Skip to content

Commit 1722eee

Browse files
antonbabenkoantonbabenko
authored
feat: Customizable prefixes for IAM policies (as for IAM role) (claranet#74)
1 parent de83082 commit 1722eee

File tree

8 files changed

+414
-17
lines changed

8 files changed

+414
-17
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -549,6 +549,7 @@ Q4: What does this error mean - `"We currently do not support adding policies fo
549549
* [Async Invocations](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/async) - Create Lambda Function with async event configuration (with SQS and SNS integration).
550550
* [With VPC](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/with-vpc) - Create Lambda Function with VPC.
551551
* [With EFS](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/with-efs) - Create Lambda Function with Elastic File System attached (Terraform 0.13+ is recommended).
552+
* [Multiple regions](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/multiple-regions) - Create the same Lambda Function in multiple regions with non-conflicting IAM roles and policies.
552553

553554

554555
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/multiple-regions/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
builds/*

‎examples/multiple-regions/README.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# AWS Lambda Functions in several regions
2+
3+
Configuration in this directory creates AWS Lambda Functions in several regions with non-conflicting IAM roles and policies.
4+
5+
6+
## Usage
7+
8+
To run this example you need to execute:
9+
10+
```bash
11+
$ terraform init
12+
$ terraform plan
13+
$ terraform apply
14+
```
15+
16+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
17+
18+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
19+
## Requirements
20+
21+
| Name | Version |
22+
|------|---------|
23+
| terraform | >= 0.12.6 |
24+
| aws | >= 2.67 |
25+
| random | >= 2 |
26+
27+
## Providers
28+
29+
| Name | Version |
30+
|------|---------|
31+
| aws | >= 2.67 |
32+
| aws.us-east-1 | >= 2.67 |
33+
| random | >= 2 |
34+
35+
## Inputs
36+
37+
No input.
38+
39+
## Outputs
40+
41+
| Name | Description |
42+
|------|-------------|
43+
| lambda\_cloudwatch\_log\_group\_arn | The ARN of the Cloudwatch Log Group |
44+
| lambda\_role\_arn | The ARN of the IAM role created for the Lambda Function |
45+
| lambda\_role\_name | The name of the IAM role created for the Lambda Function |
46+
| local\_filename | The filename of zip archive deployed (if deployment was from local) |
47+
| s3\_object | The map with S3 object data of zip archive deployed (if deployment was from S3) |
48+
| this\_lambda\_function\_arn | The ARN of the Lambda Function |
49+
| this\_lambda\_function\_invoke\_arn | The Invoke ARN of the Lambda Function |
50+
| this\_lambda\_function\_kms\_key\_arn | The ARN for the KMS encryption key of Lambda Function |
51+
| this\_lambda\_function\_last\_modified | The date Lambda Function resource was last modified |
52+
| this\_lambda\_function\_name | The name of the Lambda Function |
53+
| this\_lambda\_function\_qualified\_arn | The ARN identifying your Lambda Function Version |
54+
| this\_lambda\_function\_source\_code\_hash | Base64-encoded representation of raw SHA-256 sum of the zip file |
55+
| this\_lambda\_function\_source\_code\_size | The size in bytes of the function .zip file |
56+
| this\_lambda\_function\_version | Latest published version of Lambda Function |
57+
| this\_lambda\_layer\_arn | The ARN of the Lambda Layer with version |
58+
| this\_lambda\_layer\_created\_date | The date Lambda Layer resource was created |
59+
| this\_lambda\_layer\_layer\_arn | The ARN of the Lambda Layer without version |
60+
| this\_lambda\_layer\_source\_code\_size | The size in bytes of the Lambda Layer .zip file |
61+
| this\_lambda\_layer\_version | The Lambda Layer version |
62+
63+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/multiple-regions/main.tf

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
4+
# Make it faster by skipping something
5+
skip_get_ec2_platforms = true
6+
skip_metadata_api_check = true
7+
skip_region_validation = true
8+
skip_credentials_validation = true
9+
skip_requesting_account_id = true
10+
}
11+
12+
provider "aws" {
13+
region = "us-east-1"
14+
alias = "us-east-1"
15+
16+
# Make it faster by skipping something
17+
skip_get_ec2_platforms = true
18+
skip_metadata_api_check = true
19+
skip_region_validation = true
20+
skip_credentials_validation = true
21+
skip_requesting_account_id = true
22+
}
23+
24+
################################
25+
# Lambda Function in one region
26+
################################
27+
28+
module "lambda_function" {
29+
source = "../../"
30+
31+
function_name = "${random_pet.this.id}-lambda1"
32+
description = "My awesome lambda function"
33+
handler = "index.lambda_handler"
34+
runtime = "python3.8"
35+
publish = true
36+
37+
source_path = "${path.module}/../fixtures/python3.8-app1"
38+
39+
attach_dead_letter_policy = true
40+
dead_letter_target_arn = aws_sqs_queue.dlq.arn
41+
42+
######################
43+
# Additional policies
44+
######################
45+
46+
attach_policy_json = true
47+
policy_json = <<EOF
48+
{
49+
"Version": "2012-10-17",
50+
"Statement": [
51+
{
52+
"Effect": "Allow",
53+
"Action": [
54+
"xray:GetSamplingStatisticSummaries"
55+
],
56+
"Resource": ["*"]
57+
}
58+
]
59+
}
60+
EOF
61+
62+
attach_policy_jsons = true
63+
policy_jsons = [<<EOF
64+
{
65+
"Version": "2012-10-17",
66+
"Statement": [
67+
{
68+
"Effect": "Allow",
69+
"Action": [
70+
"xray:*"
71+
],
72+
"Resource": ["*"]
73+
}
74+
]
75+
}
76+
EOF
77+
]
78+
number_of_policy_jsons = 1
79+
80+
attach_policy = true
81+
policy = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
82+
83+
attach_policies = true
84+
policies = ["arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess"]
85+
number_of_policies = 1
86+
87+
attach_policy_statements = true
88+
policy_statements = {
89+
dynamodb = {
90+
effect = "Allow",
91+
actions = ["dynamodb:BatchWriteItem"],
92+
resources = ["arn:aws:dynamodb:eu-west-1:052212379155:table/Test"]
93+
},
94+
s3_read = {
95+
effect = "Deny",
96+
actions = ["s3:HeadObject", "s3:GetObject"],
97+
resources = ["arn:aws:s3:::my-bucket/*"]
98+
}
99+
}
100+
101+
###########################
102+
# END: Additional policies
103+
###########################
104+
105+
tags = {
106+
Module = "lambda1"
107+
}
108+
}
109+
110+
##################################################
111+
# Same Lambda Function but in another region
112+
# (used to verify conflicting IAM resource names)
113+
##################################################
114+
115+
module "lambda_function_another_region" {
116+
source = "../../"
117+
118+
###########################################################
119+
# Using different region and IAM role name (policy prefix)
120+
###########################################################
121+
providers = {
122+
aws = aws.us-east-1
123+
}
124+
125+
role_name = "another-one-us-east-1"
126+
###########################################################
127+
128+
function_name = "${random_pet.this.id}-lambda1"
129+
description = "Copy of my awesome lambda function"
130+
handler = "index.lambda_handler"
131+
runtime = "python3.8"
132+
publish = true
133+
134+
source_path = "${path.module}/../fixtures/python3.8-app1"
135+
136+
attach_dead_letter_policy = true
137+
dead_letter_target_arn = aws_sqs_queue.dlq_us_east_1.arn
138+
139+
######################
140+
# Additional policies
141+
######################
142+
143+
attach_policy_json = true
144+
policy_json = <<EOF
145+
{
146+
"Version": "2012-10-17",
147+
"Statement": [
148+
{
149+
"Effect": "Allow",
150+
"Action": [
151+
"xray:GetSamplingStatisticSummaries"
152+
],
153+
"Resource": ["*"]
154+
}
155+
]
156+
}
157+
EOF
158+
159+
attach_policy_jsons = true
160+
policy_jsons = [<<EOF
161+
{
162+
"Version": "2012-10-17",
163+
"Statement": [
164+
{
165+
"Effect": "Allow",
166+
"Action": [
167+
"xray:*"
168+
],
169+
"Resource": ["*"]
170+
}
171+
]
172+
}
173+
EOF
174+
]
175+
number_of_policy_jsons = 1
176+
177+
attach_policy = true
178+
policy = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
179+
180+
attach_policies = true
181+
policies = ["arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess"]
182+
number_of_policies = 1
183+
184+
attach_policy_statements = true
185+
policy_statements = {
186+
dynamodb = {
187+
effect = "Allow",
188+
actions = ["dynamodb:BatchWriteItem"],
189+
resources = ["arn:aws:dynamodb:eu-west-1:052212379155:table/Test"]
190+
},
191+
s3_read = {
192+
effect = "Deny",
193+
actions = ["s3:HeadObject", "s3:GetObject"],
194+
resources = ["arn:aws:s3:::my-bucket/*"]
195+
}
196+
}
197+
198+
###########################
199+
# END: Additional policies
200+
###########################
201+
202+
tags = {
203+
Module = "lambda_function_in_another_region"
204+
}
205+
}
206+
207+
##################
208+
# Extra resources
209+
##################
210+
211+
resource "random_pet" "this" {
212+
length = 2
213+
}
214+
215+
resource "aws_sqs_queue" "dlq" {
216+
name = random_pet.this.id
217+
}
218+
219+
resource "aws_sqs_queue" "dlq_us_east_1" {
220+
name = random_pet.this.id
221+
222+
provider = aws.us-east-1
223+
}

‎examples/multiple-regions/outputs.tf

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Lambda Function
2+
output "this_lambda_function_arn" {
3+
description = "The ARN of the Lambda Function"
4+
value = module.lambda_function.this_lambda_function_arn
5+
}
6+
7+
output "this_lambda_function_invoke_arn" {
8+
description = "The Invoke ARN of the Lambda Function"
9+
value = module.lambda_function.this_lambda_function_invoke_arn
10+
}
11+
12+
output "this_lambda_function_name" {
13+
description = "The name of the Lambda Function"
14+
value = module.lambda_function.this_lambda_function_name
15+
}
16+
17+
output "this_lambda_function_qualified_arn" {
18+
description = "The ARN identifying your Lambda Function Version"
19+
value = module.lambda_function.this_lambda_function_qualified_arn
20+
}
21+
22+
output "this_lambda_function_version" {
23+
description = "Latest published version of Lambda Function"
24+
value = module.lambda_function.this_lambda_function_version
25+
}
26+
27+
output "this_lambda_function_last_modified" {
28+
description = "The date Lambda Function resource was last modified"
29+
value = module.lambda_function.this_lambda_function_last_modified
30+
}
31+
32+
output "this_lambda_function_kms_key_arn" {
33+
description = "The ARN for the KMS encryption key of Lambda Function"
34+
value = module.lambda_function.this_lambda_function_kms_key_arn
35+
}
36+
37+
output "this_lambda_function_source_code_hash" {
38+
description = "Base64-encoded representation of raw SHA-256 sum of the zip file"
39+
value = module.lambda_function.this_lambda_function_source_code_hash
40+
}
41+
42+
output "this_lambda_function_source_code_size" {
43+
description = "The size in bytes of the function .zip file"
44+
value = module.lambda_function.this_lambda_function_source_code_size
45+
}
46+
47+
# Lambda Layer
48+
output "this_lambda_layer_arn" {
49+
description = "The ARN of the Lambda Layer with version"
50+
value = module.lambda_function.this_lambda_layer_arn
51+
}
52+
53+
output "this_lambda_layer_layer_arn" {
54+
description = "The ARN of the Lambda Layer without version"
55+
value = module.lambda_function.this_lambda_layer_layer_arn
56+
}
57+
58+
output "this_lambda_layer_created_date" {
59+
description = "The date Lambda Layer resource was created"
60+
value = module.lambda_function.this_lambda_layer_created_date
61+
}
62+
63+
output "this_lambda_layer_source_code_size" {
64+
description = "The size in bytes of the Lambda Layer .zip file"
65+
value = module.lambda_function.this_lambda_layer_source_code_size
66+
}
67+
68+
output "this_lambda_layer_version" {
69+
description = "The Lambda Layer version"
70+
value = module.lambda_function.this_lambda_layer_version
71+
}
72+
73+
# IAM Role
74+
output "lambda_role_arn" {
75+
description = "The ARN of the IAM role created for the Lambda Function"
76+
value = module.lambda_function.lambda_role_arn
77+
}
78+
79+
output "lambda_role_name" {
80+
description = "The name of the IAM role created for the Lambda Function"
81+
value = module.lambda_function.lambda_role_name
82+
}
83+
84+
# CloudWatch Log Group
85+
output "lambda_cloudwatch_log_group_arn" {
86+
description = "The ARN of the Cloudwatch Log Group"
87+
value = module.lambda_function.lambda_cloudwatch_log_group_arn
88+
}
89+
90+
# Deployment package
91+
output "local_filename" {
92+
description = "The filename of zip archive deployed (if deployment was from local)"
93+
value = module.lambda_function.local_filename
94+
}
95+
96+
output "s3_object" {
97+
description = "The map with S3 object data of zip archive deployed (if deployment was from S3)"
98+
value = module.lambda_function.s3_object
99+
}

‎examples/multiple-regions/variables.tf

Whitespace-only changes.

0 commit comments

Comments
 (0)