Terraform policy for centralized sns notifications

[mobious999]

This isn't an issue I just wanted to share how I got the alarms going from all of the other accounts to a central account.

you'll need your account id and the org id (but can do lookups on them)

I had to do both of these policies because the cloudwatch api can't use the org's api for permissions.

data "aws_organizations_organization" "xxxxxxx" {}

resource "aws_sns_topic_policy" "cloudwatch_alarms_ec2_memory" {
arn = aws_sns_topic.cloudwatch_alarms_ec2_memory.arn

policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowPublishFromOrganizationAccounts",
"Effect": "Allow",
"Principal": "",
"Action": ["sns:Subscribe","sns:GetTopicAttributes","sns:ListSubscriptionsByTopic"],
"Resource": "${aws_sns_topic.cloudwatch_alarms_ec2_memory.arn}",
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "${data.aws_organizations_organization.xxxxxxx.id}"
}
}
},
{
"Sid": "Allow_Cloudwatch_to_Publish_Alarms_Centrally",
"Effect": "Allow",
"Principal": {
"Service": "cloudwatch.amazonaws.com"
},
"Action": "sns:Publish",
"Resource": "${aws_sns_topic.cloudwatch_alarms_ec2_memory.arn}"
},
{
"Sid": "AllowCloudWatchAlarmsToPublish",
"Effect": "Allow",
"Principal": {
"Service": "cloudwatch.amazonaws.com"
},
"Action": "SNS:Publish",
"Resource": "${aws_sns_topic.cloudwatch_alarms_ec2_memory.arn}",
"Condition": {
"ArnLike": {
"aws:SourceArn": [
"arn:aws:cloudwatch:us-east-2:xxxxxxxxxxxxxx:alarm:",
]
}
}
}
]
}
EOF
}