Skip to content

Commit f06ff6d

Browse files
ChengaDevChengaDev
authored
Support multiple lambda integration (Gitlab) (#11)
* Support multiple lambda integration (Gitlab) * renames * update source code & add flexibility * CR fixes * fix syntax * changed to correct arn output * fix lambda execution resoucse arn
1 parent 39455f0 commit f06ff6d

File tree

15 files changed

+232
-92
lines changed

15 files changed

+232
-92
lines changed

‎locals.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
locals {
2+
resource_name_pattern = "spectral-${var.integration_type}-integration-${var.environment}"
3+
single_lambda_integration = contains(["jira", "terraform"], var.integration_type) ? true : false
4+
multiple_lambda_integration = contains(["gitlab"], var.integration_type) ? true : false
5+
api_triggered_function_arn = local.single_lambda_integration ? module.lambda_function[0].lambda_function_arn : module.frontend_lambda_function[0].lambda_function_arn
6+
}

‎modules/lambda/lambda.tf

Lines changed: 5 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
locals {
22
runtime = "nodejs14.x"
3-
lambda_handler = "handler.app"
4-
lambda_source_code_zip_path = "${path.module}/source_code/${var.integration_type}/app.zip"
3+
lambda_source_code_zip_path = "${path.module}/source_code/${var.integration_type}/${var.lambda_source_code_filename}"
54
}
65

76
resource "aws_lambda_function" "spectral_scanner_lambda" {
87
runtime = local.runtime
9-
role = aws_iam_role.lambda_execution_role.arn
10-
function_name = var.resource_name_pattern
118
filename = local.lambda_source_code_zip_path
12-
handler = local.lambda_handler
9+
handler = var.lambda_handler
10+
function_name = var.resource_name_pattern
11+
role = var.role_arn
1312
timeout = var.timeout
1413
memory_size = var.memory_size
1514
publish = var.publish
@@ -26,65 +25,11 @@ resource "aws_lambda_function" "spectral_scanner_lambda" {
2625

2726
resource "aws_cloudwatch_log_group" "lambda_log_group" {
2827
count = var.should_write_logs ? 1 : 0
29-
name = var.resource_name_pattern
28+
name = "/aws/lambda/${var.resource_name_pattern}"
3029
retention_in_days = var.logs_retention_in_days
3130

3231
tags = merge(
3332
var.global_tags,
3433
lookup(var.tags, "lambda", {}),
3534
)
36-
}
37-
38-
data "aws_iam_policy_document" "assume_role_policy" {
39-
statement {
40-
sid = ""
41-
effect = "Allow"
42-
43-
actions = ["sts:AssumeRole"]
44-
45-
principals {
46-
type = "Service"
47-
identifiers = ["lambda.amazonaws.com"]
48-
}
49-
}
50-
}
51-
52-
resource "aws_iam_role" "lambda_execution_role" {
53-
name = var.resource_name_pattern
54-
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
55-
56-
tags = merge(
57-
var.global_tags,
58-
lookup(var.tags, "iam", {}),
59-
)
60-
}
61-
62-
data "aws_iam_policy_document" "secrets_policy_document" {
63-
statement {
64-
sid = ""
65-
effect = "Allow"
66-
actions = ["secretsmanager:GetSecretValue"]
67-
resources = var.secrets_arns
68-
}
69-
}
70-
71-
resource "aws_iam_policy" "secrets_iam_policy" {
72-
count = var.store_secret_in_secrets_manager ? 1 : 0
73-
policy = data.aws_iam_policy_document.secrets_policy_document.json
74-
75-
tags = merge(
76-
var.global_tags,
77-
lookup(var.tags, "iam", {}),
78-
)
79-
}
80-
81-
resource "aws_iam_role_policy_attachment" "lambda_execution_role" {
82-
role = aws_iam_role.lambda_execution_role.name
83-
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
84-
}
85-
86-
resource "aws_iam_role_policy_attachment" "lambda_secrets_role_attachment" {
87-
count = var.store_secret_in_secrets_manager ? 1 : 0
88-
role = aws_iam_role.lambda_execution_role.name
89-
policy_arn = aws_iam_policy.secrets_iam_policy[count.index].arn
9035
}

‎modules/lambda/outputs.tf

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
1+
output "lambda_arn" {
2+
value = aws_lambda_function.spectral_scanner_lambda.arn
3+
}
4+
15
output "lambda_function_arn" {
26
value = aws_lambda_function.spectral_scanner_lambda.invoke_arn
37
}
48

59
output "lambda_function_name" {
610
value = aws_lambda_function.spectral_scanner_lambda.function_name
7-
}
8-
9-
output "lambda_iam_role_arn" {
10-
value = aws_iam_role.lambda_execution_role.arn
11-
}
12-
13-
output "lambda_iam_role_name" {
14-
value = aws_iam_role.lambda_execution_role.name
1511
}

‎modules/lambda/source_code/gitlab/app.zip

-668 KB
Binary file not shown.

‎modules/lambda/source_code/gitlab/backend.zip

1020 KB
Binary file not shown.

‎modules/lambda/source_code/gitlab/frontend.zip

78.5 KB
Binary file not shown.

‎modules/lambda/variables.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,4 +74,20 @@ variable "secrets_arns" {
7474
variable "store_secret_in_secrets_manager" {
7575
description = "Whether to store your secrets in secrets manager, default is false"
7676
type = bool
77+
}
78+
79+
variable "lambda_source_code_filename" {
80+
type = string
81+
description = "The lambda source code filename"
82+
}
83+
84+
variable "role_arn" {
85+
type = string
86+
description = "The lambda source code filename"
87+
}
88+
89+
variable "lambda_handler" {
90+
type = string
91+
description = "The handler of the handler"
92+
default = "handler.app"
7793
}

‎modules/role/outputs.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "lambda_role_name" {
2+
value = aws_iam_role.lambda_execution_role.name
3+
}
4+
5+
output "lambda_role_arn" {
6+
value = aws_iam_role.lambda_execution_role.arn
7+
}

‎modules/role/role.tf

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
data "aws_iam_policy_document" "assume_role_policy" {
2+
statement {
3+
sid = ""
4+
effect = "Allow"
5+
6+
actions = ["sts:AssumeRole"]
7+
8+
principals {
9+
type = "Service"
10+
identifiers = ["lambda.amazonaws.com"]
11+
}
12+
}
13+
}
14+
15+
resource "aws_iam_role" "lambda_execution_role" {
16+
name = var.resource_name_pattern
17+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
18+
19+
tags = merge(
20+
var.global_tags,
21+
lookup(var.tags, "iam", {}),
22+
)
23+
}
24+
25+
data "aws_iam_policy_document" "secrets_policy_document" {
26+
statement {
27+
sid = ""
28+
effect = "Allow"
29+
actions = ["secretsmanager:GetSecretValue"]
30+
resources = var.secrets_arns
31+
}
32+
}
33+
34+
resource "aws_iam_policy" "secrets_iam_policy" {
35+
count = var.store_secret_in_secrets_manager ? 1 : 0
36+
policy = data.aws_iam_policy_document.secrets_policy_document.json
37+
38+
tags = merge(
39+
var.global_tags,
40+
lookup(var.tags, "iam", {}),
41+
)
42+
}
43+
44+
resource "aws_iam_role_policy_attachment" "lambda_execution_role" {
45+
role = aws_iam_role.lambda_execution_role.name
46+
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
47+
}
48+
49+
resource "aws_iam_role_policy_attachment" "lambda_secrets_policy_attachment" {
50+
count = var.store_secret_in_secrets_manager ? 1 : 0
51+
role = aws_iam_role.lambda_execution_role.name
52+
policy_arn = aws_iam_policy.secrets_iam_policy[count.index].arn
53+
}

‎modules/role/variables.tf

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
variable "store_secret_in_secrets_manager" {
2+
description = "Whether to store your secrets in secrets manager, default is false"
3+
type = bool
4+
}
5+
6+
variable "secrets_arns" {
7+
description = "List of secrets associated with the lambda"
8+
type = list(string)
9+
default = []
10+
}
11+
12+
variable "global_tags" {
13+
type = map(string)
14+
description = "A list of tags to apply on all newly created resources."
15+
default = {
16+
BusinessUnit = "Spectral"
17+
}
18+
}
19+
20+
variable "tags" {
21+
type = map(map(string))
22+
description = "A collection of tags grouped by key representing it's target resource."
23+
default = {
24+
iam = {}
25+
lambda = {}
26+
api_gateway = {}
27+
}
28+
}
29+
30+
variable "resource_name_pattern" {
31+
type = string
32+
description = "A common resource name created by pattern."
33+
}
34+
35+
variable "multiple_lambda_integration" {
36+
type = bool
37+
description = "Is current integration structure contains two lambdas"
38+
}

‎multiple-lambdas-integration.tf

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
module "frontend_lambda_function" {
2+
count = local.multiple_lambda_integration ? 1 : 0
3+
source = "./modules/lambda"
4+
global_tags = var.global_tags
5+
tags = var.tags
6+
environment = var.environment
7+
integration_type = var.integration_type
8+
resource_name_pattern = "${local.resource_name_pattern}-frontend"
9+
env_vars = var.env_vars
10+
logs_retention_in_days = var.lambda_logs_retention_in_days
11+
should_write_logs = var.lambda_enable_logs
12+
lambda_handler = "frontend.app"
13+
timeout = var.lambda_function_timeout
14+
memory_size = var.lambda_function_memory_size
15+
publish = var.lambda_publish
16+
secrets_arns = var.store_secret_in_secrets_manager ? module.secrets_manager[0].secrets_arns : []
17+
store_secret_in_secrets_manager = var.store_secret_in_secrets_manager
18+
lambda_source_code_filename = "frontend.zip"
19+
role_arn = module.lambda_role.lambda_role_arn
20+
}
21+
22+
module "backend_lambda_function" {
23+
count = local.multiple_lambda_integration ? 1 : 0
24+
source = "./modules/lambda"
25+
global_tags = var.global_tags
26+
tags = var.tags
27+
environment = var.environment
28+
integration_type = var.integration_type
29+
resource_name_pattern = "${local.resource_name_pattern}-backend"
30+
env_vars = var.env_vars
31+
logs_retention_in_days = var.lambda_logs_retention_in_days
32+
should_write_logs = var.lambda_enable_logs
33+
lambda_handler = "backend.app"
34+
timeout = var.lambda_function_timeout
35+
memory_size = var.lambda_function_memory_size
36+
publish = var.lambda_publish
37+
secrets_arns = var.store_secret_in_secrets_manager ? module.secrets_manager[0].secrets_arns : []
38+
store_secret_in_secrets_manager = var.store_secret_in_secrets_manager
39+
lambda_source_code_filename = "backend.zip"
40+
role_arn = module.lambda_role.lambda_role_arn
41+
}
42+
43+
data "aws_iam_policy_document" "lambda_invoke_policy_document" {
44+
statement {
45+
sid = ""
46+
effect = "Allow"
47+
actions = ["lambda:InvokeFunction", "lambda:InvokeAsync"]
48+
resources = local.multiple_lambda_integration ? [module.backend_lambda_function[0].lambda_arn] : []
49+
}
50+
}
51+
52+
resource "aws_iam_policy" "lambda_invoke_iam_policy" {
53+
count = local.multiple_lambda_integration ? 1 : 0
54+
policy = data.aws_iam_policy_document.lambda_invoke_policy_document.json
55+
56+
tags = merge(
57+
var.global_tags,
58+
lookup(var.tags, "iam", {}),
59+
)
60+
}
61+
62+
resource "aws_iam_role_policy_attachment" "lambda_invoke_policy_attachment" {
63+
count = local.multiple_lambda_integration ? 1 : 0
64+
role = module.lambda_role.lambda_role_name
65+
policy_arn = aws_iam_policy.lambda_invoke_iam_policy[count.index].arn
66+
}

‎outputs.tf

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,19 @@ output "rest_api_lambda_execution_arn" {
1919
}
2020

2121
output "lambda_function_arn" {
22-
value = module.lambda_function.lambda_function_arn
22+
value = module.lambda_function[*].lambda_function_arn
2323
}
2424

2525
output "lambda_function_name" {
26-
value = module.lambda_function.lambda_function_name
26+
value = module.lambda_function[*].lambda_function_name
2727
}
2828

2929
output "lambda_iam_role_arn" {
30-
value = module.lambda_function.lambda_iam_role_arn
30+
value = module.lambda_role.lambda_role_arn
3131
}
3232

3333
output "lambda_iam_role_name" {
34-
value = module.lambda_function.lambda_iam_role_name
34+
value = module.lambda_role.lambda_role_name
3535
}
3636

3737
output "secrets_arns" {

‎shared.tf

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
module "api_gateway" {
2+
source = "./modules/api_gateway"
3+
global_tags = var.global_tags
4+
tags = var.tags
5+
environment = var.environment
6+
integration_type = var.integration_type
7+
resource_name_pattern = local.single_lambda_integration ? local.resource_name_pattern : "${local.resource_name_pattern}-frontend"
8+
lambda_function_arn = local.api_triggered_function_arn
9+
}
10+
11+
module "secrets_manager" {
12+
count = var.store_secret_in_secrets_manager ? 1 : 0
13+
integration_type = var.integration_type
14+
source = "./modules/secrets_manager"
15+
}
16+
17+
module "lambda_role" {
18+
source = "./modules/role"
19+
resource_name_pattern = local.single_lambda_integration ? local.resource_name_pattern : "${local.resource_name_pattern}-frontend"
20+
store_secret_in_secrets_manager = var.store_secret_in_secrets_manager
21+
secrets_arns = var.store_secret_in_secrets_manager ? module.secrets_manager[0].secrets_arns : []
22+
tags = var.tags
23+
global_tags = var.global_tags
24+
multiple_lambda_integration = local.multiple_lambda_integration
25+
}

‎main.tf renamed to ‎single-lambda-integration.tf

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
1-
locals {
2-
resource_name_pattern = "spectral-${var.integration_type}-integration-${var.environment}"
3-
}
4-
51
module "lambda_function" {
2+
count = local.single_lambda_integration ? 1 : 0
63
source = "./modules/lambda"
74
global_tags = var.global_tags
85
tags = var.tags
@@ -17,20 +14,6 @@ module "lambda_function" {
1714
publish = var.lambda_publish
1815
secrets_arns = var.store_secret_in_secrets_manager ? module.secrets_manager[0].secrets_arns : []
1916
store_secret_in_secrets_manager = var.store_secret_in_secrets_manager
20-
}
21-
22-
module "api_gateway" {
23-
source = "./modules/api_gateway"
24-
global_tags = var.global_tags
25-
tags = var.tags
26-
environment = var.environment
27-
integration_type = var.integration_type
28-
resource_name_pattern = local.resource_name_pattern
29-
lambda_function_arn = module.lambda_function.lambda_function_arn
30-
}
31-
32-
module "secrets_manager" {
33-
count = var.store_secret_in_secrets_manager ? 1 : 0
34-
integration_type = var.integration_type
35-
source = "./modules/secrets_manager"
17+
lambda_source_code_filename = "app.zip"
18+
role_arn = module.lambda_role.lambda_role_arn
3619
}

0 commit comments

Comments
 (0)