diff --git a/.gitignore b/.gitignore index 64ba6a7..4ac5c7f 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ terraform.tfstate terraform.tfvars .terraform.lock.hcl + +.idea diff --git a/CHANGELOG.md b/CHANGELOG.md index d6d9225..7b43f46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,14 @@ -# [3.6.0](https://github.com/observeinc/terraform-aws-lambda/compare/v3.5.1...v3.6.0) (2024-05-01) +# [3.7.0](https://github.com/observeinc/terraform-aws-lambda/compare/v3.6.0...v3.7.0) (2025-05-07) + + +### Bug Fixes + +* Fix S3 Bucket Notification Configuration Validation Error OBSSD-612 ([a708fc6](https://github.com/observeinc/terraform-aws-lambda/commit/a708fc6f17fadf1330c048d4165a1a3385de8a9b)) ### Features -* allow KMS encryption of token environment variable ([#83](https://github.com/observeinc/terraform-aws-lambda/issues/83)) ([5d209d5](https://github.com/observeinc/terraform-aws-lambda/commit/5d209d56d478e3e810d4e65bc26eb6daed95beca)) -* bump min terraform version to 1.1.1 ([#85](https://github.com/observeinc/terraform-aws-lambda/issues/85)) ([c660124](https://github.com/observeinc/terraform-aws-lambda/commit/c660124248bc0a3a3ef2a2d96dcef982e85af68e)) +* Update for apigatewayv2 ([a191b9c](https://github.com/observeinc/terraform-aws-lambda/commit/a191b9c8678d9f2c3aecfce14e6d0a5d8e7371fb)) diff --git a/README.md b/README.md index 36b181e..bb3ff33 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ Additionally, this repository provides submodules to interact with the lambda fu * [Upload S3 objects using S3 bucket notifications](https://github.com/observeinc/terraform-aws-lambda/tree/main/modules/s3_bucket_subscription) * [Subscribe CloudWatch Logs to Observe Lambda](https://github.com/observeinc/terraform-aws-lambda/tree/main/modules/cloudwatch_logs_subscription) -* [Collect API snapshots](https://github.com/observeinc/terraform-aws-lambda/tree/main/snapshot) +* [Collect API snapshots](https://github.com/observeinc/terraform-aws-lambda/tree/main/modules/snapshot) ## Examples diff --git a/examples/vpc_config/vpc.tf b/examples/vpc_config/vpc.tf index 4a23a16..8ab2d43 100644 --- a/examples/vpc_config/vpc.tf +++ b/examples/vpc_config/vpc.tf @@ -9,7 +9,7 @@ resource "aws_internet_gateway" "gw" { } resource "aws_eip" "nat" { - vpc = true + domain = "vpc" depends_on = [aws_internet_gateway.gw] } diff --git a/main.tf b/main.tf index 2b9f889..d9b1aaf 100644 --- a/main.tf +++ b/main.tf @@ -1,8 +1,8 @@ locals { - default_lambda_bucket = format("observeinc-%s", data.aws_region.current.name) + default_lambda_bucket = format("observeinc-%s", data.aws_region.current.id) lambda_iam_role_arn = var.lambda_iam_role_arn != "" ? var.lambda_iam_role_arn : aws_iam_role.lambda[0].arn lambda_iam_role_name = regex(".*role/(?P.*)$", local.lambda_iam_role_arn)["role_name"] - s3_bucket = var.s3_bucket != "" ? var.s3_bucket : lookup(var.s3_regional_buckets, data.aws_region.current.name, local.default_lambda_bucket) + s3_bucket = var.s3_bucket != "" ? var.s3_bucket : lookup(var.s3_regional_buckets, data.aws_region.current.id, local.default_lambda_bucket) s3_key = var.s3_key != "" ? var.s3_key : join("/", [var.s3_key_prefix, format("%s.zip", var.lambda_version)]) observe_token = var.kms_key != null ? aws_kms_ciphertext.token[0].ciphertext_blob : var.observe_token goarch = lookup( @@ -10,19 +10,19 @@ locals { "amd64" : { architectures = ["x86_64"] handler = "bootstrap" - runtime = "provided.al2" + runtime = "provided.al2023" } "arm64" : { architectures = ["arm64"] handler = "bootstrap" - runtime = "provided.al2" + runtime = "provided.al2023" } }, split("/", var.lambda_version)[0], { architectures = null - handler = "main" - runtime = "go1.x" + handler = "bootstrap" + runtime = "provided.al2023" }, ) } diff --git a/modules/s3_bucket/main.tf b/modules/s3_bucket/main.tf index 123465c..4bb73b5 100644 --- a/modules/s3_bucket/main.tf +++ b/modules/s3_bucket/main.tf @@ -42,8 +42,6 @@ module "s3_bucket" { tags = var.tags } -data "aws_redshift_service_account" "this" {} - data "aws_iam_policy_document" "bucket" { statement { sid = "AWSCloudTrailWrite" @@ -134,8 +132,8 @@ data "aws_iam_policy_document" "bucket" { effect = "Allow" principals { - type = "AWS" - identifiers = [data.aws_redshift_service_account.this.arn] + type = "Service" + identifiers = ["redshift.amazonaws.com"] } actions = [ @@ -152,8 +150,8 @@ data "aws_iam_policy_document" "bucket" { effect = "Allow" principals { - type = "AWS" - identifiers = [data.aws_redshift_service_account.this.arn] + type = "Service" + identifiers = ["redshift.amazonaws.com"] } actions = [ diff --git a/modules/s3_bucket_subscription/main.tf b/modules/s3_bucket_subscription/main.tf index 07344c5..938010c 100644 --- a/modules/s3_bucket_subscription/main.tf +++ b/modules/s3_bucket_subscription/main.tf @@ -28,6 +28,7 @@ resource "aws_s3_bucket_notification" "notification" { filter_prefix = var.filter_prefix filter_suffix = var.filter_suffix } + depends_on = [aws_lambda_permission.allow_bucket] } resource "aws_iam_policy" "s3_bucket_read" { diff --git a/modules/snapshot/README.md b/modules/snapshot/README.md index 4f3306c..086298c 100644 --- a/modules/snapshot/README.md +++ b/modules/snapshot/README.md @@ -123,7 +123,7 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [action](#input\_action) | List of actions allowed by policy and periodically triggered. By default,
this list contains all policies which the lambda can act upon. You should
only override this list if you do not want to execute more actions as they
become available in future lambda upgrades. If you instead wish to extend
this list, or ignore a subset of actions, use \"include\" and \"exclude\". | `list(string)` | 
[
  "apigateway:Get*",
  "autoscaling:Describe*",
  "cloudformation:Describe*",
  "cloudformation:List*",
  "cloudfront:List*",
  "dynamodb:Describe*",
  "dynamodb:List*",
  "ec2:Describe*",
  "ecs:Describe*",
  "ecs:List*",
  "eks:Describe*",
  "eks:List*",
  "elasticbeanstalk:Describe*",
  "elasticache:Describe*",
  "elasticfilesystem:Describe*",
  "elasticloadbalancing:Describe*",
  "elasticmapreduce:Describe*",
  "elasticmapreduce:List*",
  "events:List*",
  "firehose:Describe*",
  "firehose:List*",
  "iam:Get*",
  "iam:List*",
  "kinesis:Describe*",
  "kinesis:List*",
  "kms:Describe*",
  "kms:List*",
  "lambda:List*",
  "logs:Describe*",
  "organizations:Describe*",
  "organizations:List*",
  "rds:Describe*",
  "redshift:Describe*",
  "route53:List*",
  "s3:GetBucket*",
  "s3:List*",
  "secretsmanager:List*",
  "sns:Get*",
  "sns:List*",
  "sqs:Get*",
  "sqs:List*",
  "synthetics:Describe*",
  "synthetics:List*"
]
| no | +| [action](#input\_action) | List of actions allowed by policy and periodically triggered. By default,
this list contains all policies which the lambda can act upon. You should
only override this list if you do not want to execute more actions as they
become available in future lambda upgrades. If you instead wish to extend
this list, or ignore a subset of actions, use \"include\" and \"exclude\". | `list(string)` | 
[
  "apigateway:Get*",
  "apigatewayv2:Get*",
  "autoscaling:Describe*",
  "cloudformation:Describe*",
  "cloudformation:List*",
  "cloudfront:List*",
  "dynamodb:Describe*",
  "dynamodb:List*",
  "ec2:Describe*",
  "ecs:Describe*",
  "ecs:List*",
  "eks:Describe*",
  "eks:List*",
  "elasticbeanstalk:Describe*",
  "elasticache:Describe*",
  "elasticfilesystem:Describe*",
  "elasticloadbalancing:Describe*",
  "elasticmapreduce:Describe*",
  "elasticmapreduce:List*",
  "events:List*",
  "firehose:Describe*",
  "firehose:List*",
  "iam:Get*",
  "iam:List*",
  "kinesis:Describe*",
  "kinesis:List*",
  "kms:Describe*",
  "kms:List*",
  "lambda:List*",
  "logs:Describe*",
  "organizations:Describe*",
  "organizations:List*",
  "rds:Describe*",
  "redshift:Describe*",
  "route53:List*",
  "s3:GetBucket*",
  "s3:List*",
  "secretsmanager:List*",
  "sns:Get*",
  "sns:List*",
  "sqs:Get*",
  "sqs:List*",
  "synthetics:Describe*",
  "synthetics:List*"
]
| no | | [eventbridge\_name\_prefix](#input\_eventbridge\_name\_prefix) | Prefix used for EventBridge Rule | `string` | `"observe-lambda-snapshot-"` | no | | [eventbridge\_schedule\_event\_bus\_name](#input\_eventbridge\_schedule\_event\_bus\_name) | Event Bus for EventBridge scheduled events | `string` | `"default"` | no | | [eventbridge\_schedule\_expression](#input\_eventbridge\_schedule\_expression) | Rate at which snapshot is triggered. Must be valid EventBridge expression | `string` | `"rate(3 hours)"` | no | diff --git a/modules/snapshot/variables.tf b/modules/snapshot/variables.tf index 50a2700..0ff13a4 100644 --- a/modules/snapshot/variables.tf +++ b/modules/snapshot/variables.tf @@ -41,6 +41,7 @@ variable "action" { nullable = false default = [ "apigateway:Get*", + "apigatewayv2:Get*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:List*",