Skip to content
This repository was archived by the owner on Dec 22, 2022. It is now read-only.

Commit 5f9e417

Browse files
author
Jeff Fairchild
committed
Attach role policy
1 parent 15ff600 commit 5f9e417

3 files changed

Lines changed: 171 additions & 3 deletions

File tree

‎lambda-healthcheck.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@ provider "aws" {
1111
version = "~> 2.46"
1212
}
1313

14+
data "aws_iam_policy" "lambda" {
15+
arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
16+
}
17+
18+
data "aws_iam_policy" "cloudwatch_put_metric" {
19+
arn = "arn:aws:iam::092841053073:policy/cloudwatch-put-metric"
20+
}
21+
1422
resource "aws_iam_role" "lambda_healthcheck" {
1523
name = "lambda-healthcheck"
1624
path = "/service-role/"
@@ -34,6 +42,16 @@ resource "aws_iam_role" "lambda_healthcheck" {
3442
EOF
3543
}
3644

45+
resource "aws_iam_role_policy_attachment" "metrics_role" {
46+
role = aws_iam_role.lambda_healthcheck.name
47+
policy_arn = data.aws_iam_policy.lambda.arn
48+
}
49+
50+
resource "aws_iam_role_policy_attachment" "put_metrics_role" {
51+
role = aws_iam_role.lambda_healthcheck.name
52+
policy_arn = data.aws_iam_policy.cloudwatch_put_metric.arn
53+
}
54+
3755
resource "aws_lambda_function" "healthcheck" {
3856
runtime = "python3.8"
3957
handler = "part_1"

‎terraform.tfstate‎

Lines changed: 79 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,48 @@
11
{
22
"version": 4,
33
"terraform_version": "0.12.17",
4-
"serial": 21,
4+
"serial": 29,
55
"lineage": "4e2a7732-9bb1-f787-fa33-cdca7563c7a4",
66
"outputs": {},
77
"resources": [
8+
{
9+
"mode": "data",
10+
"type": "aws_iam_policy",
11+
"name": "cloudwatch_put_metric",
12+
"provider": "provider.aws",
13+
"instances": [
14+
{
15+
"schema_version": 0,
16+
"attributes": {
17+
"arn": "arn:aws:iam::092841053073:policy/cloudwatch-put-metric",
18+
"description": "cloudwatch readonly except put metric",
19+
"id": "arn:aws:iam::092841053073:policy/cloudwatch-put-metric",
20+
"name": "cloudwatch-put-metric",
21+
"path": "/",
22+
"policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"cloudwatch:Describe*\",\n \"cloudwatch:Get*\",\n \"cloudwatch:List*\",\n \"cloudwatch:PutMetricData\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}"
23+
}
24+
}
25+
]
26+
},
27+
{
28+
"mode": "data",
29+
"type": "aws_iam_policy",
30+
"name": "lambda",
31+
"provider": "provider.aws",
32+
"instances": [
33+
{
34+
"schema_version": 0,
35+
"attributes": {
36+
"arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
37+
"description": "Provides write permissions to CloudWatch Logs.",
38+
"id": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
39+
"name": "AWSLambdaBasicExecutionRole",
40+
"path": "/service-role/",
41+
"policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"logs:CreateLogGroup\",\n \"logs:CreateLogStream\",\n \"logs:PutLogEvents\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}"
42+
}
43+
}
44+
]
45+
},
846
{
947
"mode": "managed",
1048
"type": "aws_cloudwatch_event_rule",
@@ -63,6 +101,46 @@
63101
}
64102
]
65103
},
104+
{
105+
"mode": "managed",
106+
"type": "aws_iam_role_policy_attachment",
107+
"name": "metrics_role",
108+
"provider": "provider.aws",
109+
"instances": [
110+
{
111+
"schema_version": 0,
112+
"attributes": {
113+
"id": "lambda-healthcheck-20200128161443520000000002",
114+
"policy_arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
115+
"role": "lambda-healthcheck"
116+
},
117+
"private": "bnVsbA==",
118+
"dependencies": [
119+
"aws_iam_role.lambda_healthcheck"
120+
]
121+
}
122+
]
123+
},
124+
{
125+
"mode": "managed",
126+
"type": "aws_iam_role_policy_attachment",
127+
"name": "put_metrics_role",
128+
"provider": "provider.aws",
129+
"instances": [
130+
{
131+
"schema_version": 0,
132+
"attributes": {
133+
"id": "lambda-healthcheck-20200128161443500200000001",
134+
"policy_arn": "arn:aws:iam::092841053073:policy/cloudwatch-put-metric",
135+
"role": "lambda-healthcheck"
136+
},
137+
"private": "bnVsbA==",
138+
"dependencies": [
139+
"aws_iam_role.lambda_healthcheck"
140+
]
141+
}
142+
]
143+
},
66144
{
67145
"mode": "managed",
68146
"type": "aws_lambda_function",

‎terraform.tfstate.backup‎

Lines changed: 74 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,48 @@
11
{
22
"version": 4,
33
"terraform_version": "0.12.17",
4-
"serial": 20,
4+
"serial": 24,
55
"lineage": "4e2a7732-9bb1-f787-fa33-cdca7563c7a4",
66
"outputs": {},
77
"resources": [
8+
{
9+
"mode": "data",
10+
"type": "aws_iam_policy",
11+
"name": "cloudwatch_put_metric",
12+
"provider": "provider.aws",
13+
"instances": [
14+
{
15+
"schema_version": 0,
16+
"attributes": {
17+
"arn": "arn:aws:iam::092841053073:policy/cloudwatch-put-metric",
18+
"description": "cloudwatch readonly except put metric",
19+
"id": "arn:aws:iam::092841053073:policy/cloudwatch-put-metric",
20+
"name": "cloudwatch-put-metric",
21+
"path": "/",
22+
"policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"cloudwatch:Describe*\",\n \"cloudwatch:Get*\",\n \"cloudwatch:List*\",\n \"cloudwatch:PutMetricData\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}"
23+
}
24+
}
25+
]
26+
},
27+
{
28+
"mode": "data",
29+
"type": "aws_iam_policy",
30+
"name": "lambda",
31+
"provider": "provider.aws",
32+
"instances": [
33+
{
34+
"schema_version": 0,
35+
"attributes": {
36+
"arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
37+
"description": "Provides write permissions to CloudWatch Logs.",
38+
"id": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
39+
"name": "AWSLambdaBasicExecutionRole",
40+
"path": "/service-role/",
41+
"policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"logs:CreateLogGroup\",\n \"logs:CreateLogStream\",\n \"logs:PutLogEvents\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}"
42+
}
43+
}
44+
]
45+
},
846
{
947
"mode": "managed",
1048
"type": "aws_cloudwatch_event_rule",
@@ -63,6 +101,40 @@
63101
}
64102
]
65103
},
104+
{
105+
"mode": "managed",
106+
"type": "aws_iam_role_policy_attachment",
107+
"name": "metrics_role",
108+
"provider": "provider.aws",
109+
"instances": [
110+
{
111+
"status": "tainted",
112+
"schema_version": 0,
113+
"attributes": {
114+
"id": "lambda-healthcheck-20200128161157130200000002",
115+
"policy_arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
116+
"role": "lambda-healthcheck"
117+
}
118+
}
119+
]
120+
},
121+
{
122+
"mode": "managed",
123+
"type": "aws_iam_role_policy_attachment",
124+
"name": "put_metrics_role",
125+
"provider": "provider.aws",
126+
"instances": [
127+
{
128+
"status": "tainted",
129+
"schema_version": 0,
130+
"attributes": {
131+
"id": "lambda-healthcheck-20200128161157116000000001",
132+
"policy_arn": "arn:aws:iam::092841053073:policy/cloudwatch-put-metric",
133+
"role": "lambda-healthcheck"
134+
}
135+
}
136+
]
137+
},
66138
{
67139
"mode": "managed",
68140
"type": "aws_lambda_function",
@@ -82,7 +154,7 @@
82154
"id": "healthcheck",
83155
"invoke_arn": "arn:aws:apigateway:us-east-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-2:092841053073:function:healthcheck/invocations",
84156
"kms_key_arn": "",
85-
"last_modified": "2020-01-28T15:29:19.024+0000",
157+
"last_modified": "2020-01-28T15:33:11.304+0000",
86158
"layers": [],
87159
"memory_size": 128,
88160
"publish": true,

0 commit comments

Comments
 (0)