-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathmain.tf
83 lines (68 loc) · 1.71 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.0"
}
}
}
module "apigw" {
source = "armorfret/apigw-lambda/aws"
version = "0.9.2"
source_bucket = var.lambda_bucket
source_version = var.lambda_version
function_name = "madlibrarian_${var.data_bucket}"
environment_variables = {
S3_BUCKET = var.config_bucket
S3_KEY = "config.yaml"
}
stage_variables = {
bucket = var.data_bucket
}
access_policy_document = data.aws_iam_policy_document.lambda_perms.json
hostname = var.hostname
cloudwatch_retention_in_days = var.cloudwatch_retention_in_days
}
module "publish_user" {
source = "armorfret/s3-publish/aws"
version = "0.8.1"
logging_bucket = var.logging_bucket
publish_bucket = var.data_bucket
}
module "config_user" {
source = "armorfret/s3-publish/aws"
version = "0.8.1"
logging_bucket = var.logging_bucket
publish_bucket = var.config_bucket
count = var.config_bucket == var.data_bucket ? 0 : 1
}
data "aws_iam_policy_document" "lambda_perms" {
statement {
actions = [
"s3:ListBucket",
"s3:GetObject",
]
resources = distinct([
"arn:aws:s3:::${var.data_bucket}/*",
"arn:aws:s3:::${var.data_bucket}",
"arn:aws:s3:::${var.config_bucket}/*",
"arn:aws:s3:::${var.config_bucket}",
])
}
statement {
actions = [
"logs:CreateLogStream",
]
resources = [
"arn:aws:logs:*:*:log-group:/aws/lambda/madlibrarian_${var.data_bucket}",
]
}
statement {
actions = [
"logs:PutLogEvents",
]
resources = [
"arn:aws:logs:*:*:log-group:/aws/lambda/madlibrarian_${var.data_bucket}:*",
]
}
}