Pinpoint pools

aws/common/cloudwatch_log.tf

@@ -44,6 +44,26 @@
   }
 }
 
+# TODO fix the count line after it's working. Right now we want these in dev for testing
+resource "aws_cloudwatch_log_group" "pinpoint_deliveries" {
+  count             = var.cloudwatch_enabled ? 1 : 1
+  name              = "sns/${var.region}/${var.account_id}/PinPointDirectPublishToPhoneNumber"
+  retention_in_days = var.sensitive_log_retention_period_days
+  tags = {
+    CostCenter = "notification-canada-ca-${var.env}"
+  }
+}
+
+# TODO fix the count line after it's working. Right now we want these in dev for testing
+resource "aws_cloudwatch_log_group" "pinpoint_deliveries_failures" {
+  count             = var.cloudwatch_enabled ? 1 : 1
+  name              = "sns/${var.region}/${var.account_id}/PinPointDirectPublishToPhoneNumber/Failure"
+  retention_in_days = var.sensitive_log_retention_period_days
+  tags = {
+    CostCenter = "notification-canada-ca-${var.env}"
+  }
+}
+
 resource "aws_cloudwatch_log_group" "route53_resolver_query_log" {
   count             = var.cloudwatch_enabled ? 1 : 0
   name              = "route53/${var.region}/${var.account_id}/DNS/logs"

aws/common/iam.tf

@@ -189,3 +189,60 @@ data "aws_iam_policy_document" "firehose_waf_logs" {
 resource "aws_iam_service_linked_role" "spotInstances" {
   aws_service_name = "spot.amazonaws.com"
 }
+
+# Pinpoint IAM
+# see https://docs.aws.amazon.com/sms-voice/latest/userguide/configuration-sets-cloud-watch.html
+
+resource "aws_iam_role" "pinpoint_logs" {
+  name               = "PinpointLogs"
+  assume_role_policy = data.aws_iam_policy_document.pinpoint_assume.json
+}
+
+resource "aws_iam_policy" "pinpoint_logs" {
+  name   = "PinpointLogsPolicy"
+  path   = "/"
+  policy = data.aws_iam_policy_document.pinpoint_logs.json
+}
+
+resource "aws_iam_role_policy_attachment" "pinpoint_logs" {
+  role       = aws_iam_role.pinpoint_logs.name
+  policy_arn = aws_iam_policy.pinpoint_logs.arn
+}
+
+data "aws_iam_policy_document" "pinpoint_assume" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    effect  = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["sms-voice.amazonaws.com"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceAccount"
+      values   = [var.account_id]
+    }
+    condition {
+      test     = "ArnLike"
+      variable = "aws:SourceArn"
+      values = [
+        "arn:aws:sms-voice:${var.region}:${var.account_id}:configuration-set/pinpoint-configuration"
+      ]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "pinpoint_logs" {
+  statement {
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogStream",
+      "logs:DescribeLogStreams",
+      "logs:PutLogEvents"
+    ]
+    resources = [
+      "${aws_cloudwatch_log_group.pinpoint_deliveries[0].arn}:*",
+      "${aws_cloudwatch_log_group.pinpoint_failures[0].arn}:*"
+    ]
+  }
+}

aws/common/outputs.tf

@@ -143,6 +143,22 @@ output "sns_deliveries_failures_us_west_2_name" {
   value = var.cloudwatch_enabled ? aws_cloudwatch_log_group.sns_deliveries_failures_us_west_2[0].name : ""
 }
 
+output "pinpoint_deliveries_ca_central_arn" {
+  value = var.cloudwatch_enabled ? aws_cloudwatch_log_group.pinpoint_deliveries[0].arn : ""
+}
+
+output "pinpoint_deliveries_ca_central_name" {
+  value = var.cloudwatch_enabled ? aws_cloudwatch_log_group.pinpoint_deliveries[0].name : ""
+}
+
+output "pinpoint_deliveries_failures_ca_central_arn" {
+  value = var.cloudwatch_enabled ? aws_cloudwatch_log_group.pinpoint_deliveries_failures[0].arn : ""
+}
+
+output "pinpoint_deliveries_failures_ca_central_name" {
+  value = var.cloudwatch_enabled ? aws_cloudwatch_log_group.pinpoint_deliveries_failures[0].name : ""
+}
+
 output "sqs_notify_internal_tasks_arn" {
   value = aws_sqs_queue.notify_internal_tasks_queue.arn
 }

aws/ecr/ecr.tf

@@ -97,6 +97,18 @@ resource "aws_ecr_repository" "sns_to_sqs_sms_callbacks" {
   }
 }
 
+resource "aws_ecr_repository" "pinpoint_to_sqs_sms_callbacks" {
+  # The :latest tag is used in Staging
+
+  name                 = "notify/pinpoint_to_sqs_sms_callbacks"
+  image_tag_mutability = "MUTABLE" #tfsec:ignore:AWS078
+  force_delete         = var.force_delete_ecr
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
 resource "aws_ecr_repository" "system_status" {
   # The :latest tag is used in Staging
 

aws/ecr/images.tf

@@ -192,6 +192,7 @@ resource "null_resource" "build_sns_to_sqs_sms_callbacks_docker_image" {
     null_resource.lambda_repo_clone
   ]
 
+  # TODO: are we building the wrong image here?
   provisioner "local-exec" {
     command = "docker build -t ${aws_ecr_repository.sns_to_sqs_sms_callbacks.repository_url}:bootstrap -f /var/tmp/notification-lambdas/sesemailcallbacks/Dockerfile /var/tmp/notification-lambdas"
   }
@@ -208,6 +209,30 @@ resource "null_resource" "push_sns_to_sqs_sms_callbacks_docker_image" {
 
 }
 
+# Pinpoint to SQS Queue Build and Push
+
+resource "null_resource" "build_pinpoint_to_sqs_sms_callbacks_docker_image" {
+  count = var.bootstrap ? 1 : 0
+  depends_on = [
+    null_resource.lambda_repo_clone
+  ]
+
+  provisioner "local-exec" {
+    command = "docker build -t ${aws_ecr_repository.pinpoint_to_sqs_sms_callbacks.repository_url}:bootstrap -f /var/tmp/notification-lambdas/pinpointsmscallbacks/Dockerfile /var/tmp/notification-lambdas"
+  }
+
+}
+
+resource "null_resource" "push_pinpoint_to_sqs_sms_callbacks_docker_image" {
+  count      = var.bootstrap ? 1 : 0
+  depends_on = [null_resource.build_pinpoint_to_sqs_sms_callbacks_docker_image]
+
+  provisioner "local-exec" {
+    command = "docker push ${aws_ecr_repository.pinpoint_to_sqs_sms_callbacks.repository_url}:bootstrap"
+  }
+
+}
+
 #System status Build and Push
 
 resource "null_resource" "build_system_status_docker_image" {

aws/ecr/outputs.tf

@@ -22,6 +22,14 @@ output "sns_to_sqs_sms_callbacks_ecr_repository_url" {
   description = "Repository URL of sns_to_sqs_sms_callbacks ECR"
   value       = aws_ecr_repository.sns_to_sqs_sms_callbacks.repository_url
 }
+output "pinpoint_to_sqs_sms_callbacks_ecr_arn" {
+  description = "arn of pinpoint_to_sqs_sms_callbacks ECR"
+  value       = aws_ecr_repository.pinpoint_to_sqs_sms_callbacks.arn
+}
+output "pinpoint_to_sqs_sms_callbacks_ecr_repository_url" {
+  description = "Repository URL of pinpoint_to_sqs_sms_callbacks ECR"
+  value       = aws_ecr_repository.pinpoint_to_sqs_sms_callbacks.repository_url
+}
 output "heartbeat_ecr_arn" {
   description = "arn of heartbeat ECR"
   value       = aws_ecr_repository.heartbeat.arn

aws/ecr/secrets.tf

@@ -26,6 +26,15 @@
   secret_string = aws_ecr_repository.sns_to_sqs_sms_callbacks.repository_url
 }
 
+resource "aws_secretsmanager_secret" "pinpoint_to_sqs_sms_callbacks_repository_url" {
+  name = "PINPOINT_TO_SQS_SMS_CALLBACKS_REPOSITORY_URL"
+}
+
+resource "aws_secretsmanager_secret_version" "pinpoint_to_sqs_sms_callbacks_repository_url" {
+  secret_id     = aws_secretsmanager_secret.pinpoint_to_sqs_sms_callbacks_repository_url.id
+  secret_string = aws_ecr_repository.pinpoint_to_sqs_sms_callbacks.repository_url
+}
+
 resource "aws_secretsmanager_secret" "heartbeat_repository_url" {
   name = "HEARTBEAT_REPOSITORY_URL"
 }

aws/pinpoint_to_sqs_sms_callbacks/cloudwatch_alarms.tf

@@ -0,0 +1,74 @@
+# Note to maintainers:
+# Updating alarms? Update the Google Sheet also!
+# https://docs.google.com/spreadsheets/d/1gkrL3Trxw0xEkX724C1bwpfeRsTlK2X60wtCjF6MFRA/edit
+#
+
+resource "aws_cloudwatch_metric_alarm" "logs-1-500-error-1-minute-warning-pinpoint_to_sqs_sms_callbacks-api" {
+  count               = var.cloudwatch_enabled ? 1 : 0
+  alarm_name          = "logs-1-500-error-1-minute-warning-pinpoint_to_sqs_sms_callbacks-api"
+  alarm_description   = "One 500 error in 1 minute for pinpoint_to_sqs_sms_callbacks api"
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "1"
+  metric_name         = aws_cloudwatch_log_metric_filter.pinpoint_to_sqs_sms_callbacks-500-errors-api[0].metric_transformation[0].name
+  namespace           = aws_cloudwatch_log_metric_filter.pinpoint_to_sqs_sms_callbacks-500-errors-api[0].metric_transformation[0].namespace
+  period              = "60"
+  statistic           = "Sum"
+  threshold           = 1
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = [var.sns_alert_warning_arn]
+  ok_actions          = [var.sns_alert_warning_arn]
+}
+
+resource "aws_cloudwatch_metric_alarm" "logs-10-500-error-5-minutes-critical-pinpoint_to_sqs_sms_callbacks-api" {
+  count               = var.cloudwatch_enabled ? 1 : 0
+  alarm_name          = "logs-10-500-error-5-minutes-critical-pinpoint_to_sqs_sms_callbacks-api"
+  alarm_description   = "Ten 500 errors in 5 minutes for pinpoint_to_sqs_sms_callbacks api"
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "1"
+  metric_name         = aws_cloudwatch_log_metric_filter.pinpoint_to_sqs_sms_callbacks-500-errors-api[0].metric_transformation[0].name
+  namespace           = aws_cloudwatch_log_metric_filter.pinpoint_to_sqs_sms_callbacks-500-errors-api[0].metric_transformation[0].namespace
+  period              = "300"
+  statistic           = "Sum"
+  threshold           = 10
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = [var.sns_alert_critical_arn]
+  ok_actions          = [var.sns_alert_ok_arn]
+}
+
+resource "aws_cloudwatch_metric_alarm" "lambda-image-pinpoint-delivery-receipts-errors-warning" {
+  count               = var.cloudwatch_enabled ? 1 : 0
+  alarm_name          = "lambda-image-pinpoint-delivery-receipts-errors-warning"
+  alarm_description   = "5 errors on Lambda pinpoint-to-sqs-sms-callbacks in 10 minutes"
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "Errors"
+  namespace           = "AWS/Lambda"
+  period              = 60 * 10
+  statistic           = "Sum"
+  threshold           = 5
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = [var.sns_alert_warning_arn]
+  ok_actions          = [var.sns_alert_ok_arn]
+  dimensions = {
+    FunctionName = module.pinpoint_to_sqs_sms_callbacks.function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "lambda-image-pinpoint-delivery-receipts-errors-critical" {
+  count               = var.cloudwatch_enabled ? 1 : 0
+  alarm_name          = "lambda-image-pinpoint-delivery-receipts-errors-critical"
+  alarm_description   = "20 errors on Lambda pinpoint-to-sqs-sms-callbacks in 10 minutes"
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "Errors"
+  namespace           = "AWS/Lambda"
+  period              = 60 * 10
+  statistic           = "Sum"
+  threshold           = 20
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = [var.sns_alert_critical_arn]
+  ok_actions          = [var.sns_alert_ok_arn]
+  dimensions = {
+    FunctionName = module.pinpoint_to_sqs_sms_callbacks.function_name
+  }
+}

aws/pinpoint_to_sqs_sms_callbacks/cloudwatch_logs.tf

@@ -0,0 +1,27 @@
+#
+# SNS Receiving SMS CloudWatch logging
+#
+
+resource "aws_cloudwatch_log_group" "pinpoint_to_sqs_sms_callbacks_log_group" {
+  count             = var.cloudwatch_enabled ? 1 : 0
+  name              = "pinpoint_to_sqs_sms_callbacks_log_group"
+  retention_in_days = var.sensitive_log_retention_period_days
+  tags = {
+    CostCenter  = "notification-canada-ca-${var.env}"
+    Environment = var.env
+    Application = "lambda"
+  }
+}
+
+resource "aws_cloudwatch_log_metric_filter" "pinpoint_to_sqs_sms_callbacks-500-errors-api" {
+  count          = var.cloudwatch_enabled ? 1 : 0
+  name           = "pinpoint_to_sqs_sms_callbacks-500-errors-api"
+  pattern        = "\"\\\"levelname\\\": \\\"ERROR\\\"\""
+  log_group_name = "/aws/lambda/${module.pinpoint_to_sqs_sms_callbacks.function_name}"
+
+  metric_transformation {
+    name      = "500-errors-pinpoint_to_sqs_sms_callbacks-api"
+    namespace = "LogMetrics"
+    value     = "1"
+  }
+}