Skip to content

Commit c28df85

Browse files
tonymillstonymills
authored
Merge pull request #6 from andrewhibbert/fix_scheduler_multi_region
fix: Make schedule policies work in multiple regions
2 parents 9652df9 + f6bf5f3 commit c28df85

File tree

15 files changed

+104
-38
lines changed

15 files changed

+104
-38
lines changed

‎examples/cloudtrail/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ module "cloud_custodian_s3" {
1414
}
1515

1616
resource "aws_iam_role" "custodian" {
17-
name = "${local.prefix}cloudtrail"
17+
name = "${local.prefix}cloudtrail-lambda"
1818
assume_role_policy = <<EOF
1919
{
2020
"Version": "2012-10-17",

‎examples/cloudtrail/templates/policy.yaml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ policies:
1111
output_dir: s3://${prefix}cloudtrail-${account_id}/output
1212
cache_dir: s3://${prefix}cloudtrail-${account_id}/cache
1313
cache_period: 15
14-
role: arn:aws:iam::${account_id}:role/${prefix}cloudtrail
14+
role: arn:aws:iam::${account_id}:role/${prefix}cloudtrail-lambda
1515
events:
1616
- source: ec2.amazonaws.com
1717
event: AuthorizeSecurityGroupIngress

‎examples/config-rule/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ module "cloud_custodian_s3" {
1414
}
1515

1616
resource "aws_iam_role" "custodian" {
17-
name = "${local.prefix}config-rule"
17+
name = "${local.prefix}config-rule-lambda"
1818
assume_role_policy = <<EOF
1919
{
2020
"Version": "2012-10-17",
@@ -124,7 +124,7 @@ module "cloud_custodian_lambda" {
124124
"cache_dir": "s3://${local.prefix}config-rule-${local.account_id}/cache",
125125
"cache_period": 15
126126
},
127-
"role": "arn:aws:iam::${local.account_id}:role/${local.prefix}config-rule"
127+
"role": "arn:aws:iam::${local.account_id}:role/${local.prefix}config-rule-lambda"
128128
},
129129
"resource": "ec2",
130130
"filters": [

‎examples/ec2-instance-state/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ module "cloud_custodian_s3" {
1414
}
1515

1616
resource "aws_iam_role" "custodian" {
17-
name = "${local.prefix}ec2-instance-state"
17+
name = "${local.prefix}ec2-instance-state-lambda"
1818
assume_role_policy = <<EOF
1919
{
2020
"Version": "2012-10-17",
@@ -102,7 +102,7 @@ module "cloud_custodian_lambda" {
102102
"cache_dir": "s3://${local.prefix}ec2-instance-state-${local.account_id}/cache",
103103
"cache_period": 15
104104
},
105-
"role": "arn:aws:iam::${local.account_id}:role/custodian-dev-ec2-instance-state",
105+
"role": "arn:aws:iam::${local.account_id}:role/${local.prefix}ec2-instance-state-lambda",
106106
"events": [
107107
"terminated"
108108
]

‎examples/mailer/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ locals {
66
}
77

88
resource "aws_iam_role" "custodian" {
9-
name = local.lambda_name
9+
name = "${local.lambda_name}-lambda"
1010
assume_role_policy = <<EOF
1111
{
1212
"Version": "2012-10-17",

‎examples/mailer/templates/mailer.yaml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
lambda_name: "${lambda_name}"
33
lambda_schedule: rate(10 minutes)
44
queue_url: https://sqs.us-east-1.amazonaws.com/${account_id}/c7n-mailer-test
5-
role: arn:aws:iam::${account_id}:role/${lambda_name}
5+
role: arn:aws:iam::${account_id}:role/${lambda_name}-lambda
66
slack_token: xoxo-token123
77
region: ${region}

‎examples/multi-policies/main.tf‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ module "cloud_custodian_s3" {
1313
}
1414

1515
resource "aws_iam_role" "custodian" {
16-
name = "${local.prefix}multi-policies"
16+
name = "${local.prefix}multi-policies-lambda"
1717
assume_role_policy = <<EOF
1818
{
1919
"Version": "2012-10-17",
@@ -73,6 +73,43 @@ data "aws_iam_policy_document" "custodian" {
7373
}
7474
}
7575

76+
resource "aws_iam_role" "scheduler" {
77+
name = "${local.prefix}multi-policies-scheduler"
78+
assume_role_policy = <<EOF
79+
{
80+
"Version": "2012-10-17",
81+
"Statement": [
82+
{
83+
"Action": "sts:AssumeRole",
84+
"Principal": {
85+
"Service": "scheduler.amazonaws.com"
86+
},
87+
"Effect": "Allow",
88+
"Sid": ""
89+
}
90+
]
91+
}
92+
EOF
93+
}
94+
95+
resource "aws_iam_role_policy" "scheduler" {
96+
role = aws_iam_role.scheduler.id
97+
98+
policy = data.aws_iam_policy_document.scheduler.json
99+
}
100+
101+
data "aws_iam_policy_document" "scheduler" {
102+
statement {
103+
actions = [
104+
"lambda:InvokeFunction",
105+
]
106+
107+
resources = [
108+
"arn:aws:lambda:*:${local.account_id}:function:${local.prefix}*",
109+
]
110+
}
111+
}
112+
76113
module "custodian_policies" {
77114
source = "../../modules/cloud-custodian-lambda-policies"
78115

@@ -84,6 +121,7 @@ module "custodian_policies" {
84121

85122
depends_on = [
86123
module.cloud_custodian_s3,
87-
aws_iam_role.custodian
124+
aws_iam_role.custodian,
125+
aws_iam_role.scheduler
88126
]
89127
}

‎examples/multi-policies/templates/policies.yaml.tpl‎

Lines changed: 30 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ vars:
66
policies:
77
- name: ami-age
88
mode:
9-
type: periodic
9+
type: schedule
1010
function-prefix: "${prefix}"
1111
execution-options:
1212
metrics_enabled: true
@@ -16,18 +16,16 @@ policies:
1616
cache_dir: s3://${prefix}multi-policies-${account_id}/cache
1717
cache_period: 15
1818
schedule: cron(0 11 ? * 3 *)
19-
role: "${prefix}multi-policies"
20-
timeout: 300
21-
memory: 256
22-
tags:
23-
Test: 'true'
19+
timezone: Europe/London
20+
scheduler-role: ${prefix}multi-policies-scheduler
21+
role: ${prefix}multi-policies-lambda
2422
resource: ami
2523
filters:
2624
- and: *image-age-filters
2725

2826
- name: ec2-ami-age
2927
mode:
30-
type: periodic
28+
type: schedule
3129
function-prefix: "${prefix}"
3230
execution-options:
3331
metrics_enabled: true
@@ -37,12 +35,32 @@ policies:
3735
cache_dir: s3://${prefix}multi-policies-${account_id}/cache
3836
cache_period: 15
3937
schedule: cron(0 11 ? * 3 *)
40-
role: "${prefix}multi-policies"
41-
timeout: 300
42-
memory: 256
43-
tags:
44-
Test: 'true'
38+
timezone: Europe/London
39+
scheduler-role: ${prefix}multi-policies-scheduler
40+
role: ${prefix}multi-policies-lambda
4541
resource: ec2
4642
filters:
4743
- and: *image-age-filters
4844
- "State.Name": "running"
45+
46+
- name: ec2-public-ami
47+
mode:
48+
type: ec2-instance-state
49+
function-prefix: "${prefix}"
50+
execution-options:
51+
metrics_enabled: true
52+
dryrun: false
53+
log_group: "/cloud-custodian/policies"
54+
output_dir: s3://${prefix}multi-policies-${account_id}/output
55+
cache_dir: s3://${prefix}multi-policies-${account_id}/cache
56+
cache_period: 15
57+
role: "${prefix}multi-policies-lambda"
58+
events:
59+
- pending
60+
- running
61+
resource: ec2
62+
filters:
63+
- and:
64+
- type: image
65+
key: Public
66+
value: true

‎examples/multi-region/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ module "cloud_custodian_s3" {
1313
}
1414

1515
resource "aws_iam_role" "custodian" {
16-
name = "${local.prefix}multi-region"
16+
name = "${local.prefix}multi-region-lambda"
1717
assume_role_policy = <<EOF
1818
{
1919
"Version": "2012-10-17",

‎examples/multi-region/templates/policy.yaml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ policies:
1616
cache_dir: s3://${prefix}multi-region-${account_id}/cache
1717
cache_period: 15
1818
schedule: cron(0 11 ? * 3 *)
19-
role: "${prefix}multi-region"
19+
role: "${prefix}multi-region-lambda"
2020
timeout: 300
2121
memory: 256
2222
tags:

0 commit comments

Comments
 (0)