|
23 | 23 | */ |
24 | 24 |
|
25 | 25 | locals { |
26 | | - deploy_artifact_key = "deploy.zip" |
27 | | - deployment_bucket_id = coalesce(var.deployment_bucket_id, data.aws_ssm_parameter.deployment_bucket_id.value) |
28 | | - source_hash = coalesce(var.git_sha, try(filebase64sha256(var.path), null)) |
29 | | - role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.role_name}" |
| 26 | + description = coalesce(var.description, "Highwing Engine - ${title(var.engine_name)}") |
| 27 | + handler = coalesce(var.handler, "engines/${var.engine_name}/lambda.handler") |
| 28 | + |
| 29 | + environment = data.aws_ssm_parameter.account_name.value |
| 30 | + environment_variables = ( |
| 31 | + startswith(local.environment, "production") |
| 32 | + ? var.environment_variables |
| 33 | + : merge(var.environment_variables, { |
| 34 | + DEV_MODE_ENABLED = true |
| 35 | + }) |
| 36 | + ) |
30 | 37 | } |
31 | 38 |
|
32 | | -# Configure default role permissions |
33 | | -resource "aws_iam_role_policy_attachment" "lambda_basic_execution" { |
34 | | - role = var.role_name |
35 | | - policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" |
36 | | -} |
37 | | - |
38 | | -resource "aws_iam_role_policy_attachment" "lambda_networking" { |
39 | | - role = var.role_name |
40 | | - policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" |
41 | | -} |
42 | | - |
43 | | -resource "aws_iam_role_policy_attachment" "lambda_xray" { |
44 | | - role = var.role_name |
45 | | - policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess" |
46 | | -} |
47 | | - |
48 | | -resource "aws_iam_role_policy_attachment" "lambda_insights" { |
49 | | - role = var.role_name |
50 | | - policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy" |
51 | | -} |
52 | | - |
53 | | -# S3 object to hold the deployed artifact |
54 | | -resource "aws_s3_bucket_object" "lambda_deploy_object" { |
55 | | - count = var.image_uri == null ? 1 : 0 |
56 | | - bucket = local.deployment_bucket_id |
57 | | - key = "${var.name}/${local.deploy_artifact_key}" |
58 | | - source = var.path |
59 | | - source_hash = md5(local.source_hash) |
60 | | - tags = merge(var.tags, { |
61 | | - GitSHA = var.git_sha |
62 | | - }) |
63 | | -} |
64 | | - |
65 | | -# The Lambda function itself |
66 | | -resource "aws_lambda_function" "lambda" { |
67 | | - function_name = var.name |
68 | | - description = var.description |
69 | | - handler = var.handler |
70 | | - layers = var.image_uri == null ? concat( |
71 | | - var.layer_arns, |
72 | | - ["arn:aws:lambda:us-east-1:580247275435:layer:LambdaInsightsExtension:14"] # ARN for us-east-1 |
73 | | - ) : null |
74 | | - memory_size = var.memory_size |
75 | | - publish = true |
76 | | - reserved_concurrent_executions = var.reserved_concurrent_executions |
77 | | - role = local.role_arn |
78 | | - runtime = var.runtime |
79 | | - package_type = var.image_uri == null ? "Zip" : "Image" |
80 | | - s3_bucket = var.image_uri == null ? local.deployment_bucket_id : null |
81 | | - s3_key = var.image_uri == null ? aws_s3_bucket_object.lambda_deploy_object[0].key : null |
82 | | - s3_object_version = var.image_uri == null ? aws_s3_bucket_object.lambda_deploy_object[0].version_id : null |
83 | | - image_uri = var.image_uri |
84 | | - tags = var.tags |
85 | | - timeout = var.timeout |
86 | | - |
87 | | - dynamic "vpc_config" { |
88 | | - for_each = length(var.subnet_ids) > 0 ? [1] : [] |
89 | | - content { |
90 | | - subnet_ids = var.subnet_ids |
91 | | - security_group_ids = var.security_group_ids |
92 | | - } |
93 | | - } |
94 | | - |
95 | | - dynamic "environment" { |
96 | | - for_each = length(var.environment) > 0 ? [1] : [] |
97 | | - content { |
98 | | - variables = var.environment |
99 | | - } |
100 | | - } |
101 | | - |
102 | | - tracing_config { |
103 | | - mode = "Active" |
104 | | - } |
105 | | - |
106 | | - lifecycle { |
107 | | - precondition { |
108 | | - condition = (var.image_uri != null && var.path == null) || (var.image_uri == null && var.path != null) |
109 | | - error_message = "Cannot specify image_uri AND path" |
| 39 | +module "lambda_function" { |
| 40 | + source = "terraform-aws-modules/lambda/aws" |
| 41 | + version = "7.2.6" |
| 42 | + |
| 43 | + function_name = var.function_name |
| 44 | + description = local.description |
| 45 | + handler = local.handler |
| 46 | + memory_size = var.memory_size |
| 47 | + publish = true |
| 48 | + timeout = var.timeout |
| 49 | + |
| 50 | + vpc_subnet_ids = var.subnet_ids |
| 51 | + vpc_security_group_ids = var.security_group_ids |
| 52 | + |
| 53 | + attach_cloudwatch_logs_policy = true |
| 54 | + attach_dead_letter_policy = true |
| 55 | + attach_network_policy = true |
| 56 | + attach_tracing_policy = true |
| 57 | + |
| 58 | + allowed_triggers = var.allowed_triggers |
| 59 | + |
| 60 | + number_of_policies = 2 |
| 61 | + policies = [ |
| 62 | + "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy", |
| 63 | + "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole" |
| 64 | + ] |
| 65 | + attach_policies = true |
| 66 | + |
| 67 | + attach_policy_statements = length(var.policy_statements) > 0 ? true : false |
| 68 | + policy_statements = merge(var.policy_statements, { |
| 69 | + ecr = { |
| 70 | + effect = "Allow" |
| 71 | + actions = [ |
| 72 | + "ecr:BatchGetImage", |
| 73 | + "ecr:GetDownloadUrlForLayer" |
| 74 | + ] |
| 75 | + resources = [var.ecr_arn] |
110 | 76 | } |
111 | | - precondition { |
112 | | - condition = (var.image_uri != null && var.handler == null) || (var.image_uri == null && var.handler != null) |
113 | | - error_message = "Cannot specify image_uri AND handler" |
114 | | - } |
115 | | - precondition { |
116 | | - condition = (var.image_uri != null && length(var.layer_arns) == 0) || (var.image_uri == null) |
117 | | - error_message = "Cannot specify image_uri AND layer_arns" |
118 | | - } |
119 | | - precondition { |
120 | | - condition = (var.image_uri != null && var.path == null) || (var.image_uri == null && var.path != null) |
121 | | - error_message = "Cannot specify image_uri AND path" |
122 | | - } |
123 | | - precondition { |
124 | | - condition = (var.image_uri != null && var.runtime == null) || (var.image_uri == null && var.path != null) |
125 | | - error_message = "Cannot specify image_uri AND runtime" |
126 | | - } |
127 | | - } |
128 | | - |
129 | | -} |
130 | | - |
131 | | -# An alarm to notify of function errors |
132 | | -resource "aws_cloudwatch_metric_alarm" "lambda_errors" { |
133 | | - alarm_actions = [var.notifications_topic_arn] |
134 | | - alarm_description = "This metric monitors the error rate on the ${var.name} lambda" |
135 | | - alarm_name = "${var.name} - High Error Rate" |
136 | | - comparison_operator = "GreaterThanOrEqualToThreshold" |
137 | | - evaluation_periods = "2" |
138 | | - threshold = var.error_rate_alarm_threshold |
139 | | - treat_missing_data = "notBreaching" |
140 | | - |
141 | | - metric_query { |
142 | | - id = "error_rate" |
143 | | - expression = "errors/invocations*100" |
144 | | - label = "Error Rate" |
145 | | - return_data = "true" |
146 | | - } |
147 | | - |
148 | | - metric_query { |
149 | | - id = "errors" |
150 | | - |
151 | | - metric { |
152 | | - metric_name = "Errors" |
153 | | - namespace = "AWS/Lambda" |
154 | | - period = "600" |
155 | | - stat = "Sum" |
156 | | - unit = "Count" |
157 | | - |
158 | | - dimensions = { |
159 | | - FunctionName = aws_lambda_function.lambda.function_name |
160 | | - } |
161 | | - } |
162 | | - } |
| 77 | + }) |
163 | 78 |
|
164 | | - metric_query { |
165 | | - id = "invocations" |
| 79 | + cloudwatch_logs_retention_in_days = 1096 |
| 80 | + dead_letter_target_arn = data.aws_sns_topic.notifications.arn |
| 81 | + kms_key_arn = data.aws_ssm_parameter.kms_key_arn.value |
| 82 | + tracing_mode = "Active" |
166 | 83 |
|
167 | | - metric { |
168 | | - metric_name = "Invocations" |
169 | | - namespace = "AWS/Lambda" |
170 | | - period = "600" |
171 | | - stat = "Sum" |
172 | | - unit = "Count" |
| 84 | + create_package = false |
| 85 | + image_uri = "${var.ecr_address}:lambda_${var.image_tag}" |
| 86 | + package_type = "Image" |
| 87 | + architectures = ["x86_64"] |
173 | 88 |
|
174 | | - dimensions = { |
175 | | - FunctionName = aws_lambda_function.lambda.function_name |
176 | | - } |
177 | | - } |
178 | | - } |
| 89 | + event_source_mapping = var.event_source_mapping |
179 | 90 |
|
180 | | - tags = var.tags |
| 91 | + environment_variables = merge(local.environment_variables, { |
| 92 | + DD_SERVICE = replace(var.function_name, "-", "_") |
| 93 | + }) |
181 | 94 | } |
182 | 95 |
|
183 | | -# Configure logging in Cloudwatch |
184 | | -resource "aws_cloudwatch_log_group" "lambda" { |
185 | | - name = "/aws/lambda/${var.name}" |
186 | | - retention_in_days = var.log_retention_in_days |
187 | | - tags = var.tags |
188 | | -} |
0 commit comments