feat: Expose autoscaler VPC config to the root module (#160)

* feat: Expose autoscaler VPC config to the root module

* Add docs

Author: obabec

.spacelift/config.yml

@@ -1,5 +1,5 @@
 version: 2
-module_version: 4.2.0
+module_version: 4.3.0
 
 tests:
   - name: AMD64-based workerpool

README.md

@@ -237,6 +237,8 @@ This module is also available [on the OpenTofu registry](https://search.opentofu
 | `spacelift_api_credentials` | Spacelift API credentials used to authenticate the autoscaler and lifecycle manager with Spacelift. See definition for full details. | `object`<br/>(See definition) | `null` | [variables.tf:304-318](./variables.tf#L304-L318) |
 | `instance_refresh` | If this block is configured, start an Instance Refresh when this Auto Scaling Group is updated | `any`                         | `{}` | [variables.tf:217-221](./variables.tf#L217-L221) |
 | `instance_market_options` | The market (purchasing) option for the instance | `any`                         | `{}` | [variables.tf:223-227](./variables.tf#L223-L227) |
+| `autoscaling_vpc_sg_ids` | Security groups that should be assigned to autoscaling lambda | `null`                         | `[]` | [variables.tf:223-227](./variables.tf#L272-L276) |
+| `autoscaling_vpc_subnets` | Subnets that should be assigned to autoscaling lambda | `null`                         | `[]` | [variables.tf:223-227](./variables.tf#L278-L82) |
 
 ### Self-hosted Configuration
 

autoscaler/autoscaler.tf

@@ -47,10 +47,10 @@ resource "aws_lambda_function" "autoscaler" {
   timeout       = var.autoscaling_configuration.timeout != null ? var.autoscaling_configuration.timeout : 30
 
   dynamic "vpc_config" {
-    for_each = var.subnet_ids != null && var.security_group_ids != null ? ["USE_VPC_CONFIG"] : []
+    for_each = var.spacelift_vpc_subnet_ids != null && var.spacelift_vpc_security_group_ids != null ? ["USE_VPC_CONFIG"] : []
     content {
-      security_group_ids          = var.security_group_ids
-      subnet_ids                  = var.subnet_ids
+      security_group_ids          = var.spacelift_vpc_security_group_ids
+      subnet_ids                  = var.spacelift_vpc_subnet_ids
       ipv6_allowed_for_dual_stack = var.ipv6_allowed_for_dual_stack
     }
   }

autoscaler/iam.tf

@@ -45,6 +45,19 @@ data "aws_iam_policy_document" "autoscaler" {
     resources = ["*"]
   }
 
+  # Allow the Lambda to take actions on NetworkInterfaces
+  statement {
+    effect = "Allow"
+    actions = [
+      "ec2:DescribeNetworkInterfaces",
+      "ec2:CreateNetworkInterface",
+      "ec2:DeleteNetworkInterface",
+      "ec2:DescribeInstances",
+      "ec2:AttachNetworkInterface"
+    ]
+    resources = ["*"]
+  }
+
   # Allow the Lambda to read the secret from SSM Parameter Store.
   statement {
     effect    = "Allow"

autoscaler/variables.tf

@@ -74,13 +74,13 @@ variable "api_key_ssm_parameter_arn" {
   type = string
 }
 
-variable "subnet_ids" {
+variable "spacelift_vpc_subnet_ids" {
   description = "List of subnet IDs when the lambda function should run in a VPC."
   type        = list(string)
   default     = null
 }
 
-variable "security_group_ids" {
+variable "spacelift_vpc_security_group_ids" {
   description = "List of security group IDs when the lambda function should run in a VPC."
   type        = list(string)
   default     = null

examples/autoscaler/main.tf

@@ -49,6 +49,10 @@ module "this" {
   vpc_subnets     = data.aws_subnets.this.ids
   worker_pool_id  = var.worker_pool_id
 
+  # Autoscaler VPC configuration
+  autoscaling_vpc_sg_ids = [data.aws_security_group.this.id]
+  autoscaling_vpc_subnets = data.aws_subnets.this.ids
+
   autoscaling_configuration = {
     max_create          = 5
     max_terminate       = 5

main.tf

@@ -23,18 +23,20 @@ module "autoscaler" {
   count  = local.autoscaling_enabled ? 1 : 0
   source = "./autoscaler"
 
-  additional_tags                = var.additional_tags
-  api_key_ssm_parameter_arn      = local.ssm_arn
-  api_key_ssm_parameter_name     = local.ssm_name
-  auto_scaling_group_arn         = module.asg.autoscaling_group_arn
-  autoscaling_configuration      = var.autoscaling_configuration
-  aws_partition_dns_suffix       = data.aws_partition.current.dns_suffix
-  aws_region                     = data.aws_region.this.name
-  base_name                      = local.base_name
-  cloudwatch_log_group_retention = var.cloudwatch_log_group_retention
-  spacelift_api_credentials      = var.spacelift_api_credentials
-  iam_permissions_boundary       = var.iam_permissions_boundary
-  worker_pool_id                 = var.worker_pool_id
+  additional_tags                  = var.additional_tags
+  api_key_ssm_parameter_arn        = local.ssm_arn
+  api_key_ssm_parameter_name       = local.ssm_name
+  auto_scaling_group_arn           = module.asg.autoscaling_group_arn
+  autoscaling_configuration        = var.autoscaling_configuration
+  aws_partition_dns_suffix         = data.aws_partition.current.dns_suffix
+  aws_region                       = data.aws_region.this.name
+  base_name                        = local.base_name
+  cloudwatch_log_group_retention   = var.cloudwatch_log_group_retention
+  spacelift_api_credentials        = var.spacelift_api_credentials
+  iam_permissions_boundary         = var.iam_permissions_boundary
+  worker_pool_id                   = var.worker_pool_id
+  spacelift_vpc_subnet_ids         = var.autoscaling_vpc_subnets
+  spacelift_vpc_security_group_ids = var.autoscaling_vpc_sg_ids
 }
 
 module "lifecycle_manager" {

variables.tf

@@ -269,6 +269,18 @@ variable "autoscaling_configuration" {
   default = null
 }
 
+variable "autoscaling_vpc_subnets" {
+  description = "List of VPC subnets to use for the autoscaler Lambda function."
+  type        = list(string)
+  default     = null
+}
+
+variable "autoscaling_vpc_sg_ids" {
+  description = "values of the security group to use for the autoscaler Lambda function."
+  type        = list(string)
+  default     = null
+}
+
 variable "selfhosted_configuration" {
   description = <<EOF
   Configuration for selfhosted launcher. Configuration options are:
@@ -321,4 +333,4 @@ variable "cloudwatch_log_group_retention" {
   description = "Retention period for the autoscaler and lifecycle manager cloudwatch log group."
   type        = number
   default     = 7
-}
+}