fix: permission for Cloudwatch to run Notify Slack lambda

[craigzour]

Summary | Résumé

1-3 sentence description of the changed you're proposing, including a link to
a GitHub Issue # or Trello card if applicable.

---

Description en 1 à 3 phrases de la modification proposée, avec un lien vers le
problème (« issue ») GitHub ou la fiche Trello, le cas échéant.

Test instructions | Instructions pour tester la modification

Sequential steps (1., 2., 3., ...) that describe how to test this change. This
will help a developer test things out without too much detective work. Also,
include any environmental setup steps that aren't in the normal README steps
and/or any time-based elements that this requires.

---

Étapes consécutives (1., 2., 3., …) qui décrivent la façon de tester la
modification. Elles aideront les développeurs à faire des tests sans avoir à
jouer au détective. Veuillez aussi inclure toutes les étapes de configuration
de l’environnement qui ne font pas partie des étapes normales dans le fichier
README et tout élément temporel requis.

[github-actions]

⚠ Terrform update available

Terraform: 1.5.2 (using 1.4.2)
Terragrunt: 0.48.1 (using 0.46.3)

[github-actions]

Staging: alarms

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

⚠️   Warning: resources will be destroyed by this change!

Plan: 15 to add, 0 to change, 1 to destroy

Show summary

CHANGE	NAME
recreate	aws_lambda_permission.allow_cloudwatch_to_run_lambda
add	aws_cloudwatch_log_group.notify_slack
	aws_cloudwatch_log_subscription_filter.archiver_log_stream
	aws_cloudwatch_log_subscription_filter.audit_log_stream
	aws_cloudwatch_log_subscription_filter.dlq_consumer_log_stream
	aws_cloudwatch_log_subscription_filter.forms_app_log_stream
	aws_cloudwatch_log_subscription_filter.forms_unhandled_error_steam
	aws_cloudwatch_log_subscription_filter.nagware_log_stream
	aws_cloudwatch_log_subscription_filter.reliability_log_stream
	aws_cloudwatch_log_subscription_filter.template_archiver_log_stream
	aws_lambda_permission.notify_slack_critical
	aws_lambda_permission.notify_slack_ok
	aws_lambda_permission.notify_slack_ok_us_east
	aws_lambda_permission.notify_slack_warning
	aws_lambda_permission.notify_slack_warning_us_east

Show plan

Resource actions are indicated with the following symbols:
  + create
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_cloudwatch_log_group.notify_slack will be created
  + resource "aws_cloudwatch_log_group" "notify_slack" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + kms_key_id        = "arn:aws:kms:ca-central-1:687401027353:key/c5c2a1c2-c092-4fa1-8daf-3414f3511b1d"
      + name              = "/aws/lambda/NotifySlackSNS"
      + retention_in_days = 90
      + tags_all          = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.archiver_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "archiver_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/Archiver"
      + name            = "archiver_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.audit_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "audit_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/AuditLogs"
      + name            = "audit_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.dlq_consumer_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "dlq_consumer_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/DeadLetterQueueConsumer"
      + name            = "dql_consumer_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.forms_app_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "forms_app_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "Forms"
      + name            = "forms_app_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.forms_unhandled_error_steam will be created
  + resource "aws_cloudwatch_log_subscription_filter" "forms_unhandled_error_steam" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "Error -level"
      + id              = (known after apply)
      + log_group_name  = "Forms"
      + name            = "forms_unhandled_error_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.nagware_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "nagware_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/Nagware"
      + name            = "nagware_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.reliability_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "reliability_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/Reliability"
      + name            = "reliability_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_cloudwatch_log_subscription_filter.template_archiver_log_stream will be created
  + resource "aws_cloudwatch_log_subscription_filter" "template_archiver_log_stream" {
      + destination_arn = "arn:aws:lambda:ca-central-1:687401027353:function:NotifySlackSNS"
      + distribution    = "ByLogStream"
      + filter_pattern  = "{($.level = \"warn\") || ($.level = \"error\")}"
      + id              = (known after apply)
      + log_group_name  = "/aws/lambda/ArchiveFormTemplates"
      + name            = "template_archiver_log_stream"
      + role_arn        = (known after apply)
    }

  # aws_lambda_permission.allow_cloudwatch_to_run_lambda must be replaced
-/+ resource "aws_lambda_permission" "allow_cloudwatch_to_run_lambda" {
      ~ id            = "AllowExecutionFromCloudWatch" -> (known after apply)
      ~ source_arn    = "arn:aws:ssm:ca-central-1:687401027353:log-group:*:*" -> "arn:aws:logs:ca-central-1:687401027353:log-group:*:*" # forces replacement
        # (4 unchanged attributes hidden)
    }

  # aws_lambda_permission.notify_slack_critical will be created
  + resource "aws_lambda_permission" "notify_slack_critical" {
      + action        = "lambda:InvokeFunction"
      + function_name = "NotifySlackSNS"
      + id            = (known after apply)
      + principal     = "sns.amazonaws.com"
      + source_arn    = "arn:aws:sns:ca-central-1:687401027353:alert-critical"
      + statement_id  = "AllowExecutionFromSNSCriticalAlert"
    }

  # aws_lambda_permission.notify_slack_ok will be created
  + resource "aws_lambda_permission" "notify_slack_ok" {
      + action        = "lambda:InvokeFunction"
      + function_name = "NotifySlackSNS"
      + id            = (known after apply)
      + principal     = "sns.amazonaws.com"
      + source_arn    = "arn:aws:sns:ca-central-1:687401027353:alert-ok"
      + statement_id  = "AllowExecutionFromSNSOkAlert"
    }

  # aws_lambda_permission.notify_slack_ok_us_east will be created
  + resource "aws_lambda_permission" "notify_slack_ok_us_east" {
      + action        = "lambda:InvokeFunction"
      + function_name = "NotifySlackSNS"
      + id            = (known after apply)
      + principal     = "sns.amazonaws.com"
      + source_arn    = "arn:aws:sns:us-east-1:687401027353:alert-ok"
      + statement_id  = "AllowExecutionFromSNSOkAlertUSEast"
    }

  # aws_lambda_permission.notify_slack_warning will be created
  + resource "aws_lambda_permission" "notify_slack_warning" {
      + action        = "lambda:InvokeFunction"
      + function_name = "NotifySlackSNS"
      + id            = (known after apply)
      + principal     = "sns.amazonaws.com"
      + source_arn    = "arn:aws:sns:ca-central-1:687401027353:alert-warning"
      + statement_id  = "AllowExecutionFromSNSWarningAlert"
    }

  # aws_lambda_permission.notify_slack_warning_us_east will be created
  + resource "aws_lambda_permission" "notify_slack_warning_us_east" {
      + action        = "lambda:InvokeFunction"
      + function_name = "NotifySlackSNS"
      + id            = (known after apply)
      + principal     = "sns.amazonaws.com"
      + source_arn    = "arn:aws:sns:us-east-1:687401027353:alert-warning"
      + statement_id  = "AllowExecutionFromSNSWarningAlertUSEast"
    }

Plan: 15 to add, 0 to change, 1 to destroy.

Warning: Argument is deprecated

  with module.athena_bucket.aws_s3_bucket.this,
  on .terraform/modules/athena_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_replication_configuration resource instead

(and 8 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.notify_slack"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.alb_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.route53_ddos"]

20 tests, 17 passed, 3 warnings, 0 failures, 0 exceptions