|
1 | 1 | # main.tf for post-deploy-mods |
2 | 2 |
|
3 | | -# Define the Lambda Function |
4 | | -resource "aws_lambda_function" "pre_filter_DistApiEndpoints" { |
5 | | - # function_name = "ks-test-pre-filter-DistributionApiEndpoints" |
6 | | - function_name = "${var.prefix}-pre-filter-DistApiEndpoints" |
7 | | - filename = "${path.module}/resources/lambdas/pre-filter-DistributionApiEndpoints/distro/lambda.zip" |
8 | | - role = aws_iam_role.lambda_exec_pre_filter_DistApiEndpoints.arn |
9 | | - handler = "lambda_function.lambda_handler" #"index.preFilterDistApiEndpoints" |
10 | | - runtime = "python3.10" #local.lambda_runtime |
11 | | - timeout = 300 |
12 | | - memory_size = 3008 |
13 | | - |
14 | | - source_code_hash = filebase64sha256("${path.module}/resources/lambdas/pre-filter-DistributionApiEndpoints/distro/lambda.zip") |
15 | | - |
16 | | - lifecycle { |
17 | | - create_before_destroy = true |
18 | | - prevent_destroy = true |
19 | | - } |
20 | | -} |
21 | | - |
22 | | -# Define the Execution Role and Policy |
23 | | -resource "aws_iam_role" "lambda_exec_pre_filter_DistApiEndpoints" { |
24 | | - #name = "lambda_exec_role_pre_filter_DistributionApiEndpoints" |
25 | | - name = "${var.prefix}-lamb_exe_role_pf_DistApiEndpoints" # Must be 64 chars or less |
26 | | - |
27 | | - assume_role_policy = jsonencode({ |
28 | | - Version = "2012-10-17" |
29 | | - Statement = [ |
30 | | - { |
31 | | - Action = "sts:AssumeRole" |
32 | | - Effect = "Allow" |
33 | | - Sid = "" |
34 | | - Principal = { |
35 | | - Service = "lambda.amazonaws.com" |
36 | | - } |
37 | | - }, |
38 | | - ] |
39 | | - }) |
40 | | - |
41 | | - # lifecycle { |
42 | | - # prevent_destroy = true |
43 | | - # } |
44 | | -} |
45 | | - |
46 | | -# Define an attachment to the aws_iam_role above |
47 | | -resource "aws_iam_role_policy_attachment" "lambda_exec_policy" { |
48 | | - role = aws_iam_role.lambda_exec_pre_filter_DistApiEndpoints.name |
49 | | - policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" |
50 | | -} |
51 | | - |
52 | | -# Define another policy attachment to allow invoking of another lambda |
53 | | -resource "aws_iam_policy" "lambda_invoke_policy" { |
54 | | - #name = "lambda_invoke_policy" |
55 | | - name = "${var.prefix}-lambda_pf_invoke_policy" |
56 | | - description = "Policy to allow Lambda functions to invoke other Lambda functions" |
57 | | - policy = jsonencode({ |
58 | | - Version = "2012-10-17" |
59 | | - Statement = [ |
60 | | - { |
61 | | - Effect = "Allow" |
62 | | - Action = [ |
63 | | - "lambda:InvokeFunction" |
64 | | - ] |
65 | | - Resource = "*" |
66 | | - } |
67 | | - ] |
68 | | - }) |
69 | | -} |
70 | | - |
71 | | -# Attach the Policy, which allows a Lambda to be Invoked, to the Lambda Role |
72 | | -resource "aws_iam_role_policy_attachment" "lambda_invoke_policy_attachment" { |
73 | | - role = aws_iam_role.lambda_exec_pre_filter_DistApiEndpoints.name |
74 | | - policy_arn = aws_iam_policy.lambda_invoke_policy.arn |
75 | | -} |
76 | | - |
77 | | -# Attach an AWS managed Policy for DynamoDB Read Only access |
78 | | -resource "aws_iam_role_policy_attachment" "dynamodb_readonly_policy" { |
79 | | - role = aws_iam_role.lambda_exec_pre_filter_DistApiEndpoints.name |
80 | | - policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess" |
81 | | -} |
82 | | - |
83 | | -# Fetch existing API Gateway |
84 | | -data "aws_api_gateway_rest_api" "distribution_api" { |
85 | | - name = "${var.prefix}-distribution" # Example "cumulus-uat-distribution" |
86 | | -} |
87 | | - |
88 | | -# Fetch the proxy resource (API Gateway "/{proxy+}" prop) |
89 | | -data "aws_api_gateway_resource" "proxy_resource" { |
90 | | - rest_api_id = data.aws_api_gateway_rest_api.distribution_api.id |
91 | | - path = "/{proxy+}" |
92 | | -} |
93 | | - |
94 | | -# No need to update the root resource |
95 | | -# The way this is all set up, we only want to override where the file is downloaded |
96 | | -# That happens only when the proxy is invoked |
97 | | -# |
98 | | -# # If we need to update the root resource than, uncomment this code |
99 | | -# Fetch the root resource (API Gateway "/" prop) |
100 | | -# |
101 | | -#data "aws_api_gateway_resource" "root_resource" { |
102 | | -# rest_api_id = data.aws_api_gateway_rest_api.distribution_api.id |
103 | | -# path = "/" |
104 | | -#} |
105 | | -# |
106 | | -# |
107 | | -## Update the integration for the root resource with GET method |
108 | | -#resource "aws_api_gateway_integration" "root_lambda_integration" { |
109 | | -# rest_api_id = data.aws_api_gateway_rest_api.distribution_api.id |
110 | | -# resource_id = data.aws_api_gateway_resource.root_resource.id |
111 | | -# http_method = "GET" |
112 | | -# integration_http_method = "POST" #"GET" |
113 | | -# type = "AWS_PROXY" |
114 | | -# uri = aws_lambda_function.pre_filter_DistApiEndpoints.invoke_arn |
115 | | -#} |
116 | | - |
117 | | -# Update the integration for the root resource with GET method |
118 | | -resource "aws_api_gateway_integration" "proxy_lambda_integration" { |
119 | | - rest_api_id = data.aws_api_gateway_rest_api.distribution_api.id |
120 | | - resource_id = data.aws_api_gateway_resource.proxy_resource.id |
121 | | - http_method = "ANY" |
122 | | - integration_http_method = "POST" #"GET" |
123 | | - type = "AWS_PROXY" |
124 | | - uri = aws_lambda_function.pre_filter_DistApiEndpoints.invoke_arn |
125 | | -} |
126 | | - |
127 | | -# Ensure the Lambda function as the necessary permissions to be invoked by API Gateway |
128 | | -resource "aws_lambda_permission" "api_gateway" { |
129 | | - statement_id = "AllowAPIGatewayInvoke" |
130 | | - action = "lambda:InvokeFunction" |
131 | | - function_name = aws_lambda_function.pre_filter_DistApiEndpoints.function_name |
132 | | - principal = "apigateway.amazonaws.com" |
133 | | - source_arn = "${data.aws_api_gateway_rest_api.distribution_api.execution_arn}/*/*" |
134 | | -} |
135 | | - |
136 | | -# Ensure the API Gateway redeploys after the update |
137 | | -resource "aws_api_gateway_deployment" "api_deployment" { |
138 | | - depends_on = [aws_api_gateway_integration.proxy_lambda_integration] |
139 | | - |
140 | | - rest_api_id = data.aws_api_gateway_rest_api.distribution_api.id |
141 | | - stage_name = "dev" # The existing cumulus deployment for this API Gateway Stage is always called dev (in all environments) |
142 | | - |
143 | | - triggers = { |
144 | | - redeployment = sha1(jsonencode({ |
145 | | - lambda_version = aws_lambda_function.pre_filter_DistApiEndpoints.source_code_hash |
146 | | - integration_uri = aws_api_gateway_integration.proxy_lambda_integration.uri |
147 | | - })) |
148 | | - } |
149 | | -} |
| 3 | +# Temp Disable this stack -- Copy contents of file: main__tf_Working.txt back in here to reinstate |
0 commit comments