-
Notifications
You must be signed in to change notification settings - Fork 0
/
lambda.tf
88 lines (82 loc) · 2.59 KB
/
lambda.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
resource "aws_lambda_function" "VisitorCounter" {
function_name = "VisitorCounter"
role = aws_iam_role.MyLambdaRole.arn
runtime = "python3.7"
handler = "dynamodb.lambda_handler"
# filename = data.archive_file.zip.output_path
# source_code_hash = data.archive_file.zip.output_base64sha256
s3_bucket = data.aws_s3_bucket_object.lambda.bucket
s3_key = data.aws_s3_bucket_object.lambda.key
s3_object_version = data.aws_s3_bucket_object.lambda.version_id
}
data "aws_s3_bucket_object" "lambda" {
bucket = "terraform-lambda-payload"
key = "lambda_payload.zip"
}
resource "aws_iam_role" "MyLambdaRole" {
name = "MyLambdaRole"
assume_role_policy = <<EOF
{
"Version" : "2012-10-17",
"Statement" : [
{
"Action" : "sts:AssumeRole",
"Effect" : "Allow",
"Principal" : {
"Service" : "lambda.amazonaws.com"
}
}
]
}
EOF
}
resource "aws_iam_policy" "MyLambdaPolicy" {
# arn = "arn:aws:iam::319523825307:policy/MyLambdaPolicy"
# id = "arn:aws:iam::319523825307:policy/MyLambdaPolicy"
name = "MyLambdaPolicy"
path = "/"
policy = jsonencode(
{
Statement = [
{
Action = [
"dynamodb:BatchGetItem",
"dynamodb:GetItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:BatchWriteItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
]
Effect = "Allow"
Resource = "arn:aws:dynamodb:ap-southeast-2:319523825307:table/MyTable"
},
{
Action = [
"logs:CreateLogStream",
"logs:PutLogEvents",
]
Effect = "Allow"
Resource = "arn:aws:logs:eu-west-1:123456789012:*"
},
{
Action = "logs:CreateLogGroup"
Effect = "Allow"
Resource = "*"
},
]
Version = "2012-10-17"
}
)
}
resource "aws_iam_role_policy_attachment" "Role_Policy_Attachment" {
role = aws_iam_role.MyLambdaRole.name
policy_arn = aws_iam_policy.MyLambdaPolicy.arn
}
resource "aws_lambda_permission" "Lambda_APIGW" {
statement_id = "AllowAPIGatewayInvocation"
action = "lambda:InvokeFunction"
function_name = aws_lambda_function.VisitorCounter.arn
principal = "apigateway.amazonaws.com"
source_arn = "${aws_apigatewayv2_api.VisitorCounterAPI.execution_arn}/*/*/${aws_lambda_function.VisitorCounter.function_name}"
}