Copy and paste setup for Cloudloop SQS routes and creates a group which developers can be attached to

cloudloop_sqs.tf

locals {
  rock7_arn = "arn:aws:iam::902942185257:role/Rock7CustomerSQS"
}

resource "aws_sqs_queue" "cloudloop_sqs_mo" {
  name                       = "Rock7_MO"
}

resource "aws_sqs_queue" "cloudloop_sqs_mt" {
  name                      = "Rock7_MT"
}

resource "aws_sqs_queue" "cloudloop_sqs_mt_confirm" {
  name                       = "Rock7_MT_Confirm"
}

resource "aws_sqs_queue_policy" "cloudloop_sqs_mo" {
  queue_url = aws_sqs_queue.cloudloop_sqs_mo.id
  policy    = data.aws_iam_policy_document.cloudloop_sqs_mo.json
}

data "aws_iam_policy_document" "cloudloop_sqs_mo" {
  statement {
    principals {
      type        = "AWS"
      identifiers = [local.rock7_arn]
    }

    actions = [
      "sqs:SendMessage",
      "sqs:GetQueueUrl"
    ]
    resources = [aws_sqs_queue.cloudloop_sqs_mo.arn]
  }
}

resource "aws_sqs_queue_policy" "cloudloop_sqs_mt" {
  queue_url = aws_sqs_queue.cloudloop_sqs_mt.id
  policy    = data.aws_iam_policy_document.cloudloop_sqs_mt.json
}

data "aws_iam_policy_document" "cloudloop_sqs_mt" {
  statement {
    principals {
      type        = "AWS"
      identifiers = [local.rock7_arn]
    }

    actions = [
      "sqs:ReceiveMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl"
    ]
    resources = [aws_sqs_queue.cloudloop_sqs_mt.arn]
  }
}

resource "aws_sqs_queue_policy" "cloudloop_sqs_mt_confirm" {
  queue_url = aws_sqs_queue.cloudloop_sqs_mt_confirm.id
  policy    = data.aws_iam_policy_document.cloudloop_sqs_mt_confirm.json
}

data "aws_iam_policy_document" "cloudloop_sqs_mt_confirm" {
  statement {
    principals {
      type        = "AWS"
      identifiers = [local.rock7_arn]
    }

    actions = [
      "sqs:SendMessage",
      "sqs:GetQueueUrl"
    ]
    resources = [aws_sqs_queue.cloudloop_sqs_mt_confirm.arn]
  }
}

developer_permissions.tf

resource "aws_iam_group" "cloudloop_sqs_developer" {
  name = "CloudloopSQSDeveloper"
}

resource "aws_iam_group_policy" "cloudloop_sqs_developer" {
  group = aws_iam_group.cloudloop_sqs_developer.name
  policy = data.aws_iam_policy_document.cloudloop_sqs_developer.json
}

data "aws_iam_policy_document" "cloudloop_sqs_developer" {
  statement {
    actions = [
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage"
    ]
    resources = [
      aws_sqs_queue.cloudloop_sqs_mo.arn,
      aws_sqs_queue.cloudloop_sqs_mt_confirm.arn
    ]
  }
  statement {
    actions = ["sqs:SendMessage"]
    resources = [aws_sqs_queue.cloudloop_sqs_mt.arn]
  }
}