Skip to content

Commit 7748ab3

Browse files
author
Paul Harrington
committed
removed timestamp, unneeded depends_on, fmt
1 parent 7e10ce8 commit 7748ab3

File tree

4 files changed

+75
-81
lines changed

4 files changed

+75
-81
lines changed

‎cloudwatch.tf‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,49 +5,46 @@ locals {
55

66
# Create CloudWatch log group for the Lambda function
77
resource "aws_cloudwatch_log_group" "lambda" {
8-
depends_on = [
9-
aws_kms_alias.lambda_cloudwatch
10-
]
11-
name = local.lambda_cloudwatch_log_group_name
8+
name = local.lambda_cloudwatch_log_group_name
129
retention_in_days = var.lambda_cloudwatch_retention_in_days
13-
kms_key_id = var.lambda_cloudwatch_encryption_enabled == true ? aws_kms_key.lambda_cloudwatch[0].arn : null
10+
kms_key_id = var.lambda_cloudwatch_encryption_enabled == true ? aws_kms_key.lambda_cloudwatch[0].arn : null
1411
}
1512

1613
# Create KMS key for encrypting CloudWatch logs at rest
1714
resource "aws_kms_key" "lambda_cloudwatch" {
18-
count = var.lambda_cloudwatch_encryption_enabled == true ? 1 : 0
19-
enable_key_rotation = true
15+
count = var.lambda_cloudwatch_encryption_enabled == true ? 1 : 0
16+
enable_key_rotation = true
2017
deletion_window_in_days = 30
21-
policy = data.aws_iam_policy_document.lambda_cloudwatch[0].json
18+
policy = data.aws_iam_policy_document.lambda_cloudwatch[0].json
2219
}
2320

2421
# Create KMS key alias
2522
resource "aws_kms_alias" "lambda_cloudwatch" {
26-
count = var.lambda_cloudwatch_encryption_enabled == true ? 1 : 0
23+
count = var.lambda_cloudwatch_encryption_enabled == true ? 1 : 0
2724
target_key_id = aws_kms_key.lambda_cloudwatch[0].key_id
28-
name = "alias/lambda/${lower(replace(replace(var.lambda_name, "_", ""), "-", ""))}"
25+
name = "alias/lambda/${lower(replace(replace(var.lambda_name, "_", ""), "-", ""))}"
2926
}
3027

3128
# Create IAM policy granting the account access to the KMS key
3229
data "aws_iam_policy_document" "lambda_cloudwatch" {
33-
count = var.lambda_cloudwatch_encryption_enabled == true ? 1 : 0
30+
count = var.lambda_cloudwatch_encryption_enabled == true ? 1 : 0
3431
version = "2012-10-17"
3532
statement {
36-
sid = "AccountRootFullAccess"
33+
sid = "AccountRootFullAccess"
3734
effect = "Allow"
3835
principals {
3936
identifiers = ["arn:aws:iam::${data.aws_caller_identity.default.account_id}:root"]
40-
type = "AWS"
37+
type = "AWS"
4138
}
42-
actions = ["kms:*"]
39+
actions = ["kms:*"]
4340
resources = ["*"]
4441
}
4542
statement {
46-
sid = "CloudWatchKmsEncryptAccess"
43+
sid = "CloudWatchKmsEncryptAccess"
4744
effect = "Allow"
4845
principals {
4946
identifiers = ["logs.${data.aws_region.default.name}.amazonaws.com"]
50-
type = "Service"
47+
type = "Service"
5148
}
5249
actions = [
5350
"kms:Encrypt*",
@@ -58,8 +55,8 @@ data "aws_iam_policy_document" "lambda_cloudwatch" {
5855
]
5956
resources = ["*"]
6057
condition {
61-
test = "ArnEquals"
62-
values = ["arn:aws:logs:${data.aws_region.default.name}:${data.aws_caller_identity.default.account_id}:log-group:${local.lambda_cloudwatch_log_group_name}"]
58+
test = "ArnEquals"
59+
values = ["arn:aws:logs:${data.aws_region.default.name}:${data.aws_caller_identity.default.account_id}:log-group:${local.lambda_cloudwatch_log_group_name}"]
6360
variable = "kms:EncryptionContext:aws:logs:arn"
6461
}
6562
}

‎iam.tf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,17 @@ data "aws_iam_policy_document" "lambda_assume_role" {
33
version = "2012-10-17"
44
statement {
55
actions = ["sts:AssumeRole"]
6-
effect = "Allow"
6+
effect = "Allow"
77
principals {
88
identifiers = ["lambda.amazonaws.com"]
9-
type = "Service"
9+
type = "Service"
1010
}
1111
}
1212
}
1313

1414
# Create role the Lambda function will assume
1515
resource "aws_iam_role" "lambda" {
16-
name = "${local.lambda_name_snake}Lambda"
16+
name = "${local.lambda_name_snake}Lambda"
1717
assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
1818
}
1919

@@ -49,7 +49,7 @@ data "aws_iam_policy_document" "lambda_application_policy" {
4949

5050
# Attach application policy to the Lambda functions IAM role
5151
resource "aws_iam_role_policy" "lambda_application_policy" {
52-
name = "${local.lambda_name_snake}Lambda"
53-
role = aws_iam_role.lambda.name
52+
name = "${local.lambda_name_snake}Lambda"
53+
role = aws_iam_role.lambda.name
5454
policy = data.aws_iam_policy_document.lambda_application_policy.json
55-
}
55+
}

‎lambda.tf‎

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
locals {
22
# Calculate values for internal use
3-
timestamp = formatdate("YYYYMMDDhhmmss", timestamp())
4-
lambda_name_snake = join("", [for element in split("-", lower(replace(var.lambda_name, "_", "-"))) : title(element)])
5-
lambda_runtime = "python${var.lambda_python_version}"
6-
lambda_delta_filename = "/tmp/lambda-${var.lambda_name}-delta-${local.timestamp}.zip"
7-
lambda_build_path = "/tmp/lambda-${var.lambda_name}-build-${local.timestamp}"
8-
lambda_filename = "/tmp/lambda-${var.lambda_name}-${local.timestamp}.zip"
3+
lambda_name_snake = join("", [for element in split("-", lower(replace(var.lambda_name, "_", "-"))) : title(element)])
4+
lambda_runtime = "python${var.lambda_python_version}"
5+
lambda_delta_filename = "/tmp/lambda-${var.lambda_name}-delta.zip"
6+
lambda_build_path = "/tmp/lambda-${var.lambda_name}-build"
7+
lambda_filename = "/tmp/lambda-${var.lambda_name}.zip"
98
}
109

1110
# Retrieve the AWS region and caller identity to which we are deploying this function
@@ -15,16 +14,13 @@ data "aws_caller_identity" "default" {}
1514

1615
# Archive the folder containing the Lambda functions source code
1716
data "archive_file" "lambda_delta" {
18-
type = "zip"
19-
source_dir = "${var.lambda_path}/"
17+
type = "zip"
18+
source_dir = "${var.lambda_path}/"
2019
output_path = local.lambda_delta_filename
2120
}
2221

2322
# Pull down the Lambda functions dependencies to create ZIP file
2423
resource "null_resource" "lambda_build" {
25-
depends_on = [
26-
data.archive_file.lambda_delta
27-
]
2824
# Trigger the build based on the hash of the Lambda functions source code to prevent unnecessary redeploys
2925
triggers = {
3026
source_hash = filesha512(data.archive_file.lambda_delta.output_path)
@@ -54,29 +50,29 @@ resource "aws_lambda_function" "lambda" {
5450
null_resource.lambda_build
5551
]
5652
function_name = local.lambda_name_snake
57-
description = var.lambda_description
58-
filename = local.lambda_filename
59-
role = aws_iam_role.lambda.arn
60-
handler = var.lambda_handler
61-
runtime = local.lambda_runtime
62-
memory_size = var.lambda_memory
63-
timeout = var.lambda_timeout
53+
description = var.lambda_description
54+
filename = local.lambda_filename
55+
role = aws_iam_role.lambda.arn
56+
handler = var.lambda_handler
57+
runtime = local.lambda_runtime
58+
memory_size = var.lambda_memory
59+
timeout = var.lambda_timeout
6460
environment {
6561
variables = merge({
6662
LAMBDA_FUNCTION_NAME = var.lambda_name,
67-
LAMBDA_IAM_ROLE_ARN = aws_iam_role.lambda.arn,
68-
LAMBDA_MEMORY_SIZE = var.lambda_memory,
69-
LAMBDA_RUNTIME = local.lambda_runtime,
70-
LAMBDA_TIMEOUT = var.lambda_timeout
63+
LAMBDA_IAM_ROLE_ARN = aws_iam_role.lambda.arn,
64+
LAMBDA_MEMORY_SIZE = var.lambda_memory,
65+
LAMBDA_RUNTIME = local.lambda_runtime,
66+
LAMBDA_TIMEOUT = var.lambda_timeout
7167
}, var.lambda_environment_variables)
7268
}
7369
dynamic "vpc_config" {
7470
for_each = var.lambda_subnet_ids == null ? {} : {
75-
subnet_ids = var.lambda_subnet_ids
71+
subnet_ids = var.lambda_subnet_ids
7672
security_group_ids = var.lambda_security_group_ids
7773
}
7874
content {
79-
subnet_ids = vpc_config.value.subnet_ids
75+
subnet_ids = vpc_config.value.subnet_ids
8076
security_group_ids = vpc_config.value.security_group_ids
8177
}
8278
}
@@ -86,7 +82,8 @@ resource "aws_lambda_function" "lambda" {
8682
"filename",
8783
"last_modified",
8884
"source_code_hash",
89-
"source_code_size"]
85+
"source_code_size"
86+
]
9087
}
9188
content {
9289
ignore_changes = lifecycle.value["ignore_changes"]

‎load_balancer.tf‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,46 @@
11
resource "aws_lambda_permission" "lambda" {
2-
count = var.load_balancer_enabled == true ? 1 : 0
3-
statement_id = "LoadBalancerInvokeAccess"
2+
count = var.load_balancer_enabled == true ? 1 : 0
3+
statement_id = "LoadBalancerInvokeAccess"
44
function_name = aws_lambda_function.lambda.function_name
5-
action = "lambda:InvokeFunction"
6-
principal = "elasticloadbalancing.amazonaws.com"
5+
action = "lambda:InvokeFunction"
6+
principal = "elasticloadbalancing.amazonaws.com"
77
}
88

99
resource "aws_lb" "load_balancer" {
10-
count = var.load_balancer_enabled == true ? 1 : 0
11-
name = local.lambda_name_snake
12-
internal = false
10+
count = var.load_balancer_enabled == true ? 1 : 0
11+
name = local.lambda_name_snake
12+
internal = false
1313
load_balancer_type = "application"
14-
subnets = var.load_balancer_subnet_ids
15-
security_groups = var.load_balancer_security_group_ids
14+
subnets = var.load_balancer_subnet_ids
15+
security_groups = var.load_balancer_security_group_ids
1616
}
1717

1818
resource "aws_route53_record" "load_balancer" {
19-
count = var.load_balancer_enabled == true && var.load_balancer_domain_name_enabled == true ? 1 : 0
19+
count = var.load_balancer_enabled == true && var.load_balancer_domain_name_enabled == true ? 1 : 0
2020
zone_id = var.load_balancer_domain_name_hosted_zone_id
21-
name = var.load_balancer_domain_name
22-
type = "A"
21+
name = var.load_balancer_domain_name
22+
type = "A"
2323
alias {
24-
name = aws_lb.load_balancer[0].dns_name
25-
zone_id = aws_lb.load_balancer[0].zone_id
24+
name = aws_lb.load_balancer[0].dns_name
25+
zone_id = aws_lb.load_balancer[0].zone_id
2626
evaluate_target_health = true
2727
}
2828
}
2929

3030
resource "aws_lb_listener" "load_balancer" {
31-
count = var.load_balancer_enabled == true ? 1 : 0
31+
count = var.load_balancer_enabled == true ? 1 : 0
3232
load_balancer_arn = aws_lb.load_balancer[0].arn
33-
port = var.load_balancer_port_public
34-
protocol = var.load_balancer_https_enabled == true ? "HTTPS" : "HTTP"
35-
ssl_policy = var.load_balancer_https_enabled == true ? var.load_balancer_https_ssl_policy : null
36-
certificate_arn = var.load_balancer_https_enabled == true ? var.load_balancer_https_certificate_arn : null
33+
port = var.load_balancer_port_public
34+
protocol = var.load_balancer_https_enabled == true ? "HTTPS" : "HTTP"
35+
ssl_policy = var.load_balancer_https_enabled == true ? var.load_balancer_https_ssl_policy : null
36+
certificate_arn = var.load_balancer_https_enabled == true ? var.load_balancer_https_certificate_arn : null
3737
# Setup default action
3838
default_action {
3939
type = "fixed-response"
4040
fixed_response {
4141
content_type = "text/plain"
4242
message_body = "The requested resource could not be found"
43-
status_code = "404"
43+
status_code = "404"
4444
}
4545
}
4646
}
@@ -50,33 +50,33 @@ resource "aws_lb_target_group" "load_balancer" {
5050
depends_on = [
5151
aws_lambda_permission.lambda
5252
]
53-
count = var.load_balancer_enabled == true ? 1 : 0
53+
count = var.load_balancer_enabled == true ? 1 : 0
5454
target_type = "lambda"
55-
name = aws_lambda_function.lambda.function_name
56-
port = var.load_balancer_port_lambda
57-
protocol = "HTTP"
55+
name = aws_lambda_function.lambda.function_name
56+
port = var.load_balancer_port_lambda
57+
protocol = "HTTP"
5858
health_check {
59-
enabled = var.load_balancer_health_check_enabled
60-
port = var.load_balancer_enabled == true ? var.load_balancer_port_lambda : null
61-
path = var.load_balancer_enabled == true ? var.load_balancer_health_check_url : null
59+
enabled = var.load_balancer_health_check_enabled
60+
port = var.load_balancer_enabled == true ? var.load_balancer_port_lambda : null
61+
path = var.load_balancer_enabled == true ? var.load_balancer_health_check_url : null
6262
interval = var.load_balancer_enabled == true ? var.load_balancer_health_check_interval : null
6363
}
6464
}
6565

6666
# Attach the target group the load balancer
6767
resource "aws_lb_target_group_attachment" "load_balancer" {
68-
count = var.load_balancer_enabled == true ? 1 : 0
68+
count = var.load_balancer_enabled == true ? 1 : 0
6969
target_group_arn = aws_lb_target_group.load_balancer[0].arn
70-
target_id = aws_lambda_function.lambda.arn
70+
target_id = aws_lambda_function.lambda.arn
7171
}
7272

7373
# Create load balancer listener rule
7474
resource "aws_lb_listener_rule" "load_balancer" {
75-
count = var.load_balancer_enabled == true ? 1 : 0
75+
count = var.load_balancer_enabled == true ? 1 : 0
7676
listener_arn = aws_lb_listener.load_balancer[0].arn
77-
priority = 100
77+
priority = 100
7878
action {
79-
type = "forward"
79+
type = "forward"
8080
target_group_arn = aws_lb_target_group.load_balancer[0].arn
8181
}
8282
condition {

0 commit comments

Comments
 (0)