Skip to content

Commit dd40178

Browse files
tsoe77bryantbiggsantonbabenko
authored
feat: Added support for Code Signing Configuration (terraform-aws-modules#351)
Co-authored-by: Bryant Biggs <bryantbiggs@gmail.com> Co-authored-by: Anton Babenko <anton@antonbabenko.com>
1 parent 62cdf74 commit dd40178

File tree

12 files changed

+281
-37
lines changed

12 files changed

+281
-37
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.71.0
3+
rev: v1.76.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_validate
@@ -23,7 +23,7 @@ repos:
2323
- '--args=--only=terraform_standard_module_structure'
2424
- '--args=--only=terraform_workspace_remote'
2525
- repo: https://github.com/pre-commit/pre-commit-hooks
26-
rev: v4.2.0
26+
rev: v4.3.0
2727
hooks:
2828
- id: check-merge-conflict
2929
- id: end-of-file-fixer

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -595,6 +595,7 @@ Q4: What does this error mean - `"We currently do not support adding policies fo
595595
- [Multiple regions](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/multiple-regions) - Create the same Lambda Function in multiple regions with non-conflicting IAM roles and policies.
596596
- [Event Source Mapping](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/event-source-mapping) - Create Lambda Function with event source mapping configuration (SQS, DynamoDB, Amazon MQ, and Kinesis).
597597
- [Triggers](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/triggers) - Create Lambda Function with some triggers (eg, Cloudwatch Events, EventBridge).
598+
- [Code Signing](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/code-signing) - Create Lambda Function with code signing configuration.
598599

599600
# Examples by the users of this module
600601

@@ -695,6 +696,7 @@ No modules.
695696
| <a name="input_cloudwatch_logs_kms_key_id"></a> [cloudwatch\_logs\_kms\_key\_id](#input\_cloudwatch\_logs\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data. | `string` | `null` | no |
696697
| <a name="input_cloudwatch_logs_retention_in_days"></a> [cloudwatch\_logs\_retention\_in\_days](#input\_cloudwatch\_logs\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `null` | no |
697698
| <a name="input_cloudwatch_logs_tags"></a> [cloudwatch\_logs\_tags](#input\_cloudwatch\_logs\_tags) | A map of tags to assign to the resource. | `map(string)` | `{}` | no |
699+
| <a name="input_code_signing_config_arn"></a> [code\_signing\_config\_arn](#input\_code\_signing\_config\_arn) | Amazon Resource Name (ARN) for a Code Signing Configuration | `string` | `null` | no |
698700
| <a name="input_compatible_architectures"></a> [compatible\_architectures](#input\_compatible\_architectures) | A list of Architectures Lambda layer is compatible with. Currently x86\_64 and arm64 can be specified. | `list(string)` | `null` | no |
699701
| <a name="input_compatible_runtimes"></a> [compatible\_runtimes](#input\_compatible\_runtimes) | A list of Runtimes this layer is compatible with. Up to 5 runtimes can be specified. | `list(string)` | `[]` | no |
700702
| <a name="input_cors"></a> [cors](#input\_cors) | CORS settings to be used by the Lambda Function URL | `any` | `{}` | no |
@@ -798,6 +800,8 @@ No modules.
798800
| <a name="output_lambda_function_last_modified"></a> [lambda\_function\_last\_modified](#output\_lambda\_function\_last\_modified) | The date Lambda Function resource was last modified |
799801
| <a name="output_lambda_function_name"></a> [lambda\_function\_name](#output\_lambda\_function\_name) | The name of the Lambda Function |
800802
| <a name="output_lambda_function_qualified_arn"></a> [lambda\_function\_qualified\_arn](#output\_lambda\_function\_qualified\_arn) | The ARN identifying your Lambda Function Version |
803+
| <a name="output_lambda_function_signing_job_arn"></a> [lambda\_function\_signing\_job\_arn](#output\_lambda\_function\_signing\_job\_arn) | ARN of the signing job |
804+
| <a name="output_lambda_function_signing_profile_version_arn"></a> [lambda\_function\_signing\_profile\_version\_arn](#output\_lambda\_function\_signing\_profile\_version\_arn) | ARN of the signing profile version |
801805
| <a name="output_lambda_function_source_code_hash"></a> [lambda\_function\_source\_code\_hash](#output\_lambda\_function\_source\_code\_hash) | Base64-encoded representation of raw SHA-256 sum of the zip file |
802806
| <a name="output_lambda_function_source_code_size"></a> [lambda\_function\_source\_code\_size](#output\_lambda\_function\_source\_code\_size) | The size in bytes of the function .zip file |
803807
| <a name="output_lambda_function_url"></a> [lambda\_function\_url](#output\_lambda\_function\_url) | The URL of the Lambda Function URL |

‎examples/code-signing/README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# AWS Lambda Code Signing example
2+
3+
Configuration in this directory creates AWS Lambda Function deployed with code signing profile and signed code.
4+
5+
## Usage
6+
7+
To run this example you need to execute:
8+
9+
```bash
10+
$ terraform init
11+
$ terraform plan
12+
$ terraform apply
13+
```
14+
15+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
16+
17+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
18+
## Requirements
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9 |
24+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
25+
26+
## Providers
27+
28+
| Name | Version |
29+
|------|---------|
30+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9 |
31+
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
32+
33+
## Modules
34+
35+
| Name | Source | Version |
36+
|------|--------|---------|
37+
| <a name="module_lambda"></a> [lambda](#module\_lambda) | ../../ | n/a |
38+
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
39+
40+
## Resources
41+
42+
| Name | Type |
43+
|------|------|
44+
| [aws_lambda_code_signing_config.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_code_signing_config) | resource |
45+
| [aws_s3_object.unsigned](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource |
46+
| [aws_signer_signing_job.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/signer_signing_job) | resource |
47+
| [aws_signer_signing_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/signer_signing_profile) | resource |
48+
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
49+
50+
## Inputs
51+
52+
No inputs.
53+
54+
## Outputs
55+
56+
| Name | Description |
57+
|------|-------------|
58+
| <a name="output_lambda_function_arn"></a> [lambda\_function\_arn](#output\_lambda\_function\_arn) | The ARN of the Lambda Function |
59+
| <a name="output_lambda_function_invoke_arn"></a> [lambda\_function\_invoke\_arn](#output\_lambda\_function\_invoke\_arn) | The Invoke ARN of the Lambda Function |
60+
| <a name="output_lambda_function_signing_job_arn"></a> [lambda\_function\_signing\_job\_arn](#output\_lambda\_function\_signing\_job\_arn) | ARN of the signing job |
61+
| <a name="output_lambda_function_signing_profile_version_arn"></a> [lambda\_function\_signing\_profile\_version\_arn](#output\_lambda\_function\_signing\_profile\_version\_arn) | ARN of the signing profile version |
62+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/code-signing/main.tf‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
4+
# Make it faster by skipping something
5+
skip_get_ec2_platforms = true
6+
skip_metadata_api_check = true
7+
skip_region_validation = true
8+
skip_credentials_validation = true
9+
skip_requesting_account_id = true
10+
}
11+
12+
################################################################################
13+
# Lambda Function
14+
################################################################################
15+
16+
module "lambda" {
17+
source = "../../"
18+
19+
function_name = random_pet.this.id
20+
handler = "index.lambda_handler"
21+
runtime = "python3.8"
22+
code_signing_config_arn = aws_lambda_code_signing_config.this.arn
23+
create_package = false
24+
25+
s3_existing_package = {
26+
bucket = aws_signer_signing_job.this.signed_object[0].s3[0].bucket
27+
key = aws_signer_signing_job.this.signed_object[0].s3[0].key
28+
}
29+
}
30+
31+
################################################################################
32+
# Lambda Code Signing
33+
################################################################################
34+
35+
resource "aws_s3_object" "unsigned" {
36+
bucket = module.s3_bucket.s3_bucket_id
37+
key = "unsigned/existing_package.zip"
38+
source = "${path.module}/../fixtures/python3.8-zip/existing_package.zip"
39+
40+
# Making sure that S3 versioning configuration is propagated properly
41+
depends_on = [
42+
module.s3_bucket
43+
]
44+
}
45+
46+
resource "aws_signer_signing_profile" "this" {
47+
platform_id = "AWSLambda-SHA384-ECDSA"
48+
# invalid value for name (must be alphanumeric with max length of 64 characters)
49+
name = replace(random_pet.this.id, "-", "")
50+
51+
signature_validity_period {
52+
value = 3
53+
type = "MONTHS"
54+
}
55+
}
56+
57+
resource "aws_signer_signing_job" "this" {
58+
profile_name = aws_signer_signing_profile.this.name
59+
60+
source {
61+
s3 {
62+
bucket = module.s3_bucket.s3_bucket_id
63+
key = aws_s3_object.unsigned.id
64+
version = aws_s3_object.unsigned.version_id
65+
}
66+
}
67+
68+
destination {
69+
s3 {
70+
bucket = module.s3_bucket.s3_bucket_id
71+
prefix = "signed/"
72+
}
73+
}
74+
75+
ignore_signing_job_failure = true
76+
}
77+
78+
resource "aws_lambda_code_signing_config" "this" {
79+
allowed_publishers {
80+
signing_profile_version_arns = [aws_signer_signing_profile.this.version_arn]
81+
}
82+
83+
policies {
84+
untrusted_artifact_on_deployment = "Enforce"
85+
}
86+
}
87+
88+
################################################################################
89+
# Supporting Resources
90+
################################################################################
91+
92+
resource "random_pet" "this" {
93+
length = 2
94+
}
95+
96+
module "s3_bucket" {
97+
source = "terraform-aws-modules/s3-bucket/aws"
98+
version = "~> 3.0"
99+
100+
bucket_prefix = "${random_pet.this.id}-"
101+
force_destroy = true
102+
103+
# S3 bucket-level Public Access Block configuration
104+
block_public_acls = true
105+
block_public_policy = true
106+
ignore_public_acls = true
107+
restrict_public_buckets = true
108+
109+
versioning = {
110+
enabled = true
111+
}
112+
113+
server_side_encryption_configuration = {
114+
rule = {
115+
apply_server_side_encryption_by_default = {
116+
sse_algorithm = "AES256"
117+
}
118+
}
119+
}
120+
}

‎examples/code-signing/outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "lambda_function_signing_job_arn" {
2+
description = "ARN of the signing job"
3+
value = module.lambda.lambda_function_signing_job_arn
4+
}
5+
6+
output "lambda_function_signing_profile_version_arn" {
7+
description = "ARN of the signing profile version"
8+
value = module.lambda.lambda_function_signing_profile_version_arn
9+
}
10+
11+
output "lambda_function_arn" {
12+
description = "The ARN of the Lambda Function"
13+
value = module.lambda.lambda_function_arn
14+
}
15+
16+
output "lambda_function_invoke_arn" {
17+
description = "The Invoke ARN of the Lambda Function"
18+
value = module.lambda.lambda_function_invoke_arn
19+
}

‎examples/code-signing/variables.tf‎

Whitespace-only changes.

‎examples/code-signing/versions.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 0.13.1"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.9"
8+
}
9+
random = {
10+
source = "hashicorp/random"
11+
version = ">= 2.0"
12+
}
13+
}
14+
}

‎examples/complete/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Note that this example may create resources which cost money. Run `terraform des
4646
| <a name="module_lambda_layer_with_package_deploying_externally"></a> [lambda\_layer\_with\_package\_deploying\_externally](#module\_lambda\_layer\_with\_package\_deploying\_externally) | ../../ | n/a |
4747
| <a name="module_lambda_with_mixed_trusted_entities"></a> [lambda\_with\_mixed\_trusted\_entities](#module\_lambda\_with\_mixed\_trusted\_entities) | ../../ | n/a |
4848
| <a name="module_lambda_with_provisioned_concurrency"></a> [lambda\_with\_provisioned\_concurrency](#module\_lambda\_with\_provisioned\_concurrency) | ../../ | n/a |
49-
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | n/a |
49+
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
5050

5151
## Resources
5252

‎examples/complete/main.tf‎

Lines changed: 42 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -105,36 +105,37 @@ module "lambda_function" {
105105
}
106106

107107
attach_policy_json = true
108-
policy_json = <<EOF
109-
{
110-
"Version": "2012-10-17",
111-
"Statement": [
112-
{
113-
"Effect": "Allow",
114-
"Action": [
115-
"xray:GetSamplingStatisticSummaries"
116-
],
117-
"Resource": ["*"]
118-
}
119-
]
120-
}
121-
EOF
108+
policy_json = <<-EOT
109+
{
110+
"Version": "2012-10-17",
111+
"Statement": [
112+
{
113+
"Effect": "Allow",
114+
"Action": [
115+
"xray:GetSamplingStatisticSummaries"
116+
],
117+
"Resource": ["*"]
118+
}
119+
]
120+
}
121+
EOT
122122

123123
attach_policy_jsons = true
124-
policy_jsons = [<<EOF
125-
{
126-
"Version": "2012-10-17",
127-
"Statement": [
128-
{
129-
"Effect": "Allow",
130-
"Action": [
131-
"xray:*"
132-
],
133-
"Resource": ["*"]
134-
}
135-
]
136-
}
137-
EOF
124+
policy_jsons = [
125+
<<-EOT
126+
{
127+
"Version": "2012-10-17",
128+
"Statement": [
129+
{
130+
"Effect": "Allow",
131+
"Action": [
132+
"xray:*"
133+
],
134+
"Resource": ["*"]
135+
}
136+
]
137+
}
138+
EOT
138139
]
139140
number_of_policy_jsons = 1
140141

@@ -159,10 +160,6 @@ EOF
159160
}
160161
}
161162

162-
###########################
163-
# END: Additional policies
164-
###########################
165-
166163
tags = {
167164
Module = "lambda1"
168165
}
@@ -379,10 +376,21 @@ resource "random_pet" "this" {
379376
}
380377

381378
module "s3_bucket" {
382-
source = "terraform-aws-modules/s3-bucket/aws"
379+
source = "terraform-aws-modules/s3-bucket/aws"
380+
version = "~> 3.0"
383381

384-
bucket = "${random_pet.this.id}-bucket"
382+
bucket_prefix = "${random_pet.this.id}-"
385383
force_destroy = true
384+
385+
# S3 bucket-level Public Access Block configuration
386+
block_public_acls = true
387+
block_public_policy = true
388+
ignore_public_acls = true
389+
restrict_public_buckets = true
390+
391+
versioning = {
392+
enabled = true
393+
}
386394
}
387395

388396
resource "aws_sqs_queue" "dlq" {

‎main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ resource "aws_lambda_function" "this" {
3636
image_uri = var.image_uri
3737
package_type = var.package_type
3838
architectures = var.architectures
39+
code_signing_config_arn = var.code_signing_config_arn
3940

4041
/* ephemeral_storage is not supported in gov-cloud region, so it should be set to `null` */
4142
dynamic "ephemeral_storage" {

0 commit comments

Comments
 (0)