This repository has been archived by the owner on May 30, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathmain.tf
99 lines (83 loc) · 2.44 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
data "aws_iam_policy_document" "assume_role" {
statement {
actions = ["sts:AssumeRole"]
principals {
identifiers = ["lambda.amazonaws.com"]
type = "Service"
}
}
}
resource "aws_sqs_queue" "dlq" {
name = "destroy-bastion-dlq"
}
data "aws_iam_policy_document" "destroy_bastion" {
statement {
actions = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
]
resources = [
"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/destroy-bastion",
"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/destroy-bastion:*",
]
}
statement {
actions = ["sqs:SendMessage"]
resources = [aws_sqs_queue.dlq.arn]
}
statement {
actions = [
"ec2:DeleteSecurityGroup",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSecurityGroups",
"ec2:RevokeSecurityGroupIngress",
]
resources = ["*"]
}
statement {
actions = [
"ecs:DescribeTask*",
"ecs:ListTask*",
"ecs:StopTask",
]
resources = ["*"]
condition {
test = "ArnEquals"
values = [var.cluster_arn]
variable = "ecs:cluster"
}
}
}
resource "aws_iam_role" "destroy_bastion" {
name = "destroy-bastion"
assume_role_policy = data.aws_iam_policy_document.assume_role.json
}
resource "aws_iam_role_policy" "destroy_bastion" {
name = "destroy-bastion"
policy = data.aws_iam_policy_document.destroy_bastion.json
role = aws_iam_role.destroy_bastion.name
}
resource "aws_lambda_function" "destroy_bastion" {
filename = "${path.module}/target/destroy-bastion.jar"
function_name = "destroy-bastion"
handler = "bastion.destroy"
memory_size = 512
publish = true
role = aws_iam_role.destroy_bastion.arn
runtime = "java8"
source_code_hash = filebase64sha256("${path.module}/target/destroy-bastion.jar")
timeout = 120
dead_letter_config {
target_arn = aws_sqs_queue.dlq.arn
}
environment {
variables = {
CLUSTER_NAME = var.cluster_name
CLUSTER_VPC_DEFAULT_SECURITY_GROUP_ID = var.cluster_vpc_default_security_group_id
CLUSTER_VPC_ID = var.cluster_vpc_id
}
}
}