Skip to content

Commit 0a8e995

Browse files
userhas404duserhas404d
authored
Updates lambda implementation to the terraform-aws-lambda module (#10)
- Removes layer references in favor of the automated terraform-aws-lambda requirements management - Updates lambda python runtime from 3.8 to 3.9 - adds additional_iam_policy_statements input variable
1 parent 1dc2c4c commit 0a8e995

File tree

9 files changed

+51
-155
lines changed

9 files changed

+51
-155
lines changed

‎data.tf‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,3 @@
1-
locals {
2-
// https://github.com/phzietsman/aws-lambda-layer-common
3-
python_layers = {
4-
"ap-northeast-1" = "arn:aws:lambda:ap-northeast-1:306986787463:layer:common-python-libraries:1"
5-
"us-east-1" = "arn:aws:lambda:us-east-1:306986787463:layer:common-python-libraries:1"
6-
"ap-southeast-1" = "arn:aws:lambda:ap-southeast-1:306986787463:layer:common-python-libraries:1"
7-
"eu-west-1" = "arn:aws:lambda:eu-west-1:306986787463:layer:common-python-libraries:1"
8-
"us-west-1" = "arn:aws:lambda:us-west-1:306986787463:layer:common-python-libraries:1"
9-
"ap-east-1" = "arn:aws:lambda:ap-east-1:306986787463:layer:common-python-libraries:1"
10-
"ap-northeast-2" = "arn:aws:lambda:ap-northeast-2:306986787463:layer:common-python-libraries:1"
11-
"ap-northeast-3" = "arn:aws:lambda:ap-northeast-3:306986787463:layer:common-python-libraries:1"
12-
"ap-south-1" = "arn:aws:lambda:ap-south-1:306986787463:layer:common-python-libraries:1"
13-
"ap-southeast-2" = "arn:aws:lambda:ap-southeast-2:306986787463:layer:common-python-libraries:1"
14-
"ca-central-1" = "arn:aws:lambda:ca-central-1:306986787463:layer:common-python-libraries:1"
15-
"eu-central-1" = "arn:aws:lambda:eu-central-1:306986787463:layer:common-python-libraries:1"
16-
"eu-north-1" = "arn:aws:lambda:eu-north-1:306986787463:layer:common-python-libraries:1"
17-
"eu-west-2" = "arn:aws:lambda:eu-west-2:306986787463:layer:common-python-libraries:1"
18-
"eu-west-3" = "arn:aws:lambda:eu-west-3:306986787463:layer:common-python-libraries:1"
19-
"sa-east-1" = "arn:aws:lambda:sa-east-1:306986787463:layer:common-python-libraries:1"
20-
"us-east-2" = "arn:aws:lambda:us-east-2:306986787463:layer:common-python-libraries:1"
21-
"us-west-2" = "arn:aws:lambda:us-west-2:306986787463:layer:common-python-libraries:1"
22-
}
23-
}
24-
251
data "aws_s3_bucket" "cloudtrail_bucket" {
262
bucket = var.cloudtrail_bucket_name
273
}

‎iam.tf‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,4 @@
1-
resource "aws_iam_role" "lambda" {
2-
name = var.naming_prefix
3-
assume_role_policy = data.aws_iam_policy_document.lambda_role_trust.json
4-
5-
tags = var.tags
6-
}
7-
8-
data "aws_iam_policy_document" "lambda_role_trust" {
9-
statement {
10-
sid = "LambdaTrust"
11-
12-
actions = [
13-
"sts:AssumeRole"
14-
]
15-
16-
principals {
17-
type = "Service"
18-
identifiers = ["lambda.amazonaws.com"]
19-
}
20-
}
21-
}
22-
23-
resource "aws_iam_role_policy" "lambda_permissions" {
24-
name = var.naming_prefix
25-
role = aws_iam_role.lambda.id
26-
policy = data.aws_iam_policy_document.lambda_permissions.json
27-
}
28-
291
data "aws_iam_policy_document" "lambda_permissions" {
30-
statement {
31-
sid = "LoggingCreateGroup"
32-
33-
actions = [
34-
"logs:CreateLogGroup"
35-
]
36-
37-
resources = [
38-
"arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.func.name}"
39-
]
40-
}
41-
42-
statement {
43-
sid = "LoggingStreamPutEvents"
44-
45-
actions = [
46-
"logs:CreateLogStream",
47-
"logs:PutLogEvents"
48-
]
49-
50-
resources = [
51-
"arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.func.name}:log-stream:*"
52-
]
53-
}
54-
552
statement {
563
sid = "S3AccessBucket"
574

‎lambda.tf‎

Lines changed: 30 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,48 @@
1-
resource "aws_lambda_function" "func" {
21

3-
function_name = var.naming_prefix
4-
role = aws_iam_role.lambda.arn
2+
module "clickops_notifier_lambda" {
3+
source = "git::https://github.com/terraform-aws-modules/terraform-aws-lambda.git?ref=v3.2.1"
54

6-
handler = "main.handler"
7-
runtime = "python3.8"
5+
function_name = var.naming_prefix
6+
description = "ClickOps Notifier Lambda"
87

9-
filename = data.archive_file.func.output_path
10-
source_code_hash = filebase64sha256(data.archive_file.func.output_path)
8+
handler = "main.handler"
9+
runtime = "python3.9"
10+
publish = true
11+
source_path = "${path.module}/lambda/app"
1112

1213
timeout = var.event_processing_timeout
1314
memory_size = 128
1415

15-
layers = [local.python_layers[var.region]]
16-
17-
environment {
18-
variables = {
19-
WEBHOOK_PARAMETER = aws_ssm_parameter.slack_webhook.name
20-
EXCLUDED_ACCOUNTS = jsonencode(var.excluded_accounts)
21-
INCLUDED_ACCOUNTS = jsonencode(var.included_accounts)
16+
attach_policy_json = true
17+
policy_json = data.aws_iam_policy_document.lambda_permissions.json
2218

23-
EXCLUDED_USERS = jsonencode(var.excluded_users)
24-
INCLUDED_USERS = jsonencode(var.included_users)
19+
attach_policy_statements = true
20+
policy_statements = var.additional_iam_policy_statements
2521

26-
MESSAGE_FORMAT = var.message_format
22+
cloudwatch_logs_retention_in_days = var.log_retention_in_days
2723

28-
LOG_LEVEL = "INFO"
29-
}
30-
}
24+
environment_variables = {
25+
WEBHOOK_PARAMETER = aws_ssm_parameter.slack_webhook.name
26+
EXCLUDED_ACCOUNTS = jsonencode(var.excluded_accounts)
27+
INCLUDED_ACCOUNTS = jsonencode(var.included_accounts)
3128

32-
tags = var.tags
33-
}
29+
EXCLUDED_USERS = jsonencode(var.excluded_users)
30+
INCLUDED_USERS = jsonencode(var.included_users)
3431

35-
data "archive_file" "func" {
36-
type = "zip"
37-
source_dir = "${path.module}/lambda/app"
38-
output_file_mode = "0666"
39-
output_path = "${path.module}/lambda.zip"
40-
}
32+
MESSAGE_FORMAT = var.message_format
4133

42-
resource "aws_lambda_event_source_mapping" "bucket_notifications" {
43-
event_source_arn = aws_sqs_queue.bucket_notifications.arn
44-
function_name = aws_lambda_function.func.arn
34+
LOG_LEVEL = "INFO"
35+
}
4536

46-
batch_size = var.event_batch_size
47-
maximum_batching_window_in_seconds = var.event_maximum_batching_window
37+
event_source_mapping = {
38+
sqs = {
39+
event_source_arn = aws_sqs_queue.bucket_notifications.arn
40+
batch_size = var.event_batch_size
41+
maximum_batching_window_in_seconds = var.event_maximum_batching_window
42+
}
43+
}
4844

45+
tags = var.tags
4946
}
5047

5148
resource "aws_ssm_parameter" "slack_webhook" {

‎lambda/app/requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
requests==2.27.1

‎logging.tf‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎outputs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "clickops_notifier_lambda" {
2+
value = module.clickops_notifier_lambda
3+
}
4+
5+
output "sqs_queue" {
6+
value = aws_sqs_queue.bucket_notifications
7+
}

‎sample/sample.tf‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,12 @@ provider "aws" {
1212
}
1313

1414
module "clickops_notifications" {
15-
source = "../"
15+
source = "../"
1616

17-
cloudtrail_bucket_name = var.cloudtrail_bucket_name
18-
webhook = var.webhook
19-
region = var.region
20-
message_format = "slack"
17+
cloudtrail_bucket_name = var.cloudtrail_bucket_name
18+
webhook = var.webhook
19+
message_format = "slack"
2120
}
2221

23-
variable "cloudtrail_bucket_name" { }
24-
variable "webhook" { }
25-
variable "region" { }
22+
variable "cloudtrail_bucket_name" {}
23+
variable "webhook" {}

‎trigger.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,4 @@ resource "aws_s3_bucket_notification" "bucket_notification" {
3636
depends_on = [
3737
aws_sqs_queue_policy.bucket_notifications
3838
]
39-
}
39+
}

‎variables.tf‎

Lines changed: 6 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -10,36 +10,6 @@ variable "webhook" {
1010
sensitive = true
1111
}
1212

13-
variable "region" {
14-
type = string
15-
description = "Region where this will be deployed. Used for [getting the correct lambda layer]"
16-
17-
validation {
18-
condition = contains([
19-
"ap-northeast-1",
20-
"us-east-1",
21-
"ap-southeast-1",
22-
"eu-west-1",
23-
"us-west-1",
24-
"ap-east-1",
25-
"ap-northeast-2",
26-
"ap-northeast-3",
27-
"ap-south-1",
28-
"ap-southeast-2",
29-
"ca-central-1",
30-
"eu-central-1",
31-
"eu-north-1",
32-
"eu-west-2",
33-
"eu-west-3",
34-
"sa-east-1",
35-
"us-east-2",
36-
"us-west-2"
37-
], var.region)
38-
error_message = "Invalid region provided."
39-
}
40-
}
41-
42-
4313
# Application Related Optional Variables
4414

4515
variable "message_format" {
@@ -87,6 +57,12 @@ variable "naming_prefix" {
8757
default = "clickops-notifier"
8858
}
8959

60+
variable "additional_iam_policy_statements" {
61+
description = "Map of dynamic policy statements to attach to Lambda Function role"
62+
type = any
63+
default = {}
64+
}
65+
9066
variable "tags" {
9167
type = map(string)
9268
description = "Tags to add to resources in addition to the default_tags for the provider"

0 commit comments

Comments
 (0)