terraform-aws-lambda/main.tf at master · genstackio/terraform-aws-lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
resource "aws_lambda_function" "lambda" {
  count = var.enabled ? 1 : 0
  //noinspection ConflictingProperties
  filename = var.file
  architectures = [var.architectures]
  //noinspection ConflictingProperties
  s3_bucket = local.is_s3 ? var.s3_bucket : null
  //noinspection ConflictingProperties
  s3_key = local.is_s3 ? local.real_s3_key : null
  //noinspection ConflictingProperties
  s3_object_version              = local.is_s3 ? var.s3_object_version : null
  source_code_hash               = (null != var.file) ? ((null == var.file_hash) ? ((true == var.check_file_hash) ? filebase64sha256(var.file) : null) : var.file_hash) : null
  image_uri                      = local.is_image ? var.image : null
  function_name                  = var.name
  role                           = aws_iam_role.lambda[0].arn
  handler                        = local.is_image ? null : var.handler
  runtime                        = local.is_image ? null : var.runtime
  timeout                        = var.timeout
  memory_size                    = var.memory_size
  depends_on                     = [module.lambda-policy, aws_cloudwatch_log_group.lambda[0]]
  tags                           = var.tags
  layers                         = var.layers
  publish                        = var.publish
  description                    = var.description
  package_type                   = (null != var.image) ? "Image" : "Zip"
  reserved_concurrent_executions = var.reserved

  dynamic "dead_letter_config" {
    iterator = v
    for_each = ("" != var.dlq_sns_topic) ? { dlq : var.dlq_sns_topic } : {}
    content {
      target_arn = v.value
    }
  }
  dynamic "environment" {
    iterator = v
    for_each = (0 != length(keys(var.variables))) ? { variables : var.variables } : {}
    content {
      variables = v.value
    }
  }
  dynamic "vpc_config" {
    iterator = v
    for_each = (0 != length(var.subnet_ids)) ? { x : { subnet_ids : var.subnet_ids, security_group_ids : var.security_group_ids } } : {}
    content {
      subnet_ids         = lookup(v.value, "subnet_ids")
      security_group_ids = lookup(v.value, "security_group_ids")
    }
  }
  dynamic "file_system_config" {
    iterator = v
    for_each = var.efs
    content {
      arn              = lookup(v.value, "arn")
      local_mount_path = lookup(v.value, "mount")
    }
  }
  dynamic "tracing_config" {
    iterator = v
    for_each = (null != var.tracing_mode) ? { x : { mode = var.tracing_mode } } : {}
    content {
      mode = lookup(v.value, "mode")
    }
  }
}

resource "aws_s3_object" "package-zip" {
  count  = local.is_managed_s3 ? 1 : 0
  bucket = var.s3_bucket
  key    = local.real_s3_key
  source = "${path.module}/default-packages/${var.runtime}.zip"
  etag   = filemd5("${path.module}/default-packages/${var.runtime}.zip")
  lifecycle {
    ignore_changes = [
      etag, source_hash
    ]
  }
}

//noinspection ConflictingProperties
resource "aws_iam_role" "lambda" {
  count              = var.enabled ? 1 : 0
  name               = (64 < length("lambda-${null != var.unique_name ? var.unique_name : var.name}-role")) ? null : "lambda-${null != var.unique_name ? var.unique_name : var.name}-role"
  name_prefix        = (64 >= length("lambda-${null != var.unique_name ? var.unique_name : var.name}-role")) ? null : "lambda-${null != var.unique_name ? var.unique_name : var.name}-role-"
  assume_role_policy = data.aws_iam_policy_document.lambda-assume-role.json
}

resource "aws_cloudwatch_log_group" "lambda" {
  count             = var.enabled ? 1 : 0
  name              = "/aws/lambda/${var.name}"
  retention_in_days = 14
}

module "lambda-policy" {
  source      = "./modules/policy"
  enabled     = var.enabled
  name        = null != var.unique_name ? var.unique_name : var.name
  policy_name = "lambda-${null != var.unique_name ? var.unique_name : var.name}"
  role_name   = (var.enabled && 0 < length(aws_iam_role.lambda)) ? aws_iam_role.lambda[0].name : null
  statements = concat(
    var.enabled ? [
      {
        actions   = ["logs:CreateLogStream", "logs:PutLogEvents"],
        resources = ["${aws_cloudwatch_log_group.lambda[0].arn}:*"],
        effect    = "Allow"
      },
    ] : [],
    var.policy_statements,
    ("" != var.dlq_sns_topic) ? [
      {
        actions   = ["SNS:Publish"],
        resources = [var.dlq_sns_topic],
        effect    = "Allow"
      },
    ] : [],
    length(var.subnet_ids) > 0 ? [
      {
        actions = [
          "ec2:DescribeSecurityGroups",
          "ec2:DescribeSubnets",
          "ec2:DescribeVpcs",
          "ec2:CreateNetworkInterface",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DeleteNetworkInterface"
        ]
        resources = ["*"]
        effect    = "Allow"
      }
    ] : [],
    "Active" == var.tracing_mode ? [
      {
        actions = [
          "xray:PutTraceSegments",
          "xray:PutTelemetryRecords"
        ]
        resources = ["*"]
        effect    = "Allow"
      }
    ] : []
  )
}