Skip to content

feat(deploy): add DLQ, log retention, and existing destination bucket to CloudFormation - #25

Merged
ngoyal16 merged 1 commit into
mainfrom
feat/cfn-hardening-dlq-logs-destbucket
Sep 29, 2026
Merged

ngoyal16 merged 1 commit into
mainfrom
feat/cfn-hardening-dlq-logs-destbucket

Conversation

@ngoyal16

Copy link
Copy Markdown
Contributor

Fixes #18

Summary of Changes

  • Dead-Letter Queue (DLQ): Added ProcessorDeadLetterQueue (AWS::SQS::Queue) with server-side encryption and 14-day retention. Attached a RedrivePolicy to ProcessorQueue with configurable SqsMaxReceiveCount (default: 5).
  • CloudWatch LogGroup: Added explicit ProcessorLogGroup (AWS::Logs::LogGroup) with configurable LogRetentionDays (default: 30) to eliminate perpetual CloudWatch storage accumulation.
  • Existing Destination S3 Bucket: Removed internal creation of DestinationBucket in favor of an input parameter DasDestinationBucketName to write into existing pre-provisioned data lake buckets.
  • IAM Hardening: Updated LambdaExecutionRole to grant s3:PutObject permissions specifically to arn:aws:s3:::${DasDestinationBucketName}/*.
  • Configurable Lambda Memory: Parameterized LambdaMemorySize (default: 512, allowed values: 256-3072).
  • Stack Outputs: Added ProcessorDLQArn and ProcessorDLQUrl outputs.

… to CloudFormation (#18)

- Add ProcessorDeadLetterQueue SQS resource and RedrivePolicy to ProcessorQueue with configurable SqsMaxReceiveCount
- Add explicit AWS::Logs::LogGroup resource with configurable LogRetentionDays
- Parameterize LambdaMemorySize (default 512MB)
- Remove internal DestinationBucket creation and replace with DasDestinationBucketName parameter for existing data lake bucket integration
- Update IAM execution role and DAS_OUTPUT_BUCKET to use DasDestinationBucketName
- Add stack outputs for ProcessorDLQArn and ProcessorDLQUrl
@ngoyal16
ngoyal16 merged commit b67e0b7 into main Sep 29, 2026
9 checks passed
@ngoyal16
ngoyal16 deleted the feat/cfn-hardening-dlq-logs-destbucket branch September 29, 2026 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add SQS DLQ, CloudWatch LogGroup retention, and S3 lifecycle rules to CloudFormation

1 participant