Merge branch 'master' into permission-source-arn

Author: romrell4

main.tf

@@ -1,10 +1,87 @@
-//TODO: maybe move to single repo using github pages
 module "acs" {
-  source = "github.com/byu-oit/terraform-aws-acs-info.git?ref=v1.1.0"
-  env = var.env
+  source = "github.com/byu-oit/terraform-aws-acs-info.git?ref=v2.1.0"
   vpc_vpn_to_campus = true
 }
 
+resource "aws_cloudwatch_log_group" "logs" {
+  name              = "/aws/lambda/${aws_lambda_function.lambda.function_name}"
+  retention_in_days = 14
+}
+
+resource "aws_iam_role" "iam_for_lambda" {
+  name = "${var.app-name}-lambda"
+  permissions_boundary = "arn:aws:iam::${var.account-id}:policy/iamRolePermissionBoundary"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource aws_iam_policy "ec2-network-interface-policy" {
+  name = "${var.app-name}-ec2"
+  description = "A policy to allow create, describe, and delete network interfaces"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+        "Effect": "Allow",
+        "Action": [
+            "ec2:CreateNetworkInterface",
+            "ec2:DescribeNetworkInterfaces",
+            "ec2:DeleteNetworkInterface"
+        ],
+        "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy_attachment" "ec2-network-interface-policy-attachment" {
+  role = aws_iam_role.iam_for_lambda.name
+  policy_arn = aws_iam_policy.ec2-network-interface-policy.arn
+}
+
+resource "aws_iam_policy" "lambda_logging" {
+  name = "${var.app-name}-lambda-logging"
+  description = "IAM policy for logging from a lambda"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "arn:aws:logs:*:*:*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy_attachment" "lambda_logs" {
+  role = aws_iam_role.iam_for_lambda.name
+  policy_arn = aws_iam_policy.lambda_logging.arn
+}
+
 resource "aws_api_gateway_rest_api" "api" {
   name = "${var.app-name}-api"
 }
@@ -33,29 +110,29 @@ resource "aws_api_gateway_integration" "root_method_integration" {
   rest_api_id = aws_api_gateway_rest_api.api.id
   resource_id = aws_api_gateway_rest_api.api.root_resource_id
   http_method = var.root-resource-method
-  integration_http_method = var.root-resource-method
+  integration_http_method = "POST"
   type = "AWS_PROXY"
   uri = aws_lambda_function.lambda.invoke_arn
 }
 
 resource "aws_api_gateway_resource" "resource" {
-  count = length(var.method-paths)
-  path_part = var.method-paths[count.index]
+  count = length(var.methods)
+  path_part = var.methods[count.index].path
   parent_id = aws_api_gateway_rest_api.api.root_resource_id
   rest_api_id = aws_api_gateway_rest_api.api.id
 }
 
 resource "aws_api_gateway_method" "method" {
-  count = length(var.method-paths)
+  count = length(var.methods)
   rest_api_id = aws_api_gateway_rest_api.api.id
   resource_id = aws_api_gateway_resource.resource[count.index].id
-  http_method = var.method-types[count.index]
+  http_method = var.methods[count.index].type
   authorization = var.resource-authorization
   request_parameters = var.resource-request-params
 }
 
 resource "aws_api_gateway_integration" "integration" {
-  count = length(var.method-paths)
+  count = length(var.methods)
   rest_api_id = aws_api_gateway_rest_api.api.id
   resource_id = aws_api_gateway_resource.resource[count.index].id
   http_method = aws_api_gateway_method.method[count.index].http_method
@@ -69,8 +146,8 @@ resource "aws_lambda_permission" "apigw_lambda" {
   action = "lambda:InvokeFunction"
   function_name = aws_lambda_function.lambda.function_name
   principal = "apigateway.amazonaws.com"
-
   source_arn = aws_api_gateway_rest_api.api.execution_arn
+  depends_on    = [aws_iam_role_policy_attachment.lambda_logs, aws_cloudwatch_log_group.logs]
 }
 
 resource "aws_api_gateway_domain_name" "api_domain" {
@@ -100,53 +177,6 @@ resource "aws_route53_record" "a_record" {
   }
 }
 
-resource "aws_iam_role" "iam_for_lambda" {
-  name = "${var.app-name}-lambda"
-  permissions_boundary = "arn:aws:iam::${var.account-id}:policy/iamRolePermissionBoundary"
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "lambda.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-resource aws_iam_policy "ec2-network-interface-policy" {
-  name = "${var.app-name}-ec2"
-  description = "A policy to allow create, describe, and delete network interfaces"
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-        "Effect": "Allow",
-        "Action": [
-            "ec2:CreateNetworkInterface",
-            "ec2:DescribeNetworkInterfaces",
-            "ec2:DeleteNetworkInterface"
-        ],
-        "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy_attachment" "ec2-network-interface-policy-attachment" {
-  role = aws_iam_role.iam_for_lambda.name
-  policy_arn = aws_iam_policy.ec2-network-interface-policy.arn
-}
-
 resource "aws_security_group" "vpc_sec" {
   name = "${var.app-name}-sg"
   description = "${var.app-name}-sg"
@@ -183,8 +213,9 @@ resource aws_lambda_function "lambda" {
   runtime = var.runtime
   timeout = var.timeout
   vpc_config {
-    security_group_ids = [
-      aws_security_group.vpc_sec.id]
+    security_group_ids = concat([
+      aws_security_group.vpc_sec.id,
+    ], var.lambda-security-group-ids)
     subnet_ids = module.acs.private_subnet_ids
   }
   environment {

variables.tf

@@ -42,13 +42,11 @@ variable "account-id" {
   type = string
 }
 
-variable "method-paths" {
-  type = list(string)
-  default = []
-}
-
-variable "method-types" {
-  type = list(string)
+variable "methods" {
+  type = list(object({
+    path = string
+    type = string
+  }))
   default = []
 }
 
@@ -89,3 +87,8 @@ variable "root-resource-authorization" {
 variable "swagger-path" {
   type = string
 }
+
+variable "lambda-security-group-ids" {
+  type = list(string)
+  default = []
+}