXz8gqzH/cgI2MBO6sDmfgwdsmgiH3ffj/Za5NFiF1TksXMiWs9dJPt4BNzTjrOm/PRSn0Qi9FYAFVcvjVyW5x0yZCItJMXRGfhrAgg3KcY6xr88wLh0MTitOy8Slp7SfCn3Y35V2Q23d1xz96KBrPiWWaq6c5mUgMsQdIOQdU75UgLxO9Nfzyc/84T2sX7JQ6Y8bjWeJefO1vFYDogsBbNjg0VHC/5ghBOCDFZGfIx0nuD+FmLkHHrKxgfdTn/udMpnETc5zxbepa9vhRsrqthyeRTPUufISaqy/9//1+O1W0ieQBISaeisQ1cVoMDz+EYMVq7tlxc2tbacDD1y7ILtte41j1CzsAvBBLxK79CjgH/8GmX+OWNdHClxli/nZz9o5dkDr0tIvQuLEISKCg3AycHccTnrMfV2KaP0GrpwYFioXViZjSjw8cJTOed7ZC6vwpBBaHKObSA2VQUSOEkHyzFy3EXqxVzB+BblBblMoX7HZytcTLJayyMaPY1/72ozz5au5LyWc4Fk2wu36tdk4qYRvonA1sPXjpS2jaFz6YHBXUBuZaDKeFBEujv0kUR981MIANJ0xd6Y/YBGwAes/TbQdKr+9MpmhkOtx4Sd7xaJHjrZ8I5zwPvcYe1McVTjMBC9NqzNDYLFBoKrW/83F5AWwL4aNKwnCnxlmpwvt24nKh9B94gcM+6fE3GoOdivG7d2bcLMC0azl8fG6oA2aF0k8i2BsrHSb5TYjTx3gqWRkv3lhIv4YJtuvcyp78PLceeS2iKIx6wh4UCXkFHKfxmgun1itneiauhQ6F3FamYWc3C8GpvYlvjSVJ5Ib+f/AO8dx2OJN0xP5aYJfHXSVO1aJaxSU73NVNQh3hEsqCEUl4WyAI/L2J6Mo2Qxsugp8SgZHLDlgkOGPjrgJU4U6ULAJiXE8oaWBZiB93J0unWNRNdtkDuJA9++q2mHJtRTXi4XrGYVrZtHUbOD4JWgf4OpmLFrMSsdbXRZU9cE6sQ/jENCjLINnnNIqZaIloMJ7DuxYlvgeVn7zZN1eGxtNxDa/7Xx135bE6PEhSxM8RulbR3qM2wxQpBpgOtJRDhIRZg4cRmHzODI1uZ7M9BGGBnBCLS1vuvPvdpaMm5RhhO+XuTv00Kd/WOb+/1OLFfHxpuBwF2+PxwwLcKNRlnFf/59iYOv6ksX6Tvb70yJS8KIUw0SFRw2KzSbpNeMVXf6eX8OU5fuDaWndGWMK8CcXvohCcVex1MpAzUJ8jorACJ7dBtB33Vn6dG0LqhAb+b2xsupdn7ze20rxwJsGwz5P8SoY8cJrYljVYpI7UZ/TCr3aNCk/BpNKY4PLYgO9OdzhDo2fpFaO3awC5JBu4wK5rmDFttWVq9p/9UrZD4xYe+jk4h4WCpBM3VxrPq4gFYNcc1qq0N7Ykyup28lQjgQ2cPK9TX2GBLUq0KChOvOpMcjTHi5HZ7CrDzdk9x4b7DAcARPfN+tMz8NvItJsOCpbmnvf9Eq+fg==,iv:Cy6XH2/MTi06bTQ184PMHzefI8aj6jkaXQZSPKf0ZL8=,tag:hU2DO0bGK/AF4QXC3iMdhA==,type:str]
@@ -716,4 +724,4 @@ sops:
       enc: AQICAHiCa0SxyWv/VuVkwfKgPAG3j8l+Be+oAWTYKNLFuuPQsAFZJNm31fbu7Nvpys8buYBtAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMkDoVrjbvMHHf89niAgEQgDtLxEX5HqaUAYPuSxtrimw50F/mjAZf6AWYpoHuxEUXgLs++BECkiao5TpAFXAQIWX+OYjQXENt2iA4yA==
       aws_profile: ""
   unencrypted_regex: /nonsensitive/
-  version: 3.12.1
+  version: 3.12.2

ops/services/04-idr-pipeline/README.md

@@ -8,6 +8,7 @@
 
 | Name | Version |
 |------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.10.0 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 6 |
 
 <!--WARNING: GENERATED CONTENT with terraform-docs, e.g.
@@ -62,11 +63,14 @@
 | [aws_iam_role_policy_attachment.idr_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.idr_task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_security_group.idr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_sqs_queue.events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |
+| [aws_sqs_queue_policy.events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |
 | [aws_vpc_security_group_egress_rule.idr_allow_all_traffic_ipv4](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
 | [aws_vpc_security_group_ingress_rule.idr_allow_db_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
 | [aws_ecr_image.pipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_image) | data source |
 | [aws_ecr_repository.pipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_repository) | data source |
 | [aws_ecs_cluster.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecs_cluster) | data source |
+| [aws_iam_policy_document.events_sqs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.idr_ecs_exec](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.idr_execution_ecr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.idr_execution_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

ops/services/04-idr-pipeline/events.tf

@@ -0,0 +1,42 @@
+locals {
+  events_queue_roles = jsondecode(
+    nonsensitive(
+      lookup(local.ssm_config, "/bfd/${local.service}/queue/authorized_roles_json", "[]")
+    )
+  )
+}
+
+resource "aws_sqs_queue" "events" {
+  count = local.is_prod ? 1 : 0
+
+  name = local.name_prefix
+
+  fifo_queue                 = false
+  sqs_managed_sse_enabled    = false
+  max_message_size           = 1048576
+  message_retention_seconds  = 4 * 24 * 60 * 60 # 4 days
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = 30
+}
+
+data "aws_iam_policy_document" "events_sqs" {
+  count = local.is_prod ? 1 : 0
+
+  statement {
+    sid       = "AllowPrincipalsToSendMessages"
+    actions   = ["sqs:SendMessage"]
+    resources = aws_sqs_queue.events[*].arn
+
+    principals {
+      type        = "AWS"
+      identifiers = local.events_queue_roles
+    }
+  }
+}
+
+resource "aws_sqs_queue_policy" "events" {
+  count = local.is_prod ? 1 : 0
+
+  queue_url = one(aws_sqs_queue.events[*].url)
+  policy    = one(data.aws_iam_policy_document.events_sqs[*].json)
+}