Added lambda description and improved Lambda IAM policy for KMS

README.md

@@ -71,6 +71,7 @@ To run the tests:
 | create\_sns\_topic | Whether to create new SNS topic | bool | `"true"` | no |
 | iam\_role\_tags | Additional tags for the IAM role | map(string) | `{}` | no |
 | kms\_key\_arn | ARN of the KMS key used for decrypting slack webhook url | string | `""` | no |
+| lambda\_description | The description of the Lambda function | string | `"null"` | no |
 | lambda\_function\_name | The name of the Lambda function to create | string | `"notify_slack"` | no |
 | lambda\_function\_tags | Additional tags for the Lambda function | map(string) | `{}` | no |
 | log\_events | Boolean flag to enabled/disable logging of incoming events | string | `"false"` | no |

examples/cloudwatch-alerts-to-slack/main.tf

@@ -24,6 +24,9 @@ module "notify_slack" {
 
   kms_key_arn = aws_kms_key.this.arn
 
+  lambda_description = "Lambda function which sends notifications to Slack"
+  log_events         = true
+
   tags = {
     Name = "cloudwatch-alerts-to-slack"
   }

iam.tf

@@ -1,3 +1,22 @@
+locals {
+  lambda_policy_document = [{
+    sid    = "AllowWriteToCloudwatchLogs"
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+    ]
+    resources = [aws_cloudwatch_log_group.lambda[0].arn]
+  }]
+
+  lambda_policy_document_kms = var.kms_key_arn != "" ? [{
+    sid       = "AllowKMSDecrypt"
+    effect    = "Allow"
+    actions   = ["kms:Decrypt"]
+    resources = [var.kms_key_arn]
+  }] : []
+}
+
 data "aws_iam_policy_document" "assume_role" {
   count = var.create ? 1 : 0
 
@@ -13,36 +32,17 @@ data "aws_iam_policy_document" "assume_role" {
   }
 }
 
-data "aws_iam_policy_document" "lambda_basic" {
-  count = var.create ? 1 : 0
-
-  statement {
-    sid = "AllowWriteToCloudwatchLogs"
-
-    effect = "Allow"
-
-    actions = [
-      "logs:CreateLogStream",
-      "logs:PutLogEvents",
-    ]
-
-    resources = [aws_cloudwatch_log_group.lambda[0].arn]
-  }
-}
-
 data "aws_iam_policy_document" "lambda" {
-  count = var.kms_key_arn != "" && var.create ? 1 : 0
-
-  source_json = data.aws_iam_policy_document.lambda_basic[0].json
-
-  statement {
-    sid = "AllowKMSDecrypt"
-
-    effect = "Allow"
-
-    actions = ["kms:Decrypt"]
+  count = var.create ? 1 : 0
 
-    resources = [var.kms_key_arn]
+  dynamic "statement" {
+    for_each = concat(local.lambda_policy_document, local.lambda_policy_document_kms)
+    content {
+      sid       = statement.value.sid
+      effect    = statement.value.effect
+      actions   = statement.value.actions
+      resources = statement.value.resources
+    }
   }
 }
 
@@ -60,12 +60,5 @@ resource "aws_iam_role_policy" "lambda" {
 
   name_prefix = "lambda-policy-"
   role        = aws_iam_role.lambda[0].id
-
-  policy = element(
-    concat(
-      data.aws_iam_policy_document.lambda.*.json,
-      data.aws_iam_policy_document.lambda_basic.*.json,
-    ),
-    0,
-  )
+  policy      = data.aws_iam_policy_document.lambda[0].json
 }

main.tf

@@ -77,6 +77,7 @@ resource "aws_lambda_function" "notify_slack" {
   filename = data.archive_file.notify_slack[0].output_path
 
   function_name = var.lambda_function_name
+  description   = var.lambda_description
 
   role                           = aws_iam_role.lambda[0].arn
   handler                        = "notify_slack.lambda_handler"

variables.tf

@@ -16,6 +16,12 @@ variable "lambda_function_name" {
   default     = "notify_slack"
 }
 
+variable "lambda_description" {
+  description = "The description of the Lambda function"
+  type        = string
+  default     = null
+}
+
 variable "sns_topic_name" {
   description = "The name of the SNS topic to create"
   type        = string