如何使用 Ansible 和 AWS 将重新驱动策略（死信队列/DLQ）添加到 SNS 订阅

Question

In an Ansible script I have:

- name: Subscribe lambda to SNS topic example1
  sns_topic:
    name: "example1-{{env_name}}"
    purge_subscriptions: no
    subscriptions:
      - endpoint: "arn:aws:lambda:{{ aws.region }}:{{ aws.account }}:function:{{repo_name}}-{{env_name}}"
        protocol: "lambda"

It works, and the result is that my lambda is subscribed to my SNS topic.

Now, I would want to add a DLQ to this subscription. I already have a SQS and I want to state it as my DLQ.

So I rewrite my code like this:

- name: Subscribe lambda to SNS topic example1
  sns_topic:
    name: "example1-{{env_name}}"
    purge_subscriptions: no
    subscriptions:
      - endpoint: "arn:aws:lambda:{{ aws.region }}:{{ aws.account }}:function:{{repo_name}}-{{env_name}}"
        protocol: "lambda"
        redrive_policy:
          dead_letter_target_arn: "arn:aws:{{ aws.region }}:{{ aws.account }}:dlq-for-example1"

This does not work and I didn't find anything in Ansible or by googling...

What am I doing wrong?

Answer 1

Looks like you are missing sqs between arn:aws:{{aws.region}} on the last line.

dead_letter_target_arn: "arn:aws:sqs:{{ aws.region }}:{{ aws.account }}:dlq-for-example1"

Answer 2

The problem is that the Subscription property that is embedded in the SNS Topic only has two properties: Endpoint and Protocol (See Subscription Property ).

For more advanced settings, like RedrivePolicy, you need to use the stand-alone AWS::SNS::Subscription resource (See Subscription Resource ).

Since AWS::SNS::Subscription is stand-alone, you must include the TopicArn that the Subscription is bound to. Also note that the RedrivePolicy is in Json format.

Here's a simple example of the Cloud Formation syntax from Redrive Syntax :

{
  "Resources": {
    "mySubscription": {
      "Type" : "AWS::SNS::Subscription",
      "Properties" : {
        "Protocol": "sqs",
        "Endpoint": "arn:aws:sqs:us-east-2:123456789012:MyEndpoint",
        "TopicArn": "arn:aws:sns:us-east-2:123456789012:MyTopic",
        "RedrivePolicy": {
          "deadLetterTargetArn":
            "arn:aws:sqs:us-east-2:123456789012:MyDeadLetterQueue"
        }
      }
    }
  }
}

But I don't know how Ansible makes these translations.