deploybot-ecs-tf-module/lambda_iam.tf at main · dayspring-tech/deploybot-ecs-tf-module · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
data "aws_cloudfront_distribution" "distribution" {
  id = var.cloudfront_distribution_id

  // only create if a cloudfront distribution is provided
  count = var.cloudfront_distribution_id != null ? 1 : 0
}

resource "aws_iam_policy" "cloudfront_cache_processing" {
  name        = "${var.app_name}-cloudfront-cache-processing-${var.environment}"
  description = "${var.app_name}-cloudfront-cache-processing-${var.environment}"
  path        = "/service-role/"

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "cloudfront:ListDistributions"
        ],
        "Resource": [
          data.aws_cloudfront_distribution.distribution[0].arn
        ]
      }
    ]
  })

  // only create if a cloudfront distribution is provided
  count = var.cloudfront_distribution_id != null ? 1 : 0
}

resource "aws_iam_role" "deploy_automation" {
  assume_role_policy = jsonencode({
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
        Sid = ""
      },
    ]
    Version = "2012-10-17"
  })
  name = "${var.app_name}_deploy_automation-${var.environment}"
  path = "/service-role/"
}

resource "aws_iam_role_policy_attachment" "deploy_automation_vpc_exec" {
  role       = aws_iam_role.deploy_automation.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}

resource "aws_iam_role_policy_attachment" "deploy_automation_cloudfront" {
  count      = var.cloudfront_distribution_id != null ? 1 : 0
  role       = aws_iam_role.deploy_automation.name
  policy_arn = aws_iam_policy.cloudfront_cache_processing[0].arn
}