Skip to content

Commit 05d1290

Browse files
npalmnpalm
committed
cleanup, refactor
1 parent 5777e84 commit 05d1290

File tree

10 files changed

+112
-85
lines changed

10 files changed

+112
-85
lines changed

‎main.tf‎

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,6 @@ module "webhook" {
3737
lambda_timeout = var.webhook_lambda_timeout
3838
}
3939

40-
resource "aws_iam_role_policy" "webhook" {
41-
name = "${var.environment}-lambda-webhook-publish-sqs-policy"
42-
role = module.webhook.role.name
43-
44-
policy = templatefile("${path.module}/policies/lambda-publish-sqs-policy.json", {
45-
sqs_resource_arn = aws_sqs_queue.queued_builds.arn
46-
})
47-
}
48-
4940
module "runners" {
5041
source = "./modules/runners"
5142

@@ -58,7 +49,7 @@ module "runners" {
5849
s3_bucket_runner_binaries = module.runner_binaries.bucket
5950
s3_location_runner_binaries = local.s3_action_runner_url
6051

61-
sqs = aws_sqs_queue.queued_builds
52+
sqs_build_queue = aws_sqs_queue.queued_builds
6253
github_app = var.github_app
6354
enable_organization_runners = var.enable_organization_runners
6455
scale_down_schedule_expression = var.scale_down_schedule_expression
@@ -85,20 +76,9 @@ module "runner_binaries" {
8576

8677
resource "aws_resourcegroups_group" "resourcegroups_group" {
8778
name = "${var.environment}-group"
88-
8979
resource_query {
90-
query = <<-JSON
91-
{
92-
"ResourceTypeFilters": [
93-
"AWS::AllSupported"
94-
],
95-
"TagFilters": [
96-
{
97-
"Key": "Environment",
98-
"Values": ["${var.environment}"]
99-
}
100-
]
101-
}
102-
JSON
80+
query = templatefile("${path.module}/templates/resource-group.json", {
81+
environment = var.environment
82+
})
10383
}
10484
}

‎modules/runners/outputs.tf‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,22 @@ output "launch_template" {
22
value = aws_launch_template.runner
33
}
44

5-
output "role" {
5+
output "role_runner" {
66
value = aws_iam_role.runner
77
}
8+
9+
output "lambda_scale_up" {
10+
value = aws_lambda_function.scale_up
11+
}
12+
13+
output "role_scale_up" {
14+
value = aws_iam_role.scale_up
15+
}
16+
17+
output "lambda_scale_down" {
18+
value = aws_lambda_function.scale_down
19+
}
20+
21+
output "role_scale_down" {
22+
value = aws_iam_role.scale_down
23+
}

‎modules/runners/scale-up.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ resource "aws_lambda_function" "scale_up" {
2424
}
2525

2626
resource "aws_lambda_event_source_mapping" "scale_up" {
27-
event_source_arn = var.sqs.arn
27+
event_source_arn = var.sqs_build_queue.arn
2828
function_name = aws_lambda_function.scale_up.arn
2929
}
3030

@@ -33,7 +33,7 @@ resource "aws_lambda_permission" "scale_runners_lambda" {
3333
action = "lambda:InvokeFunction"
3434
function_name = aws_lambda_function.scale_up.function_name
3535
principal = "sqs.amazonaws.com"
36-
source_arn = var.sqs.arn
36+
source_arn = var.sqs_build_queue.arn
3737
}
3838

3939
resource "aws_iam_role" "scale_up" {
@@ -47,6 +47,6 @@ resource "aws_iam_role_policy" "scale_up" {
4747

4848
policy = templatefile("${path.module}/policies/lambda-scale-up.json", {
4949
arn_runner_instance_role = aws_iam_role.runner.arn
50-
sqs_arn = var.sqs.arn
50+
sqs_arn = var.sqs_build_queue.arn
5151
})
5252
}

‎modules/runners/variables.tf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,12 @@ variable "userdata_post_install" {
9292
default = ""
9393
}
9494

95-
variable "sqs" {}
95+
variable "sqs_build_queue" {
96+
description = "SQS queue to consume accepted build events."
97+
type = object({
98+
arn = string
99+
})
100+
}
96101

97102
variable "enable_organization_runners" {
98103
type = bool

‎modules/webhook/main.tf‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -47,53 +47,3 @@ resource "aws_apigatewayv2_integration" "webhook" {
4747
integration_method = "POST"
4848
integration_uri = aws_lambda_function.webhook.invoke_arn
4949
}
50-
51-
resource "aws_lambda_function" "webhook" {
52-
filename = local.lambda_zip
53-
source_code_hash = filebase64sha256(local.lambda_zip)
54-
function_name = "${var.environment}-webhook"
55-
role = aws_iam_role.webhook_lambda.arn
56-
handler = "index.githubWebhook"
57-
runtime = "nodejs12.x"
58-
timeout = var.lambda_timeout
59-
60-
environment {
61-
variables = {
62-
GITHUB_APP_WEBHOOK_SECRET = var.github_app_webhook_secret
63-
SQS_URL_WEBHOOK = var.sqs_build_queue.id
64-
}
65-
}
66-
67-
tags = var.tags
68-
}
69-
70-
resource "aws_lambda_permission" "webhook" {
71-
statement_id = "AllowExecutionFromAPIGateway"
72-
action = "lambda:InvokeFunction"
73-
function_name = aws_lambda_function.webhook.function_name
74-
principal = "apigateway.amazonaws.com"
75-
source_arn = "${aws_apigatewayv2_api.webhook.execution_arn}/*/*/${local.webhook_endpoint}"
76-
}
77-
78-
data "aws_iam_policy_document" "lambda_assume_role_policy" {
79-
statement {
80-
actions = ["sts:AssumeRole"]
81-
82-
principals {
83-
type = "Service"
84-
identifiers = ["lambda.amazonaws.com"]
85-
}
86-
}
87-
}
88-
89-
resource "aws_iam_role" "webhook_lambda" {
90-
name = "${var.environment}-action-webhook-lambda-role"
91-
assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json
92-
tags = var.tags
93-
}
94-
95-
resource "aws_iam_role_policy" "webhook_logging" {
96-
name = "${var.environment}-lamda-logging-policy"
97-
role = aws_iam_role.webhook_lambda.name
98-
policy = templatefile("${path.module}/policies/lambda-cloudwatch.json", {})
99-
}

‎modules/webhook/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,7 @@ output "lambda" {
99
output "role" {
1010
value = aws_iam_role.webhook_lambda
1111
}
12+
13+
output "endpoint_relative_path" {
14+
value = local.webhook_endpoint
15+
}

‎modules/webhook/policies/lambda-publish-sqs-policy.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": ["sqs:SendMessage", "sqs:GetQueueAttributes"],
7+
"Resource": "${sqs_resource_arn}"
8+
}
9+
]
10+
}

‎modules/webhook/variables.tf‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,13 @@ variable "tags" {
1919
}
2020

2121
variable "sqs_build_queue" {
22+
description = "SQS queue to publish accepted build events."
2223
type = object({
23-
id = string
24+
id = string
25+
arn = string
2426
})
2527
}
2628

27-
variable "create_sqs_publish_policy" {
28-
type = bool
29-
default = true
30-
}
31-
3229
variable "lambda_zip" {
3330
description = "File location of the lambda zip file."
3431
type = string

‎modules/webhook/webhook.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
resource "aws_lambda_function" "webhook" {
2+
filename = local.lambda_zip
3+
source_code_hash = filebase64sha256(local.lambda_zip)
4+
function_name = "${var.environment}-webhook"
5+
role = aws_iam_role.webhook_lambda.arn
6+
handler = "index.githubWebhook"
7+
runtime = "nodejs12.x"
8+
timeout = var.lambda_timeout
9+
10+
environment {
11+
variables = {
12+
GITHUB_APP_WEBHOOK_SECRET = var.github_app_webhook_secret
13+
SQS_URL_WEBHOOK = var.sqs_build_queue.id
14+
}
15+
}
16+
17+
tags = var.tags
18+
}
19+
20+
resource "aws_lambda_permission" "webhook" {
21+
statement_id = "AllowExecutionFromAPIGateway"
22+
action = "lambda:InvokeFunction"
23+
function_name = aws_lambda_function.webhook.function_name
24+
principal = "apigateway.amazonaws.com"
25+
source_arn = "${aws_apigatewayv2_api.webhook.execution_arn}/*/*/${local.webhook_endpoint}"
26+
}
27+
28+
data "aws_iam_policy_document" "lambda_assume_role_policy" {
29+
statement {
30+
actions = ["sts:AssumeRole"]
31+
32+
principals {
33+
type = "Service"
34+
identifiers = ["lambda.amazonaws.com"]
35+
}
36+
}
37+
}
38+
39+
resource "aws_iam_role" "webhook_lambda" {
40+
name = "${var.environment}-action-webhook-lambda-role"
41+
assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json
42+
tags = var.tags
43+
}
44+
45+
resource "aws_iam_role_policy" "webhook_logging" {
46+
name = "${var.environment}-lamda-logging-policy"
47+
role = aws_iam_role.webhook_lambda.name
48+
policy = templatefile("${path.module}/policies/lambda-cloudwatch.json", {})
49+
}
50+
51+
resource "aws_iam_role_policy" "webhook_sqs" {
52+
name = "${var.environment}-lambda-webhook-publish-sqs-policy"
53+
role = aws_iam_role.webhook_lambda.name
54+
55+
policy = templatefile("${path.module}/policies/lambda-publish-sqs-policy.json", {
56+
sqs_resource_arn = var.sqs_build_queue.arn
57+
})
58+
}

‎outputs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ output "runners" {
33
launch_template_name = module.runners.launch_template.name
44
launch_template_id = module.runners.launch_template.id
55
launch_template_version = module.runners.launch_template.latest_version
6+
lambda_up = module.runners.lambda_scale_up
7+
lambda_down = module.runners.lambda_scale_down
8+
role_runner = module.runners.role_runner
9+
role_scale_up = module.runners.role_scale_up
10+
role_scale_down = module.runners.role_scale_down
611
}
712
}
813

@@ -19,5 +24,7 @@ output "webhook" {
1924
gateway = module.webhook.gateway
2025
lambda = module.webhook.lambda
2126
lambda_role = module.webhook.role
27+
endpoint = "${module.webhook.gateway.api_endpoint}/${module.webhook.endpoint_relative_path}"
2228
}
2329
}
30+

0 commit comments

Comments
 (0)