|
| 1 | +# ------------------------------------------------------------------------------ |
| 2 | +# CREATE EITHER S3 OBJECT OR ARCHIVE FILE |
| 3 | +# ------------------------------------------------------------------------------ |
| 4 | + |
| 5 | +# Here lambda function will be created from zip file uploaded in s3 bucket where key is path for zip file in the bucket. |
| 6 | +data "aws_s3_object" "lambda" { |
| 7 | + count = var.s3_bucket != "" && var.s3_key != "" ? 1 : 0 |
| 8 | + bucket = var.s3_bucket |
| 9 | + key = var.s3_key |
| 10 | +} |
| 11 | + |
| 12 | +# Here a zip file will be created when source_file is passed and lambda function will be created from that zip file |
| 13 | +data "archive_file" "lambda" { |
| 14 | + count = var.source_file != "" && var.output_path != "" ? 1 : 0 |
| 15 | + type = "zip" |
| 16 | + source_file = var.source_file |
| 17 | + output_path = var.output_path |
| 18 | +} |
| 19 | + |
| 20 | +data "aws_ssm_parameter" "env_vars_from_parameter_store" { |
| 21 | + for_each = var.env_vars_from_parameter_store |
| 22 | + name = each.value |
| 23 | +} |
| 24 | + |
| 25 | +locals { |
| 26 | + env_vars_from_parameter_store = length(keys(var.env_vars_from_parameter_store)) == 0 ? {} : zipmap( |
| 27 | + [for key, value in var.env_vars_from_parameter_store : key], |
| 28 | + [for parameter in data.aws_ssm_parameter.env_vars_from_parameter_store : parameter.value] |
| 29 | + ) |
| 30 | + environment_variables = length(keys(var.environment_variables)) == 0 && length(keys(local.env_vars_from_parameter_store)) == 0 ? [] : [merge(var.environment_variables, local.env_vars_from_parameter_store)] |
| 31 | +} |
| 32 | + |
| 33 | +# ------------------------------------------------------------------------------ |
| 34 | +# CREATE LAMBDA FUNCTION |
| 35 | +# ------------------------------------------------------------------------------ |
| 36 | +#tfsec:ignore:aws-lambda-enable-tracing |
| 37 | +resource "aws_lambda_function" "lambda" { |
| 38 | + function_name = var.function_name |
| 39 | + description = var.description |
| 40 | + handler = var.handler |
| 41 | + memory_size = var.lambda_memory |
| 42 | + role = aws_iam_role.lambda.arn |
| 43 | + runtime = var.lambda_runtime |
| 44 | + timeout = var.lambda_timeout |
| 45 | + s3_bucket = try(data.aws_s3_object.lambda[0].bucket, null) |
| 46 | + s3_key = try(data.aws_s3_object.lambda[0].key, null) |
| 47 | + s3_object_version = try(data.aws_s3_object.lambda[0].version_id, null) |
| 48 | + filename = try(data.archive_file.lambda[0].output_path, null) |
| 49 | + layers = var.layers_arn |
| 50 | + publish = var.publish |
| 51 | + |
| 52 | + dynamic "environment" { |
| 53 | + for_each = length(local.environment_variables) == 0 ? [] : local.environment_variables |
| 54 | + content { |
| 55 | + variables = environment.value |
| 56 | + } |
| 57 | + } |
| 58 | + |
| 59 | + dynamic "vpc_config" { |
| 60 | + for_each = var.subnets != null && var.security_group_ids != null ? [true] : [] |
| 61 | + content { |
| 62 | + security_group_ids = var.security_group_ids |
| 63 | + subnet_ids = var.subnets |
| 64 | + } |
| 65 | + } |
| 66 | +} |
| 67 | + |
| 68 | +# ------------------------------------------------------------------------------ |
| 69 | +# ASSIGN PERMISSION TO API GATEWAY, COGNITO, SQS AND EVENTBRIDGE |
| 70 | +# ------------------------------------------------------------------------------ |
| 71 | + |
| 72 | +resource "aws_lambda_permission" "api" { |
| 73 | + count = length(var.apigw_execution_arn) > 0 ? 1 : 0 |
| 74 | + statement_id = "AllowAPIGWLambdaInvoke" |
| 75 | + action = "lambda:InvokeFunction" |
| 76 | + function_name = aws_lambda_function.lambda.function_name |
| 77 | + principal = "apigateway.amazonaws.com" |
| 78 | + source_arn = "${var.apigw_execution_arn}/*/*/*" |
| 79 | +} |
| 80 | + |
| 81 | +resource "aws_lambda_permission" "cognito" { |
| 82 | + count = length(var.cognito_pool_arn) > 0 ? 1 : 0 |
| 83 | + statement_id = "AllowCognitoPoolLambdaInvoke" |
| 84 | + action = "lambda:InvokeFunction" |
| 85 | + function_name = aws_lambda_function.lambda.function_name |
| 86 | + principal = "cognito-idp.amazonaws.com" |
| 87 | + source_arn = var.cognito_pool_arn |
| 88 | +} |
| 89 | + |
| 90 | +resource "aws_lambda_permission" "sqs" { |
| 91 | + count = length(var.sqs_queue_arn) > 0 ? 1 : 0 |
| 92 | + statement_id = "AllowExecutionFromSQS" |
| 93 | + action = "lambda:InvokeFunction" |
| 94 | + function_name = aws_lambda_function.lambda.function_name |
| 95 | + principal = "sqs.amazonaws.com" |
| 96 | + source_arn = var.sqs_queue_arn |
| 97 | +} |
| 98 | + |
| 99 | +resource "aws_lambda_permission" "eventbridge" { |
| 100 | + count = length(var.eventbridge_rule_arn) > 0 ? 1 : 0 |
| 101 | + statement_id = "AllowExecutionFromEventBridge" |
| 102 | + action = "lambda:InvokeFunction" |
| 103 | + function_name = aws_lambda_function.lambda.function_name |
| 104 | + principal = "events.amazonaws.com" |
| 105 | + source_arn = var.eventbridge_rule_arn |
| 106 | +} |
| 107 | + |
| 108 | +# ------------------------------------------------------------------------------ |
| 109 | +# LAMBDA LOG RETENTION |
| 110 | +# ------------------------------------------------------------------------------ |
| 111 | +#tfsec:ignore:aws-cloudwatch-log-group-customer-key |
| 112 | +resource "aws_cloudwatch_log_group" "lambda" { |
| 113 | + name = "/aws/lambda/${aws_lambda_function.lambda.function_name}" |
| 114 | + retention_in_days = var.logs_retention |
| 115 | +} |
| 116 | + |
| 117 | +# ------------------------------------------------------------------------------ |
| 118 | +# CREATE LAMBDA FUNCTION URL |
| 119 | +# ------------------------------------------------------------------------------ |
| 120 | +resource "aws_lambda_function_url" "function_url" { |
| 121 | + count = var.function_url ? 1 : 0 |
| 122 | + function_name = aws_lambda_function.lambda.function_name |
| 123 | + authorization_type = "NONE" |
| 124 | + |
| 125 | + dynamic "cors" { |
| 126 | + for_each = length(keys(var.function_url_cors)) == 0 ? [] : [var.function_url_cors] |
| 127 | + |
| 128 | + content { |
| 129 | + allow_credentials = try(cors.value.allow_credentials, null) |
| 130 | + allow_headers = try(cors.value.allow_headers, null) |
| 131 | + allow_methods = try(cors.value.allow_methods, null) |
| 132 | + allow_origins = try(cors.value.allow_origins, null) |
| 133 | + expose_headers = try(cors.value.expose_headers, null) |
| 134 | + max_age = try(cors.value.max_age, null) |
| 135 | + } |
| 136 | + } |
| 137 | +} |
0 commit comments