reporter-serverless/lambda.tf at master · snacker-tracker/reporter-serverless · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
resource "aws_iam_role" "lambda_execution_role" {
  name = "${var.api_name}-lambda-execution-${terraform.workspace}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action    = "sts:AssumeRole"
        Effect    = "Allow"
        Principal = { Service = "lambda.amazonaws.com" }
      }
    ]
  })
}

resource "aws_iam_role_policy" "lambda_logs" {
  name_prefix = "${var.api_name}-lambda-logs-${terraform.workspace}"
  role        = aws_iam_role.lambda_execution_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource = ["arn:aws:logs:*:*:*"]
      }
    ]
  })
}

resource "aws_iam_role_policy" "lambda_s3" {
  name_prefix = "${var.api_name}-lambda-s3-${terraform.workspace}"
  role        = aws_iam_role.lambda_execution_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:ListBucket"]
        Resource = [aws_s3_bucket.firehose-destination.arn]
      },
      {
        Effect   = "Allow"
        Action   = ["s3:GetObject"]
        Resource = ["${aws_s3_bucket.firehose-destination.arn}/raw/*"]
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject"
        ]
        Resource = ["${aws_s3_bucket.firehose-destination.arn}/bronze/*"]
      }
    ]
  })
}

resource "aws_iam_role_policy" "lambda_sqs" {
  name_prefix = "${var.api_name}-lambda-sqs-${terraform.workspace}"
  role        = aws_iam_role.lambda_execution_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "sqs:ReceiveMessage",
          "sqs:DeleteMessage",
          "sqs:GetQueueAttributes"
        ]
        Resource = [aws_sqs_queue.s3_to_lambda.arn]
      }
    ]
  })
}

resource "aws_lambda_function" "append_to_bronze" {
  function_name = "${var.api_name}-append-to-bronze-${terraform.workspace}"
  role          = aws_iam_role.lambda_execution_role.arn
  package_type  = "Image"
  image_uri     = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${data.aws_region.current.region}.amazonaws.com/snacker-tracker-lambda/append-to-bronze:${var.version_label}-append"
  timeout       = 300
  memory_size   = 1024

  environment {
    variables = {
      BRONZE_BUCKET = aws_s3_bucket.firehose-destination.bucket
    }
  }
}

resource "aws_lambda_function" "rebuild_bronze" {
  function_name = "${var.api_name}-rebuild-bronze-${terraform.workspace}"
  role          = aws_iam_role.lambda_execution_role.arn
  package_type  = "Image"
  image_uri     = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${data.aws_region.current.region}.amazonaws.com/snacker-tracker-lambda/append-to-bronze:${var.version_label}-rebuild"
  timeout       = 900
  memory_size   = 1024

  environment {
    variables = {
      BRONZE_BUCKET = aws_s3_bucket.firehose-destination.bucket
    }
  }
}

resource "aws_lambda_event_source_mapping" "sqs_to_append" {
  event_source_arn = aws_sqs_queue.s3_to_lambda.arn
  function_name    = aws_lambda_function.append_to_bronze.arn
  batch_size       = 1
}