# modules/notification-service/main.tf
resource "aws_sns_topic" "notifications" {
name = "notification-service-topic"
tags = {
Service = "notification-service"
Environment = var.environment
}
}
resource "aws_sqs_queue" "notifications_dlq" {
name = "${var.project}-notif-dlq"
message_retention_seconds = 1209600 # 14 days, so failures are debuggable, not gone
tags = {
Service = "notification-service"
}
}
resource "aws_sqs_queue" "notifications_queue" {
name = "notification-service-queue"
visibility_timeout_seconds = 30
message_retention_seconds = 345600 # 4 days
redrive_policy = jsonencode({
deadLetterTargetArn = aws_sqs_queue.notifications_dlq.arn
maxReceiveCount = 5
})
tags = {
Service = "notification-service"
}
}
resource "aws_sns_topic_subscription" "queue_subscription" {
topic_arn = aws_sns_topic.notifications.arn
protocol = "sqs"
endpoint = aws_sqs_queue.notifications_queue.arn
}
# Least-privilege policy — scoped to this queue only, not sqs:*
resource "aws_sqs_queue_policy" "allow_sns" {
queue_url = aws_sqs_queue.notifications_queue.id
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = { Service = "sns.amazonaws.com" }
Action = "sqs:SendMessage"
Resource = aws_sqs_queue.notifications_queue.arn