secrethub-kubernetes-mutating-webhook/deploy/aws-lambda/webhook.tf at master · secrethub/secrethub-kubernetes-mutating-webhook · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
data "github_release" "webhook" {
  repository  = "secrethub-kubernetes-mutating-webhook"
  owner       = "secrethub"
  retrieve_by = var.webhook_version == "latest" ? "latest" : "tag"
  release_tag = var.webhook_version == "latest" ? null : "v${var.webhook_version}"
}

locals {
  zip_url = "https://github.com/secrethub/secrethub-kubernetes-mutating-webhook/releases/download/${data.github_release.webhook.release_tag}/secrethub-kubernetes-mutating-webhook-${data.github_release.webhook.release_tag}-lambda.zip"
}

resource "null_resource" "webhook_zip_download" {
  triggers = {
    tag = local.zip_url
  }

  provisioner "local-exec" {
    command = "curl -L -o lambda-webhook.zip ${local.zip_url}"
  }

  provisioner "local-exec" {
    when    = destroy
    command = "rm ./lambda-webhook.zip"
  }
}

resource "aws_lambda_function" "webhook" {
  function_name    = "SecretHubKubernetesWebhook"
  filename         = "lambda-webhook.zip"
  handler          = "lambda-webhook"
  role             = aws_iam_role.iam_for_lambda.arn
  runtime          = "go1.x"
  memory_size      = 128
  timeout          = 10
  depends_on       = [null_resource.webhook_zip_download]
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "SecretHubKubernetesWebhookRole"
  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
  description        = "SecretHub Kubernetes Webhook"
}

data "aws_iam_policy_document" "lambda_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

resource "aws_api_gateway_rest_api" "api" {
  name = "SecretHubKubernetesWebhookAPI"
}

resource "aws_api_gateway_resource" "resource" {
  path_part   = "{proxy+}"
  parent_id   = aws_api_gateway_rest_api.api.root_resource_id
  rest_api_id = aws_api_gateway_rest_api.api.id
}

resource "aws_api_gateway_method" "method" {
  rest_api_id   = aws_api_gateway_rest_api.api.id
  resource_id   = aws_api_gateway_resource.resource.id
  http_method   = "ANY"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "lambda_integration" {
  rest_api_id             = aws_api_gateway_rest_api.api.id
  resource_id             = aws_api_gateway_resource.resource.id
  http_method             = aws_api_gateway_method.method.http_method
  integration_http_method = "POST"
  type                    = "AWS_PROXY"
  uri                     = aws_lambda_function.webhook.invoke_arn
}

resource "aws_api_gateway_method" "proxy_root" {
  rest_api_id   = aws_api_gateway_rest_api.api.id
  resource_id   = aws_api_gateway_rest_api.api.root_resource_id
  http_method   = "ANY"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "lambda_root" {
  rest_api_id = aws_api_gateway_rest_api.api.id
  resource_id = aws_api_gateway_method.proxy_root.resource_id
  http_method = aws_api_gateway_method.proxy_root.http_method

  integration_http_method = "POST"
  type                    = "AWS_PROXY"
  uri                     = aws_lambda_function.webhook.invoke_arn
}

resource "aws_lambda_permission" "apigw_lambda" {
  statement_id  = "AllowExecutionFromAPIGateway"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.webhook.function_name
  principal     = "apigateway.amazonaws.com"

  source_arn = "${aws_api_gateway_rest_api.api.execution_arn}/*/*"
}

resource "aws_api_gateway_deployment" "webhook" {
  depends_on = [
    aws_api_gateway_integration.lambda_integration,
    aws_api_gateway_integration.lambda_root,
  ]

  rest_api_id = aws_api_gateway_rest_api.api.id
  stage_name  = "v1"
}