diff --git a/kms_policy.json.tpl b/kms_policy.json.tpl
new file mode 100644
index 0000000..f956b2f
--- /dev/null
+++ b/kms_policy.json.tpl
@@ -0,0 +1,13 @@
+{
+ "Version": "2012-10-17",
+ "Id": "kms-key-policy",
+ "Statement": [
+ {
+ "Sid": "Enable IAM User Permissions",
+ "Effect": "Allow",
+ "Principal": {"AWS": "arn:aws:iam::${account_id}:root","Service": "logs.us-east-1.amazonaws.com"},
+ "Action": "kms:*",
+ "Resource": "*"
+ }
+ ]
+}
diff --git a/main.tf b/main.tf
new file mode 100644
index 0000000..9aa1984
--- /dev/null
+++ b/main.tf
@@ -0,0 +1,18 @@
+data "template_file" "kms_policy" {
+ template = "${file("${kms_policy.json.tpl")}"
+
+ vars {
+ account_id = "${var.account_id}"
+ }
+}
+
+resource "aws_kms_key" "key" {
+ policy = "${data.template_file.kms_policy.rendered}"
+}
+
+resource "aws_cloudwatch_log_group" "yada" {
+ name = "vijay"
+
+ kms_key_id = aws_kms_key.key.arn
+
+}
diff --git a/terraform-aws-sns/example/.terraform.lock.hcl b/terraform-aws-sns/example/.terraform.lock.hcl
new file mode 100644
index 0000000..f72ada9
--- /dev/null
+++ b/terraform-aws-sns/example/.terraform.lock.hcl
@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+ version = "4.22.0"
+ constraints = ">= 3.1.15"
+ hashes = [
+ "h1:KOsejPSvd2eEfuhtbLilFMnQZlaOJ53p7/NR+4qSibo=",
+ "zh:299efb8ba733b7742f0ef1c5c5467819e0c7bf46264f5f36ba6b6674304a5244",
+ "zh:4db198a41d248491204d4ca644662c32f748177d5cbe01f3c7adbb957d4d77f0",
+ "zh:62ebc2b05b25eafecb1a75f19d6fc5551faf521ada9df9e5682440d927f642e1",
+ "zh:636b590840095b4f817c176034cf649f543c0ce514dc051d6d0994f0a05c53ef",
+ "zh:8594bd8d442288873eee56c0b4535cbdf02cacfcf8f6ddcf8cd5f45bb1d3bc80",
+ "zh:8e18a370949799f20ba967eec07a84aaedf95b3ee5006fe5af6eae13fbf39dc3",
+ "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+ "zh:aa968514231e404fb53311d8eae2e8b6bde1fdad1f4dd5a592ab93d9cbf11af4",
+ "zh:af8e5c48bf36d4fff1a6fca760d5b85f14d657cbdf95e9cd5e898c68104bad31",
+ "zh:d8a75ba36bf8b6f2e49be5682f48eccb6c667a4484afd676ae347213ae208622",
+ "zh:dd7c419674a47e587dabe98b150a8f1f7e31c248c68e8bf5e9ca0a400b5e2c4e",
+ "zh:fdeb6314a2ce97489bbbece59511f78306955e8a23b02cbd1485bd04185a3673",
+ ]
+}
diff --git a/terraform-aws-sns/example/example.tf b/terraform-aws-sns/example/example.tf
new file mode 100644
index 0000000..96c8f77
--- /dev/null
+++ b/terraform-aws-sns/example/example.tf
@@ -0,0 +1,13 @@
+provider "aws" {
+ region = "eu-west-1"
+}
+
+module "sns_cloudwatch" {
+ source = "github.com/easyawslearn/Terraform-Tutorial/terraform-aws-sns"
+ cloudwatch_event_rule_name = "capture-aws-sign-in"
+ description = "Capture each AWS Console Sign In"
+ sns_name = "mysns"
+ sns_display_name = "demosns"
+ lambda_function_name = "S3cloudHub_Test_Lambda_Function"
+ lambda_function_runtime = "python3.8"
+}
diff --git a/terraform-aws-sns/example/version.tf b/terraform-aws-sns/example/version.tf
new file mode 100644
index 0000000..966e0bc
--- /dev/null
+++ b/terraform-aws-sns/example/version.tf
@@ -0,0 +1,12 @@
+# Terraform version
+terraform {
+ required_version = ">= 0.14.11"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 3.1.15"
+ }
+ }
+}
+
diff --git a/terraform-aws-sns/main.tf b/terraform-aws-sns/main.tf
new file mode 100644
index 0000000..a94ca7b
--- /dev/null
+++ b/terraform-aws-sns/main.tf
@@ -0,0 +1,132 @@
+provider "aws" {
+ region = var.region
+}
+
+resource "aws_cloudwatch_event_rule" "default" {
+ count = var.enabled == true ? 1 : 0
+
+ name = var.cloudwatch_event_rule_name
+ description = var.description
+ event_pattern = <<EOF
+{
+ "detail-type": [
+ "AWS Console Sign In via CloudTrail"
+ ]
+}
+EOF
+ role_arn = var.role_arn
+ is_enabled = var.is_enabled
+}
+
+resource "aws_cloudwatch_event_target" "default" {
+ count = var.enabled == true ? 1 : 0
+ rule = aws_cloudwatch_event_rule.default.*.name[0]
+ target_id = var.target_id
+ arn = aws_sns_topic.this[count.index].arn
+ input_path = var.input_path != "" ? var.input_path : null
+ role_arn = var.target_role_arn
+}
+
+resource "aws_sns_topic" "this" {
+ count = var.enabled ? 1 : 0
+
+ name = var.sns_name
+ display_name = var.sns_display_name
+ kms_master_key_id = var.kms_master_key_id
+ delivery_policy = var.delivery_policy
+ fifo_topic = var.fifo_topic
+ content_based_deduplication = var.content_based_deduplication
+}
+
+resource "aws_sns_topic_subscription" "this" {
+ for_each = var.enabled ? var.subscribers : {}
+
+ topic_arn = join("", aws_sns_topic.this.*.arn)
+ protocol = var.subscribers[each.key].protocol
+ endpoint = aws_lambda_function.terraform_lambda_func.arn
+ endpoint_auto_confirms = var.subscribers[each.key].endpoint_auto_confirms
+ raw_message_delivery = var.subscribers[each.key].raw_message_delivery
+}
+
+resource "aws_sns_topic_policy" "default" {
+ count = var.sns_topic_policy_enabled ? 1 : 0
+
+ arn = aws_sns_topic.this[count.index].arn
+ policy = data.aws_iam_policy_document.sns_topic_policy[count.index].json
+}
+
+data "aws_iam_policy_document" "sns_topic_policy" {
+ count = var.sns_topic_policy_enabled ? 1 : 0
+ statement {
+ effect = "Allow"
+ actions = ["SNS:Publish"]
+
+ principals {
+ type = "Service"
+ identifiers = ["events.amazonaws.com"]
+ }
+
+ resources = [aws_sns_topic.this[count.index].arn]
+ }
+}
+
+resource "aws_iam_role" "lambda_role" {
+ name = "S3cloudHub_Test_Lambda_Function_Role"
+ assume_role_policy = <<EOF
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": "sts:AssumeRole",
+ "Principal": {
+ "Service": "lambda.amazonaws.com"
+ },
+ "Effect": "Allow",
+ "Sid": ""
+ }
+ ]
+}
+EOF
+}
+resource "aws_iam_policy" "iam_policy_for_lambda" {
+
+ name = "aws_iam_policy_for_terraform_aws_lambda_role"
+ path = "/"
+ description = "AWS IAM Policy for managing aws lambda role"
+ policy = <<EOF
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "logs:CreateLogGroup",
+ "logs:CreateLogStream",
+ "logs:PutLogEvents"
+ ],
+ "Resource": "arn:aws:logs:*:*:*",
+ "Effect": "Allow"
+ }
+ ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy_attachment" "attach_iam_policy_to_iam_role" {
+ role = aws_iam_role.lambda_role.name
+ policy_arn = aws_iam_policy.iam_policy_for_lambda.arn
+}
+
+data "archive_file" "zip_the_python_code" {
+ type = "zip"
+ source_dir = "${path.module}/python/"
+ output_path = "${path.module}/python/hello-python.zip"
+}
+
+resource "aws_lambda_function" "terraform_lambda_func" {
+ filename = "${path.module}/python/hello-python.zip"
+ function_name = var.lambda_function_name
+ role = aws_iam_role.lambda_role.arn
+ handler = "index.lambda_handler"
+ runtime = var.lambda_function_runtime
+ depends_on = [aws_iam_role_policy_attachment.attach_iam_policy_to_iam_role]
+}
\ No newline at end of file
diff --git a/terraform-aws-sns/python/hello-python.py b/terraform-aws-sns/python/hello-python.py
new file mode 100644
index 0000000..708768c
--- /dev/null
+++ b/terraform-aws-sns/python/hello-python.py
@@ -0,0 +1,5 @@
+def lambda_handler(event, context):
+ message = 'Hello {} !'.format(event['key1'])
+ return {
+ 'message' : message
+ }
\ No newline at end of file
diff --git a/terraform-aws-sns/variable.tf b/terraform-aws-sns/variable.tf
new file mode 100644
index 0000000..4c70d19
--- /dev/null
+++ b/terraform-aws-sns/variable.tf
@@ -0,0 +1,201 @@
+variable "region" {
+ type = string
+ default = "eu-west-1"
+}
+
+variable "enabled" {
+ type = bool
+ default = true
+}
+
+variable "sns_topic_policy_enabled" {
+ type = bool
+ default = true
+}
+
+variable "lambda_function_name" {
+ type = string
+ default = ""
+}
+
+variable "lambda_function_runtime" {
+ type = string
+ default = ""
+}
+
+variable "sns_display_name" {
+ type = string
+ default = ""
+}
+
+variable "cloudwatch_event_rule_name" {
+ type = string
+ default = ""
+ description = "Name (e.g. `app` or `cluster`)."
+}
+
+variable "description" {
+ type = string
+ default = ""
+ description = "The description for the rule."
+}
+
+variable "role_arn" {
+ type = string
+ default = ""
+ description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
+}
+
+variable "is_enabled" {
+ type = bool
+ default = true
+ description = "Whether the rule should be enabled (defaults to true)."
+}
+
+variable "target_id" {
+ type = string
+ default = "SendToSNS"
+ description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
+}
+
+variable "arn" {
+ type = string
+ default = ""
+ description = "The Amazon Resource Name (ARN) associated with the role that is used for target invocation."
+}
+
+variable "input_path" {
+ type = string
+ default = ""
+ description = "The value of the JSONPath that is used for extracting part of the matched event when passing it to the target."
+}
+
+variable "target_role_arn" {
+ type = string
+ default = ""
+ description = "The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered. Required if ecs_target is used."
+}
+
+variable "input_paths" {
+ type = map(any)
+ default = {}
+ description = "Key value pairs specified in the form of JSONPath (for example, time = $.time)"
+
+}
+
+variable "sns_name" {
+ type = string
+ default = ""
+ description = "Name (e.g. `app` or `cluster`)."
+}
+
+variable "subscribers" {
+ type = map(object({
+ protocol = string
+ # The protocol to use. The possible values for this are: sqs, sms, lambda, application. (http or https are partially supported, see below) (email is an option but is unsupported, see below).
+ endpoint = string
+ # The endpoint to send data to, the contents will vary with the protocol. (see below for more information)
+ endpoint_auto_confirms = bool
+ # Boolean indicating whether the end point is capable of auto confirming subscription e.g., PagerDuty (default is false)
+ raw_message_delivery = bool
+ # Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property) (default is false)
+ }))
+ description = "Required configuration for subscibres to SNS topic."
+ default = {}
+}
+
+variable "allowed_aws_services_for_sns_published" {
+ type = list(string)
+ description = "AWS services that will have permission to publish to SNS topic. Used when no external JSON policy is used"
+ default = []
+}
+
+variable "kms_master_key_id" {
+ type = string
+ description = "The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK."
+ default = "alias/aws/sns"
+}
+
+variable "encryption_enabled" {
+ type = bool
+ description = "Whether or not to use encryption for SNS Topic. If set to `true` and no custom value for KMS key (kms_master_key_id) is provided, it uses the default `alias/aws/sns` KMS key."
+ default = true
+}
+
+variable "sqs_queue_kms_master_key_id" {
+ type = string
+ description = "The ID of an AWS-managed customer master key (CMK) for Amazon SQS Queue or a custom CMK"
+ default = "alias/aws/sqs"
+}
+
+variable "sqs_queue_kms_data_key_reuse_period_seconds" {
+ type = number
+ description = "The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again"
+ default = 300
+}
+
+variable "allowed_iam_arns_for_sns_publish" {
+ type = list(string)
+ description = "IAM role/user ARNs that will have permission to publish to SNS topic. Used when no external json policy is used."
+ default = []
+}
+
+variable "sns_topic_policy_json" {
+ type = string
+ description = "The fully-formed AWS policy as JSON"
+ default = ""
+}
+
+variable "sqs_dlq_enabled" {
+ type = bool
+ description = "Enable delivery of failed notifications to SQS and monitor messages in queue."
+ default = false
+}
+
+variable "sqs_dlq_max_message_size" {
+ type = number
+ description = "The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). The default for this attribute is 262144 (256 KiB)."
+ default = 262144
+}
+
+variable "sqs_dlq_message_retention_seconds" {
+ type = number
+ description = "The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days)."
+ default = 1209600
+}
+
+variable "delivery_policy" {
+ type = string
+ description = "The SNS delivery policy as JSON."
+ default = null
+}
+
+variable "fifo_topic" {
+ type = bool
+ description = "Whether or not to create a FIFO (first-in-first-out) topic"
+ default = false
+}
+
+variable "fifo_queue_enabled" {
+ type = bool
+ description = "Whether or not to create a FIFO (first-in-first-out) queue"
+ default = false
+}
+
+variable "content_based_deduplication" {
+ type = bool
+ description = "Enable content-based deduplication for FIFO topics"
+ default = false
+}
+
+variable "redrive_policy_max_receiver_count" {
+ type = number
+ description = "The number of times a message is delivered to the source queue before being moved to the dead-letter queue. When the ReceiveCount for a message exceeds the maxReceiveCount for a queue, Amazon SQS moves the message to the dead-letter-queue."
+ default = 5
+}
+
+variable "redrive_policy" {
+ type = string
+ description = "The SNS redrive policy as JSON. This overrides `var.redrive_policy_max_receiver_count` and the `deadLetterTargetArn` (supplied by `var.fifo_queue = true`) passed in by the module."
+ default = null
+}
\ No newline at end of file