Skip to content

Commit e8e0315

Browse files
hong-yihong-yi
authored
Merge pull request #12 from SPHTech-Platform/add/managed-policies
- add support for aws managed policies - bump module version
2 parents 7b82731 + a9ccbcc commit e8e0315

File tree

3 files changed

+41
-12
lines changed

3 files changed

+41
-12
lines changed

‎README.md‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,23 @@
1-
# Github Actions Lambda Deployment Terraform module
2-
3-
Terraform module for creating skeleton lambda and the github actions oidc AWS IAM role to deploy the lambda code.
4-
5-
<!-- BEGIN_TF_DOCS -->
61
## Requirements
72

83
| Name | Version |
94
|------|---------|
105
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
11-
| <a name="requirement_archive"></a> [archive](#requirement\_archive) | ~> 1.3 |
6+
| <a name="requirement_archive"></a> [archive](#requirement\_archive) | ~> 2.3.0 |
127
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.27 |
138

149
## Providers
1510

1611
| Name | Version |
1712
|------|---------|
18-
| <a name="provider_archive"></a> [archive](#provider\_archive) | ~> 1.3 |
19-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.27 |
13+
| <a name="provider_archive"></a> [archive](#provider\_archive) | 2.3.0 |
14+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.15.0 |
2015

2116
## Modules
2217

2318
| Name | Source | Version |
2419
|------|--------|---------|
25-
| <a name="module_lambda"></a> [lambda](#module\_lambda) | terraform-aws-modules/lambda/aws | ~> 4.14.0 |
20+
| <a name="module_lambda"></a> [lambda](#module\_lambda) | terraform-aws-modules/lambda/aws | ~> 6.0.0 |
2621
| <a name="module_lamda_gha"></a> [lamda\_gha](#module\_lamda\_gha) | philips-labs/github-oidc/aws | ~> 0.7.0 |
2722
| <a name="module_oidc_provider"></a> [oidc\_provider](#module\_oidc\_provider) | philips-labs/github-oidc/aws//modules/provider | ~> 0.7.0 |
2823

@@ -44,8 +39,12 @@ Terraform module for creating skeleton lambda and the github actions oidc AWS IA
4439
| <a name="input_allowed_triggers"></a> [allowed\_triggers](#input\_allowed\_triggers) | Map of allowed triggers to create Lambda permissions | `map(any)` | `{}` | no |
4540
| <a name="input_architectures"></a> [architectures](#input\_architectures) | Instruction set architecture for your Lambda function. Valid values are ["x86\_64"] and ["arm64"]. | `list(string)` | `null` | no |
4641
| <a name="input_attach_network_policy"></a> [attach\_network\_policy](#input\_attach\_network\_policy) | Flag to attach network policy to use VPC subnet and security group | `bool` | `false` | no |
42+
| <a name="input_attach_policies"></a> [attach\_policies](#input\_attach\_policies) | controls whether AWS managed policies should be added to IAM role for Lambda Function (e.g AWSLambdaBasicExecutionRole) | `bool` | `false` | no |
43+
| <a name="input_attach_policy_json"></a> [attach\_policy\_json](#input\_attach\_policy\_json) | Controls whether policy\_json should be added to IAM role for Lambda Function | `bool` | `false` | no |
4744
| <a name="input_attach_policy_jsons"></a> [attach\_policy\_jsons](#input\_attach\_policy\_jsons) | Controls whether policy\_jsons should be added to IAM role for Lambda Function | `bool` | `false` | no |
45+
| <a name="input_attach_policy_statements"></a> [attach\_policy\_statements](#input\_attach\_policy\_statements) | Controls whether policy\_jsons should be added to IAM role for Lambda Function | `bool` | `false` | no |
4846
| <a name="input_authorization_type"></a> [authorization\_type](#input\_authorization\_type) | The type of authentication that the Lambda Function URL uses. Set to 'AWS\_IAM' to restrict access to authenticated IAM users only. Set to 'NONE' to bypass IAM authentication and create a public endpoint. | `string` | `"NONE"` | no |
47+
| <a name="input_cloudwatch_logs_retention_in_days"></a> [cloudwatch\_logs\_retention\_in\_days](#input\_cloudwatch\_logs\_retention\_in\_days) | Number of days the cloudwatch logs will be retained. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `7` | no |
4948
| <a name="input_code_signing_config_arn"></a> [code\_signing\_config\_arn](#input\_code\_signing\_config\_arn) | Amazon Resource Name (ARN) for a Code Signing Configuration | `string` | `null` | no |
5049
| <a name="input_cors"></a> [cors](#input\_cors) | CORS settings to be used by the Lambda Function URL | `any` | `{}` | no |
5150
| <a name="input_create_current_version_allowed_triggers"></a> [create\_current\_version\_allowed\_triggers](#input\_create\_current\_version\_allowed\_triggers) | Whether to allow triggers on current version of Lambda Function (this will revoke permissions from previous version because Terraform manages only current resources) | `bool` | `true` | no |
@@ -60,7 +59,7 @@ Terraform module for creating skeleton lambda and the github actions oidc AWS IA
6059
| <a name="input_ephemeral_storage_size"></a> [ephemeral\_storage\_size](#input\_ephemeral\_storage\_size) | Amount of ephemeral storage (/tmp) in MB your Lambda Function can use at runtime. Valid value between 512 MB to 10,240 MB (10 GB). | `number` | `512` | no |
6160
| <a name="input_function_name"></a> [function\_name](#input\_function\_name) | Lambda Function Name | `string` | n/a | yes |
6261
| <a name="input_function_prefix"></a> [function\_prefix](#input\_function\_prefix) | Prefix for the IAM role for lambda functions | `string` | `""` | no |
63-
| <a name="input_github_repo"></a> [github\_repo](#input\_github\_repo) | GitHub repo to grant access to assume a role via OIDC. | <pre>object({<br> repo = string<br> branches = optional(list(string), [])<br> environments = optional(list(string), [])<br><br> # Custom Role name. It will autocreate based on repo if not provided<br> role_name = optional(string)<br> })</pre> | n/a | yes |
62+
| <a name="input_github_repo"></a> [github\_repo](#input\_github\_repo) | GitHub repo to grant access to assume a role via OIDC. | <pre>object({<br> repo = string<br> branches = optional(list(string), [])<br> environments = optional(list(string), ["*"])<br><br> # Custom Role name. It will autocreate based on repo if not provided<br> role_name = optional(string)<br> })</pre> | n/a | yes |
6463
| <a name="input_handler"></a> [handler](#input\_handler) | Lambda Function Index Handler | `string` | `"index.handler"` | no |
6564
| <a name="input_image_config_command"></a> [image\_config\_command](#input\_image\_config\_command) | The CMD for the docker image | `list(string)` | `[]` | no |
6665
| <a name="input_image_config_entry_point"></a> [image\_config\_entry\_point](#input\_image\_config\_entry\_point) | The ENTRYPOINT for the docker image | `list(string)` | `[]` | no |
@@ -70,8 +69,12 @@ Terraform module for creating skeleton lambda and the github actions oidc AWS IA
7069
| <a name="input_lambda_at_edge"></a> [lambda\_at\_edge](#input\_lambda\_at\_edge) | Set this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the function | `bool` | `false` | no |
7170
| <a name="input_lambda_role"></a> [lambda\_role](#input\_lambda\_role) | IAM role ARN attached to the Lambda Function. This governs both who / what can invoke your Lambda Function, as well as what resources our Lambda Function has access to. See Lambda Permission Model for more details. | `string` | `""` | no |
7271
| <a name="input_layers"></a> [layers](#input\_layers) | List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. | `list(string)` | `null` | no |
72+
| <a name="input_managed_policy_arns"></a> [managed\_policy\_arns](#input\_managed\_policy\_arns) | list of AWS managed policies to attach to IAM role for Lambda Function | `list(string)` | `null` | no |
7373
| <a name="input_memory_size"></a> [memory\_size](#input\_memory\_size) | Amount of memory in MB your Lambda Function can use at runtime. Valid value between 128 MB to 10,240 MB (10 GB), in 64 MB increments. | `number` | `128` | no |
74+
| <a name="input_number_of_managed_policies"></a> [number\_of\_managed\_policies](#input\_number\_of\_managed\_policies) | number of AWS managed policies to attach to IAM role for Lambda Function | `number` | `0` | no |
75+
| <a name="input_number_of_policy_jsons"></a> [number\_of\_policy\_jsons](#input\_number\_of\_policy\_jsons) | Number of policies JSON to attach to IAM role for Lambda Function | `number` | `0` | no |
7476
| <a name="input_package_type"></a> [package\_type](#input\_package\_type) | The Lambda deployment package type. Valid options: Zip or Image | `string` | `"Zip"` | no |
77+
| <a name="input_policy_json"></a> [policy\_json](#input\_policy\_json) | An additional policy document as JSON to attach to the Lambda Function role | `string` | `null` | no |
7578
| <a name="input_policy_jsons"></a> [policy\_jsons](#input\_policy\_jsons) | List of additional policies for the lambda execution | `list(string)` | `[]` | no |
7679
| <a name="input_policy_statements"></a> [policy\_statements](#input\_policy\_statements) | Additional Inline Lambda Policy Statements | `any` | `{}` | no |
7780
| <a name="input_publish"></a> [publish](#input\_publish) | Whether to publish creation/change as new Lambda Function Version. | `bool` | `false` | no |
@@ -88,11 +91,16 @@ Terraform module for creating skeleton lambda and the github actions oidc AWS IA
8891

8992
| Name | Description |
9093
|------|-------------|
94+
| <a name="output_function_url"></a> [function\_url](#output\_function\_url) | The function url of lambda function to be able to be set as cloudfront origin |
95+
| <a name="output_function_url_id"></a> [function\_url\_id](#output\_function\_url\_id) | The function url ID of lambda function to be able to be set as cloudfront origin |
96+
| <a name="output_invoke_arn"></a> [invoke\_arn](#output\_invoke\_arn) | The invoke arn of lambda function for APIGW integration |
9197
| <a name="output_lambda_cloudwatch_log_group_arn"></a> [lambda\_cloudwatch\_log\_group\_arn](#output\_lambda\_cloudwatch\_log\_group\_arn) | Lambda Cloudwatch Log group |
9298
| <a name="output_lambda_cloudwatch_log_group_name"></a> [lambda\_cloudwatch\_log\_group\_name](#output\_lambda\_cloudwatch\_log\_group\_name) | Lambda Cloudwatch Log group |
9399
| <a name="output_lambda_function_arn"></a> [lambda\_function\_arn](#output\_lambda\_function\_arn) | Lambda Function ARN |
94100
| <a name="output_lambda_function_name"></a> [lambda\_function\_name](#output\_lambda\_function\_name) | Lambda Function Name |
101+
| <a name="output_lambda_function_version"></a> [lambda\_function\_version](#output\_lambda\_function\_version) | Latest published version of Lambda Function |
95102
| <a name="output_lambda_role_arn"></a> [lambda\_role\_arn](#output\_lambda\_role\_arn) | ARN of the IAM role created for the Lambda Function |
96103
| <a name="output_lambda_role_name"></a> [lambda\_role\_name](#output\_lambda\_role\_name) | The name of the IAM role created for the Lambda Function |
97104
| <a name="output_lambda_role_unique_id"></a> [lambda\_role\_unique\_id](#output\_lambda\_role\_unique\_id) | The unique id of the IAM role created for the Lambda Function |
98-
<!-- END_TF_DOCS -->
105+
| <a name="output_lamda_gha_role_name"></a> [lamda\_gha\_role\_name](#output\_lamda\_gha\_role\_name) | The crated role that can be assumed for the configured repository. |
106+
| <a name="output_qualified_arn"></a> [qualified\_arn](#output\_qualified\_arn) | The qualified arn of the lambda function to be associated with Cloudfront as a Lambda@Edge function |

‎main.tf‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ data "archive_file" "dummy" {
99

1010
module "lambda" {
1111
source = "terraform-aws-modules/lambda/aws"
12-
version = "~> 4.14.0"
12+
version = "~> 6.0.0"
1313

1414
function_name = var.function_name
1515
description = var.description
@@ -54,16 +54,19 @@ module "lambda" {
5454
attach_policy_jsons = var.attach_policy_jsons
5555
attach_policy_json = var.attach_policy_json
5656
attach_policy_statements = var.attach_policy_statements
57+
attach_policies = var.attach_policies
5758
attach_network_policy = var.attach_network_policy
5859

5960
ignore_source_code_hash = true
6061

6162
# dummy package, package is delegated to CI pipeline
6263
local_existing_package = data.archive_file.dummy.output_path
64+
policies = var.managed_policy_arns
6365
policy_jsons = var.policy_jsons
6466
policy_json = var.policy_json
6567
policy_statements = var.policy_statements
6668
number_of_policy_jsons = var.number_of_policy_jsons
69+
number_of_policies = var.number_of_managed_policies
6770

6871
cloudwatch_logs_retention_in_days = var.cloudwatch_logs_retention_in_days
6972
}

‎variables.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,24 @@ variable "policy_json" {
294294
default = null
295295
}
296296

297+
variable "attach_policies" {
298+
description = "Controls whether AWS managed policies should be added to IAM role for Lambda Function (e.g AWSLambdaBasicExecutionRole)"
299+
type = bool
300+
default = false
301+
}
302+
303+
variable "managed_policy_arns" {
304+
description = "List of AWS managed policies to attach to IAM role for Lambda Function"
305+
type = list(string)
306+
default = null
307+
}
308+
309+
variable "number_of_managed_policies" {
310+
description = "Number of AWS managed policies to attach to IAM role for Lambda Function"
311+
type = number
312+
default = 0
313+
}
314+
297315
##################
298316
# Cloudwatch Logs
299317
##################

0 commit comments

Comments
 (0)