Skip to content

Commit 9652df9

Browse files
tonymillstonymills
authored
Merge pull request #4 from andrewhibbert/feat_eventbridge_schedule_mode
feat: Add support for EventBridge Schedule mode
2 parents e9a7ede + b26c60c commit 9652df9

File tree

24 files changed

+472
-73
lines changed

24 files changed

+472
-73
lines changed

‎examples/cloudtrail/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
external = {
1010
source = "hashicorp/external"
11-
version = ">= 1.0"
11+
version = ">= 2.0"
1212
}
1313
}
1414
}

‎examples/config-rule/versions.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.5.7"
3+
34
required_providers {
45
aws = {
56
source = "hashicorp/aws"
67
version = ">= 6.0"
78
}
8-
archive = {
9-
source = "hashicorp/archive"
10-
version = ">= 2.2"
9+
external = {
10+
source = "hashicorp/external"
11+
version = ">= 2.0"
1112
}
1213
}
1314
}

‎examples/ec2-instance-state/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
external = {
1010
source = "hashicorp/external"
11-
version = ">= 1.0"
11+
version = ">= 2.0"
1212
}
1313
}
1414
}

‎examples/mailer/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
external = {
1010
source = "hashicorp/external"
11-
version = ">= 1.0"
11+
version = ">= 2.0"
1212
}
1313
}
1414
}

‎examples/multi-policies/versions.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,9 @@ terraform {
66
source = "hashicorp/aws"
77
version = ">= 6.0"
88
}
9+
external = {
10+
source = "hashicorp/external"
11+
version = ">= 2.0"
12+
}
913
}
1014
}

‎examples/multi-region/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
external = {
1010
source = "hashicorp/external"
11-
version = ">= 1.0"
11+
version = ">= 2.0"
1212
}
1313
}
1414
}

‎examples/periodic/templates/policy.yaml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ policies:
1515
output_dir: s3://${prefix}periodic-${account_id}/output
1616
cache_dir: s3://${prefix}periodic-${account_id}/cache
1717
cache_period: 15
18-
schedule: cron(0 11 ? * 3 *)
18+
schedule: rate(5 minutes)
1919
role: "${prefix}periodic"
2020
timeout: 300
2121
memory: 256

‎examples/periodic/tfplan‎

-20.2 KB
Binary file not shown.

‎examples/periodic/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
external = {
1010
source = "hashicorp/external"
11-
version = ">= 1.0"
11+
version = ">= 2.0"
1212
}
1313
}
1414
}

‎examples/schedule/main.tf‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
data "aws_caller_identity" "current" {}
2+
3+
locals {
4+
region = "eu-west-1"
5+
account_id = data.aws_caller_identity.current.account_id
6+
prefix = "custodian-dev-"
7+
}
8+
9+
module "cloud_custodian_s3" {
10+
source = "terraform-aws-modules/s3-bucket/aws"
11+
12+
bucket = "${local.prefix}schedule-${local.account_id}"
13+
force_destroy = true
14+
}
15+
16+
resource "aws_iam_role" "custodian" {
17+
name = "${local.prefix}schedule"
18+
assume_role_policy = <<EOF
19+
{
20+
"Version": "2012-10-17",
21+
"Statement": [
22+
{
23+
"Action": "sts:AssumeRole",
24+
"Principal": {
25+
"Service": "lambda.amazonaws.com"
26+
},
27+
"Effect": "Allow",
28+
"Sid": ""
29+
}
30+
]
31+
}
32+
EOF
33+
}
34+
35+
resource "aws_iam_role_policy" "custodian" {
36+
role = aws_iam_role.custodian.id
37+
38+
policy = data.aws_iam_policy_document.custodian.json
39+
}
40+
41+
data "aws_iam_policy_document" "custodian" {
42+
statement {
43+
44+
actions = [
45+
"s3:PutObject",
46+
]
47+
48+
resources = [
49+
"${module.cloud_custodian_s3.s3_bucket_arn}/*",
50+
]
51+
}
52+
53+
statement {
54+
55+
actions = [
56+
"logs:PutLogEvents",
57+
"logs:DescribeLogGroups",
58+
"logs:CreateLogStream",
59+
"logs:CreateLogGroup",
60+
"cloudwatch:PutMetricData",
61+
]
62+
63+
resources = ["*"]
64+
}
65+
66+
statement {
67+
68+
actions = [
69+
"ec2:DescribeImages"
70+
]
71+
72+
resources = ["*"]
73+
}
74+
}
75+
76+
resource "aws_iam_role" "scheduler" {
77+
name = "${local.prefix}scheduler"
78+
assume_role_policy = <<EOF
79+
{
80+
"Version": "2012-10-17",
81+
"Statement": [
82+
{
83+
"Action": "sts:AssumeRole",
84+
"Principal": {
85+
"Service": "scheduler.amazonaws.com"
86+
},
87+
"Effect": "Allow",
88+
"Sid": ""
89+
}
90+
]
91+
}
92+
EOF
93+
}
94+
95+
resource "aws_iam_role_policy" "scheduler" {
96+
role = aws_iam_role.scheduler.id
97+
98+
policy = data.aws_iam_policy_document.scheduler.json
99+
}
100+
101+
data "aws_iam_policy_document" "scheduler" {
102+
statement {
103+
actions = [
104+
"lambda:InvokeFunction",
105+
]
106+
107+
resources = [
108+
"arn:aws:lambda:${local.region}:${local.account_id}:function:${local.prefix}*",
109+
]
110+
}
111+
}
112+
113+
resource "aws_scheduler_schedule_group" "custodian" {
114+
name = "${local.prefix}schedule-group"
115+
}
116+
117+
module "cloud_custodian_lambda" {
118+
source = "../../"
119+
120+
regions = [local.region]
121+
122+
execution_options = {
123+
# Not really required but if you run custodian run you need to specify -s/--output-dir you'd then have execution-options
124+
# as part of the config.json with the output_dir that was specified
125+
"output_dir" = "s3://${local.prefix}schedule-${local.account_id}/output?region=${local.region}"
126+
}
127+
128+
policies = templatefile("${path.module}/templates/policy.yaml.tpl", {
129+
prefix = local.prefix
130+
account_id = local.account_id
131+
})
132+
133+
depends_on = [
134+
module.cloud_custodian_s3,
135+
aws_iam_role.custodian,
136+
aws_iam_role.scheduler,
137+
aws_scheduler_schedule_group.custodian,
138+
]
139+
}

0 commit comments

Comments
 (0)