From 68a0b4740e1aab2c507547ab985c7c1dc436d9c9 Mon Sep 17 00:00:00 2001 From: lian-manonog Date: Tue, 13 Aug 2024 17:16:12 +0100 Subject: wip: running terraform apply to continue fixing terraform infrastructure --- terraform/events.tf | 4 ++-- terraform/iam.tf | 64 ++++++++++++++++++++++++++++------------------------- terraform/lambda.tf | 13 +++++------ terraform/s3.tf | 63 ++++++++++++++++++++++++++++++---------------------- 4 files changed, 79 insertions(+), 65 deletions(-) (limited to 'terraform') diff --git a/terraform/events.tf b/terraform/events.tf index 0196dc3..7a6b0ad 100644 --- a/terraform/events.tf +++ b/terraform/events.tf @@ -50,7 +50,7 @@ resource "aws_s3_bucket_notification" "extract_bucket_notification" { ###### -resource "aws_lambda_permission" "allow_s3_transfrom_bucket" { +resource "aws_lambda_permission" "allow_s3_transform_bucket" { statement_id = "AllowS3InvokeLambdaTransform" action = "lambda:InvokeFunction" function_name = aws_lambda_function.transform_lambda.function_name #replaced lambda name placeholder @@ -67,5 +67,5 @@ resource "aws_s3_bucket_notification" "transform_bucket_notification" { lambda_function_arn = aws_lambda_function.transform_lambda.arn #replaced lambda name placeholder } - depends_on = [aws_lambda_permission.allow_s3_transform] + depends_on = [aws_lambda_permission.allow_s3_transform_bucket] } \ No newline at end of file diff --git a/terraform/iam.tf b/terraform/iam.tf index bb8d932..f34d58a 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -4,7 +4,7 @@ ######################################################################## # DEFINE MULTI-SERVICE ROLE (lambda, s3, cloudwatch, events) -resource "aws_iam_role" "bentley_multi_service_role" { +resource "aws_iam_role" "multi_service_role" { name = "multi_service_role" assume_role_policy = jsonencode({ @@ -16,7 +16,7 @@ resource "aws_iam_role" "bentley_multi_service_role" { Principal = { Service = [ "lambda.amazonaws.com", - "states.amazonaws.com", + "cloudwatch.amazonaws.com", "events.amazonaws.com", "s3.amazonaws.com" ] @@ -27,7 +27,6 @@ resource "aws_iam_role" "bentley_multi_service_role" { } - ######################################################################## # S3 SETUP # Description: allows allows retention/tagging/access control settings @@ -35,32 +34,23 @@ resource "aws_iam_role" "bentley_multi_service_role" { ######################################################################## # S3 DEFINE POLICY -resource "aws_iam_policy" "s3_access_policy" { - name = "s3_access_policy" - path = "/" - description = "IAM policy for S3 access" - - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Effect = "Allow" - Action = [ - "s3:PutObject", - "s3:GetObject", - "s3:ListBucket" - ] - resources = [ - "${aws_s3_bucket.extract_bucket.arn}/*", - "${aws_s3_bucket.transform_bucket.arn}/*", - "${aws_s3_bucket.lambda_bucket.arn}/*" - ] - } - ] - } - ) +data "aws_iam_policy_document" "s3_data_policy_doc" { + statement { + actions = [ + "s3:PutObject", + "s3:PutObjectRetention", + "s3:PutObjectTagging", + "s3:PutObjectAcl" + ] + resources = [ + "${aws_s3_bucket.extract_bucket.arn}/*", + "${aws_s3_bucket.transform_bucket.arn}/*", + "${aws_s3_bucket.lambda_code_bucket.arn}/*", + ] + } } + ######################################################################## # LAMBDA SETUP # Description: Allows Lambda permission to write to Cloudwatch logs @@ -112,6 +102,11 @@ data "aws_iam_policy_document" "cw_document" { } } +resource "aws_iam_policy" "cw_policy" { + name = "cw_policy" + policy = data.aws_iam_policy_document.cw_document.json +} + ######################################################################## # POLICY WRITE & ATTACH ######################################################################## @@ -123,6 +118,15 @@ resource "aws_iam_policy" "s3_write_policy" { # S3 ATTACH POLICY resource "aws_iam_role_policy_attachment" "lambda_s3_policy_attachment" { - role = aws_iam_role.lambda_role.name - policy_arn = aws_iam_policy.s3_write_policy.arn -} \ No newline at end of file + for_each = toset([ + aws_iam_policy.s3_write_policy.arn, + aws_iam_policy.lambda_execution_policy.arn, + aws_iam_policy.cw_policy.arn + ]) + role = aws_iam_role.multi_service_role.name + policy_arn = each.value +} + +################ +# RDS POLICIES # +################ diff --git a/terraform/lambda.tf b/terraform/lambda.tf index 09d6697..bcbf394 100644 --- a/terraform/lambda.tf +++ b/terraform/lambda.tf @@ -7,9 +7,9 @@ data "archive_file" "extract_lambda_zip" { resource "aws_lambda_function" "extract_lambda" { function_name = "${var.extract_lambda_name}" - s3_bucket = aws_s3_bucket.lambda_bucket.bucket + s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket s3_key = "extract_lambda/extract_function.zip" - role = aws_iam_role.PLACEHOLDER_extract_lambda_role.arn # << lambda role placehodler + role = aws_iam_role.multi_service_role.arn #<< lambda role placehodler handler = "extract_lambda.lambda_handler" # << check that the function is called lambda handler runtime = "python3.11" environment { @@ -36,9 +36,9 @@ data "archive_file" "transform_lambda_zip" { resource "aws_lambda_function" "transform_lambda" { function_name = "${var.transform_lambda_name}" - s3_bucket = aws_s3_bucket.lambda_bucket.bucket + s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket s3_key = "transform_lambda/transform_function.zip" - role = aws_iam_role.PLACEHOLDER_transform_lambda_role.arn # << lambda role placehodler + role = aws_iam_role.multi_service_role.arn # << lambda role placehodler handler = "transform_lambda.lambda_handler" # << check that the function is called lambda handler runtime = "python3.11" environment { @@ -55,7 +55,6 @@ resource "aws_lambda_permission" "allow_to_write_to_s3_transform_bucket" { source_arn = aws_s3_bucket.transform_bucket.arn } - ### LOAD LAMBDA SET UP data "archive_file" "load_lambda_zip" { type = "zip" @@ -65,9 +64,9 @@ data "archive_file" "load_lambda_zip" { resource "aws_lambda_function" "load_lambda" { function_name = "${var.load_lambda_name}" - s3_bucket = aws_s3_bucket.lambda_bucket.bucket + s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket s3_key = "load_lambda/load_function.zip" - role = aws_iam_role.PLACEHOLDER_load_lambda_role.arn # << lambda role placehodler + role = aws_iam_role.multi_service_role.arn # << lambda role placehodler handler = "load_lambda.lambda_handler" # << check that the function is called lambda handler runtime = "python3.11" } diff --git a/terraform/s3.tf b/terraform/s3.tf index 8cb65ef..8ab5622 100644 --- a/terraform/s3.tf +++ b/terraform/s3.tf @@ -1,40 +1,51 @@ ### EXTRACT BUCKET SET-UP resource "aws_s3_bucket" "extract_bucket" { - bucket = "${var.s3_extract_bucket_name}" + bucket_prefix = "${var.s3_extract_bucket_name}-" } -resource "aws_s3_object" "extract_lambda_code" { - bucket = aws_s3_bucket.s3_code_bucket_name.bucket - key = "${var.extract_lambda_name}/extract_function.zip" - source = "${path.module}/../extract_function.zip" -} # << can't figure out how this is being used but we seem to need it - -resource "aws_s3_bucket_notification" "extract_bucket_notification" { - bucket = aws_s3_bucket.extract_bucket.id - lambda_function { - lambda_function_arn = aws_lambda_function.extract_lambda.arn - events = ["s3:ObjectCreated:*"] - } - depends_on = [aws_lambda_permission.allow_to_write_to_s3_extract_bucket] -} # << is this the correct permission dependency? - +# resource "aws_s3_bucket_notification" "extract_bucket_notification" { +# bucket = aws_s3_bucket.extract_bucket.id +# lambda_function { +# lambda_function_arn = aws_lambda_function.extract_lambda.arn +# events = ["s3:ObjectCreated:*"] +# } +# depends_on = [aws_lambda_permission.allow_to_write_to_s3_extract_bucket] +# } # << is this the correct permission dependency? ### TRANSFORM BUCKET SET-UP resource "aws_s3_bucket" "transform_bucket" { - bucket = "${var.s3_transform_bucket_name}" + bucket_prefix = "${var.s3_transform_bucket_name}-" } +# resource "aws_s3_bucket_notification" "transform_bucket_notification" { +# bucket = aws_s3_bucket.transform_bucket.id +# lambda_function { +# lambda_function_arn = aws_lambda_function.transform_lambda.arn +# events = ["s3:ObjectCreated:*"] +# } +# depends_on = [aws_lambda_permission.allow_to_write_to_s3_transform_bucket] +# } # << is this the correct permission dependency? + + +### LAMBDA BUCKET +resource "aws_s3_bucket" "lambda_code_bucket" { + bucket_prefix = "${var.s3_code_bucket_name}-" +} + +resource "aws_s3_object" "extract_lambda_code" { + bucket = aws_s3_bucket.lambda_code_bucket.bucket + key = "${var.extract_lambda_name}/extract_function.zip" + source = "${path.module}/../extract_function.zip" +} # << can't figure out how this is being used but we seem to need it + resource "aws_s3_object" "transform_lambda_code" { - bucket = aws_s3_bucket.s3_code_bucket_name.bucket + bucket = aws_s3_bucket.lambda_code_bucket.bucket key = "${var.transform_lambda_name}/transform_function.zip" source = "${path.module}/../transform_function.zip" } # << can't figure out how this is being used but we seem to need it -resource "aws_s3_bucket_notification" "transform_bucket_notification" { - bucket = aws_s3_bucket.transform_bucket.id - lambda_function { - lambda_function_arn = aws_lambda_function.transform_lambda.arn - events = ["s3:ObjectCreated:*"] - } - depends_on = [aws_lambda_permission.allow_to_write_to_s3_transform_bucket] -} # << is this the correct permission dependency? +resource "aws_s3_object" "load_lambda_code" { + bucket = aws_s3_bucket.lambda_code_bucket.bucket + key = "${var.load_lambda_name}/load_function.zip" + source = "${path.module}/../load_function.zip" +} \ No newline at end of file -- cgit v1.2.3 From 9966fcff43cc5e748bc3eb406c270d63fa51ca61 Mon Sep 17 00:00:00 2001 From: lian-manonog Date: Wed, 14 Aug 2024 12:35:25 +0100 Subject: change the s3-key --- terraform/lambda.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'terraform') diff --git a/terraform/lambda.tf b/terraform/lambda.tf index bcbf394..a5da972 100644 --- a/terraform/lambda.tf +++ b/terraform/lambda.tf @@ -8,7 +8,7 @@ data "archive_file" "extract_lambda_zip" { resource "aws_lambda_function" "extract_lambda" { function_name = "${var.extract_lambda_name}" s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket - s3_key = "extract_lambda/extract_function.zip" + s3_key = "extract-lambda/extract_function.zip" role = aws_iam_role.multi_service_role.arn #<< lambda role placehodler handler = "extract_lambda.lambda_handler" # << check that the function is called lambda handler runtime = "python3.11" @@ -37,7 +37,7 @@ data "archive_file" "transform_lambda_zip" { resource "aws_lambda_function" "transform_lambda" { function_name = "${var.transform_lambda_name}" s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket - s3_key = "transform_lambda/transform_function.zip" + s3_key = "transform-lambda/transform_function.zip" role = aws_iam_role.multi_service_role.arn # << lambda role placehodler handler = "transform_lambda.lambda_handler" # << check that the function is called lambda handler runtime = "python3.11" @@ -65,7 +65,7 @@ data "archive_file" "load_lambda_zip" { resource "aws_lambda_function" "load_lambda" { function_name = "${var.load_lambda_name}" s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket - s3_key = "load_lambda/load_function.zip" + s3_key = "load-lambda/load_function.zip" role = aws_iam_role.multi_service_role.arn # << lambda role placehodler handler = "load_lambda.lambda_handler" # << check that the function is called lambda handler runtime = "python3.11" -- cgit v1.2.3 From 6caff95389a6054f8fe1d1c9c23db9a251b6b355 Mon Sep 17 00:00:00 2001 From: lian-manonog Date: Wed, 14 Aug 2024 12:35:59 +0100 Subject: change the name of bucket in backend bucket --- terraform/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'terraform') diff --git a/terraform/main.tf b/terraform/main.tf index 3ca9a3d..2a048b9 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -6,7 +6,7 @@ terraform { } } backend "s3" { - bucket = "bentley-secrets" + bucket = "bentley-project-secrets" key = "bentley-project/terraform.tfstate" region = "eu-west-2" } -- cgit v1.2.3 From 4d52771ceee6841febc6179e0b9608fb35a792d9 Mon Sep 17 00:00:00 2001 From: lian-manonog Date: Wed, 14 Aug 2024 12:36:22 +0100 Subject: change the attachment/policies, individual --- terraform/iam.tf | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) (limited to 'terraform') diff --git a/terraform/iam.tf b/terraform/iam.tf index f34d58a..cf4902a 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -117,14 +117,29 @@ resource "aws_iam_policy" "s3_write_policy" { } # S3 ATTACH POLICY -resource "aws_iam_role_policy_attachment" "lambda_s3_policy_attachment" { - for_each = toset([ - aws_iam_policy.s3_write_policy.arn, - aws_iam_policy.lambda_execution_policy.arn, - aws_iam_policy.cw_policy.arn - ]) - role = aws_iam_role.multi_service_role.name - policy_arn = each.value +# resource "aws_iam_role_policy_attachment" "lambda_s3_policy_attachment" { +# for_each = toset([ +# aws_iam_policy.s3_write_policy.arn, +# aws_iam_policy.lambda_execution_policy.arn, +# aws_iam_policy.cw_policy.arn +# ]) +# role = aws_iam_role.multi_service_role.name +# policy_arn = each.value +# } + +resource "aws_iam_role_policy_attachment" "s3_attachment" { + role = aws_iam_role.multi_service_role.name + policy_arn = aws_iam_policy.s3_write_policy.arn +} + +resource "aws_iam_role_policy_attachment" "lambda_attachment" { + role = aws_iam_role.multi_service_role.name + policy_arn = aws_iam_policy.lambda_execution_policy.arn +} + +resource "aws_iam_role_policy_attachment" "cw_attachment" { + role = aws_iam_role.multi_service_role.name + policy_arn = aws_iam_policy.cw_policy.arn } ################ -- cgit v1.2.3 From f2c0429698edafccb0846a58e4020bf419e7e824 Mon Sep 17 00:00:00 2001 From: lian-manonog Date: Wed, 14 Aug 2024 12:37:31 +0100 Subject: style change --- terraform/events.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'terraform') diff --git a/terraform/events.tf b/terraform/events.tf index 7a6b0ad..6744085 100644 --- a/terraform/events.tf +++ b/terraform/events.tf @@ -4,7 +4,7 @@ resource "aws_cloudwatch_event_rule" "lambda_trigger" { schedule_expression = "rate(30 minutes)" # event_pattern = jsonencode({ -# detail-type = [ +# detail-type = # "AWS Console Sign In via CloudTrail" # ] # }) -- cgit v1.2.3 From 101e1e24cb38b6a45661b723881e2b2d6dd2fb07 Mon Sep 17 00:00:00 2001 From: lian-manonog Date: Wed, 14 Aug 2024 14:35:05 +0100 Subject: wip: terraform debugging --- .gitignore | 5 ++++- src/load_lambda.py | 2 ++ src/transform_lambda.py | 2 ++ terraform/events.tf | 18 ++++++++++-------- terraform/s3.tf | 34 +++++++++++++++++----------------- 5 files changed, 35 insertions(+), 26 deletions(-) (limited to 'terraform') diff --git a/.gitignore b/.gitignore index 239c7e0..d759665 100644 --- a/.gitignore +++ b/.gitignore @@ -3,4 +3,7 @@ *.tfvars *.tfvars.json .terraform.tfstate.lock.info -*.zip \ No newline at end of file +*.zip +.terraform/ +.terraform* +log* \ No newline at end of file diff --git a/src/load_lambda.py b/src/load_lambda.py index e69de29..6ee681f 100644 --- a/src/load_lambda.py +++ b/src/load_lambda.py @@ -0,0 +1,2 @@ +def lambda_handler(): + pass \ No newline at end of file diff --git a/src/transform_lambda.py b/src/transform_lambda.py index e69de29..6ee681f 100644 --- a/src/transform_lambda.py +++ b/src/transform_lambda.py @@ -0,0 +1,2 @@ +def lambda_handler(): + pass \ No newline at end of file diff --git a/terraform/events.tf b/terraform/events.tf index 6744085..9fd89e4 100644 --- a/terraform/events.tf +++ b/terraform/events.tf @@ -1,7 +1,17 @@ +resource "aws_cloudwatch_event_target" "extract_lambda_cw_event" { + rule = aws_cloudwatch_event_rule.lambda_trigger.name + target_id = "TargetFunctionV1" + arn = aws_lambda_function.extract_lambda.arn #replaced lambda name placeholder + force_destroy = true +} + resource "aws_cloudwatch_event_rule" "lambda_trigger" { name = "lambda-scheduled-trigger" description = "Schedule to trigger the Lambda function" schedule_expression = "rate(30 minutes)" + force_destroy = true + # depends_on = [ + # aws_cloudwatch_event_target.extract_lambda_cw_event] # event_pattern = jsonencode({ # detail-type = @@ -10,14 +20,6 @@ resource "aws_cloudwatch_event_rule" "lambda_trigger" { # }) } - -resource "aws_cloudwatch_event_target" "extract_lambda_cw_event" { - rule = aws_cloudwatch_event_rule.lambda_trigger.name - target_id = "TargetFunctionV1" - arn = aws_lambda_function.extract_lambda.arn #replaced lambda name placeholder -} - - resource "aws_lambda_permission" "allow_eventbridge" { statement_id = "AllowExecutionFromEventBridge" action = "lambda:InvokeFunction" diff --git a/terraform/s3.tf b/terraform/s3.tf index 8ab5622..4c06b8e 100644 --- a/terraform/s3.tf +++ b/terraform/s3.tf @@ -32,20 +32,20 @@ resource "aws_s3_bucket" "lambda_code_bucket" { bucket_prefix = "${var.s3_code_bucket_name}-" } -resource "aws_s3_object" "extract_lambda_code" { - bucket = aws_s3_bucket.lambda_code_bucket.bucket - key = "${var.extract_lambda_name}/extract_function.zip" - source = "${path.module}/../extract_function.zip" -} # << can't figure out how this is being used but we seem to need it - -resource "aws_s3_object" "transform_lambda_code" { - bucket = aws_s3_bucket.lambda_code_bucket.bucket - key = "${var.transform_lambda_name}/transform_function.zip" - source = "${path.module}/../transform_function.zip" -} # << can't figure out how this is being used but we seem to need it - -resource "aws_s3_object" "load_lambda_code" { - bucket = aws_s3_bucket.lambda_code_bucket.bucket - key = "${var.load_lambda_name}/load_function.zip" - source = "${path.module}/../load_function.zip" -} \ No newline at end of file +# resource "aws_s3_object" "extract_lambda_code" { +# bucket = aws_s3_bucket.lambda_code_bucket.bucket +# key = "${var.extract_lambda_name}/extract_function.zip" +# source = "${path.module}/../extract_function.zip" +# } # << can't figure out how this is being used but we seem to need it + +# resource "aws_s3_object" "transform_lambda_code" { +# bucket = aws_s3_bucket.lambda_code_bucket.bucket +# key = "${var.transform_lambda_name}/transform_function.zip" +# source = "${path.module}/../transform_function.zip" +# } # << can't figure out how this is being used but we seem to need it + +# resource "aws_s3_object" "load_lambda_code" { +# bucket = aws_s3_bucket.lambda_code_bucket.bucket +# key = "${var.load_lambda_name}/load_function.zip" +# source = "${path.module}/../load_function.zip" +# } \ No newline at end of file -- cgit v1.2.3 From 911b2a4ba08e59f46a53b5252a044a5853796f78 Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Wed, 14 Aug 2024 16:38:36 +0100 Subject: test(tf): attempt to solve ResourceConflictException --- terraform/events.tf | 35 ++++++++--------- terraform/iam.tf | 60 +++++++++++++++++++++-------- terraform/lambda.tf | 109 +++++++++++++++++++++++++--------------------------- terraform/main.tf | 26 ++++++------- terraform/s3.tf | 43 ++------------------- terraform/vars.tf | 26 ++++++------- 6 files changed, 139 insertions(+), 160 deletions(-) (limited to 'terraform') diff --git a/terraform/events.tf b/terraform/events.tf index 9fd89e4..d2e2eb5 100644 --- a/terraform/events.tf +++ b/terraform/events.tf @@ -1,23 +1,18 @@ -resource "aws_cloudwatch_event_target" "extract_lambda_cw_event" { - rule = aws_cloudwatch_event_rule.lambda_trigger.name - target_id = "TargetFunctionV1" - arn = aws_lambda_function.extract_lambda.arn #replaced lambda name placeholder - force_destroy = true -} - resource "aws_cloudwatch_event_rule" "lambda_trigger" { name = "lambda-scheduled-trigger" description = "Schedule to trigger the Lambda function" schedule_expression = "rate(30 minutes)" - force_destroy = true - # depends_on = [ - # aws_cloudwatch_event_target.extract_lambda_cw_event] - -# event_pattern = jsonencode({ -# detail-type = -# "AWS Console Sign In via CloudTrail" -# ] -# }) + + lifecycle { + create_before_destroy = true + } +} + +resource "aws_cloudwatch_event_target" "extract_lambda_cw_event" { + rule = aws_cloudwatch_event_rule.lambda_trigger.name + target_id = "TargetFunctionV1" + arn = aws_lambda_function.extract_lambda.arn #replaced lambda name placeholder + depends_on = [aws_lambda_permission.allow_eventbridge] } resource "aws_lambda_permission" "allow_eventbridge" { @@ -25,7 +20,7 @@ resource "aws_lambda_permission" "allow_eventbridge" { action = "lambda:InvokeFunction" function_name = aws_lambda_function.extract_lambda.function_name #replaced lambda name placeholder principal = "events.amazonaws.com" - source_arn = aws_cloudwatch_event_rule.lambda_trigger.arn + source_arn = aws_cloudwatch_event_rule.lambda_trigger.arn } @@ -43,7 +38,7 @@ resource "aws_s3_bucket_notification" "extract_bucket_notification" { bucket = aws_s3_bucket.extract_bucket.id #replaced bucket name placeholder lambda_function { - events = ["s3:ObjectCreated:*"] + events = ["s3:ObjectCreated:*"] lambda_function_arn = aws_lambda_function.transform_lambda.arn #replaced lambda name placeholder } @@ -65,9 +60,9 @@ resource "aws_s3_bucket_notification" "transform_bucket_notification" { bucket = aws_s3_bucket.transform_bucket.id #replaced bucket name placeholder lambda_function { - events = ["s3:ObjectCreated:*"] + events = ["s3:ObjectCreated:*"] lambda_function_arn = aws_lambda_function.transform_lambda.arn #replaced lambda name placeholder } depends_on = [aws_lambda_permission.allow_s3_transform_bucket] -} \ No newline at end of file +} diff --git a/terraform/iam.tf b/terraform/iam.tf index cf4902a..6c6b4fc 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -16,9 +16,7 @@ resource "aws_iam_role" "multi_service_role" { Principal = { Service = [ "lambda.amazonaws.com", - "cloudwatch.amazonaws.com", - "events.amazonaws.com", - "s3.amazonaws.com" + "scheduler.amazonaws.com" ] } } @@ -57,22 +55,22 @@ data "aws_iam_policy_document" "s3_data_policy_doc" { ######################################################################## resource "aws_iam_policy" "lambda_execution_policy" { - name = "lambda_execution_policy" - path = "/" + name = "lambda_execution_policy" + path = "/" description = "IAM policy for Lambda execution" policy = jsonencode({ Version = "2012-10-17" Statement = [ - { + { Effect = "Allow" Action = [ "lambda:InvokeFunction", "lambda:GetFunction" ] Resource = "*" - } - ] + } + ] } ) } @@ -87,7 +85,7 @@ data "aws_iam_policy_document" "cw_document" { actions = ["logs:CreateLogGroup"] resources = [ "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*" - ] + ] } statement { @@ -95,15 +93,15 @@ data "aws_iam_policy_document" "cw_document" { "logs:CreateLogStream", "logs:CreateLogGroup", "logs:PutLogEvents" - ] - resources = [ - "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/*" - ] + ] + resources = [ + "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/*" + ] } } resource "aws_iam_policy" "cw_policy" { - name = "cw_policy" + name = "cw_policy" policy = data.aws_iam_policy_document.cw_document.json } @@ -128,20 +126,48 @@ resource "aws_iam_policy" "s3_write_policy" { # } resource "aws_iam_role_policy_attachment" "s3_attachment" { - role = aws_iam_role.multi_service_role.name + role = aws_iam_role.multi_service_role.name policy_arn = aws_iam_policy.s3_write_policy.arn } resource "aws_iam_role_policy_attachment" "lambda_attachment" { - role = aws_iam_role.multi_service_role.name + role = aws_iam_role.multi_service_role.name policy_arn = aws_iam_policy.lambda_execution_policy.arn } resource "aws_iam_role_policy_attachment" "cw_attachment" { - role = aws_iam_role.multi_service_role.name + role = aws_iam_role.multi_service_role.name policy_arn = aws_iam_policy.cw_policy.arn } ################ # RDS POLICIES # ################ + +################### +# EVENTS POLICIES # +################### + +data "aws_iam_policy_document" "cloudwatch_events_policy" { + statement { + actions = [ + "events:PutRule", + "events:PutTargets", + "events:RemoveTargets", + "events:DeleteRule", + "events:PutEvents" + ] + resources = ["*"] + effect = "Allow" + } +} + +resource "aws_iam_policy" "cloudwatch_events_policy" { + name = "cloudwatch_events_policy" + policy = data.aws_iam_policy_document.cloudwatch_events_policy.json +} + +resource "aws_iam_role_policy_attachment" "cloudwatch_events_attachment" { + role = aws_iam_role.multi_service_role.name + policy_arn = aws_iam_policy.cloudwatch_events_policy.arn +} diff --git a/terraform/lambda.tf b/terraform/lambda.tf index a5da972..fb0a666 100644 --- a/terraform/lambda.tf +++ b/terraform/lambda.tf @@ -1,73 +1,68 @@ -### EXTRACT LAMBDA SET UP -data "archive_file" "extract_lambda_zip" { - type = "zip" - source_file = "${path.module}/../src/extract_lambda.py" - output_path = "${path.module}/../extract_function.zip" +# Extract Lambda Function +resource "aws_s3_object" "extract_lambda_code" { + bucket = aws_s3_bucket.lambda_code_bucket.bucket + key = "${var.extract_lambda_name}/extract_function.zip" + source = "${path.module}/../extract_function.zip" + etag = filemd5("${path.module}/../extract_function.zip") } resource "aws_lambda_function" "extract_lambda" { - function_name = "${var.extract_lambda_name}" - s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket - s3_key = "extract-lambda/extract_function.zip" - role = aws_iam_role.multi_service_role.arn #<< lambda role placehodler - handler = "extract_lambda.lambda_handler" # << check that the function is called lambda handler - runtime = "python3.11" - environment { - variables = { - output = aws_s3_bucket.extract_bucket.bucket - } - } -} + function_name = var.extract_lambda_name + s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket + s3_key = aws_s3_object.extract_lambda_code.key + role = aws_iam_role.multi_service_role.arn + handler = "extract_lambda.extract" + runtime = "python3.11" -resource "aws_lambda_permission" "allow_to_write_to_s3_extract_bucket" { - action = "lambda:InvokeFunction" - function_name = aws_lambda_function.extract_lambda.function_name - principal = "s3.amazonaws.com" - source_arn = aws_s3_bucket.extract_bucket.arn -} + lifecycle { + create_before_destroy = true + } + depends_on = [aws_s3_object.extract_lambda_code] +} -### TRANSFORM LAMBDA SET UP -data "archive_file" "transform_lambda_zip" { - type = "zip" - source_file = "${path.module}/../src/transform_lambda.py" - output_path = "${path.module}/../transform_function.zip" +# Transform Lambda Function +resource "aws_s3_object" "transform_lambda_code" { + bucket = aws_s3_bucket.lambda_code_bucket.bucket + key = "${var.transform_lambda_name}/transform_function.zip" + source = "${path.module}/../transform_function.zip" + etag = filemd5("${path.module}/../transform_function.zip") } resource "aws_lambda_function" "transform_lambda" { - function_name = "${var.transform_lambda_name}" - s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket - s3_key = "transform-lambda/transform_function.zip" - role = aws_iam_role.multi_service_role.arn # << lambda role placehodler - handler = "transform_lambda.lambda_handler" # << check that the function is called lambda handler - runtime = "python3.11" - environment { - variables = { - output = aws_s3_bucket.transform_bucket.bucket - } - } -} + function_name = var.transform_lambda_name + s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket + s3_key = aws_s3_object.transform_lambda_code.key + role = aws_iam_role.multi_service_role.arn + handler = "transform_lambda.transform" + runtime = "python3.11" -resource "aws_lambda_permission" "allow_to_write_to_s3_transform_bucket" { - action = "lambda:InvokeFunction" - function_name = aws_lambda_function.transform_lambda.function_name - principal = "s3.amazonaws.com" - source_arn = aws_s3_bucket.transform_bucket.arn + lifecycle { + create_before_destroy = true + } + + depends_on = [aws_s3_object.transform_lambda_code] } -### LOAD LAMBDA SET UP -data "archive_file" "load_lambda_zip" { - type = "zip" - source_file = "${path.module}/../src/load_lambda.py" - output_path = "${path.module}/../load_function.zip" +# Load Lambda Function +resource "aws_s3_object" "load_lambda_code" { + bucket = aws_s3_bucket.lambda_code_bucket.bucket + key = "${var.load_lambda_name}/load_function.zip" + source = "${path.module}/../load_function.zip" + etag = filemd5("${path.module}/../load_function.zip") } resource "aws_lambda_function" "load_lambda" { - function_name = "${var.load_lambda_name}" - s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket - s3_key = "load-lambda/load_function.zip" - role = aws_iam_role.multi_service_role.arn # << lambda role placehodler - handler = "load_lambda.lambda_handler" # << check that the function is called lambda handler - runtime = "python3.11" -} + function_name = var.load_lambda_name + s3_bucket = aws_s3_bucket.lambda_code_bucket.bucket + s3_key = aws_s3_object.load_lambda_code.key + role = aws_iam_role.multi_service_role.arn + handler = "load_lambda.load" + runtime = "python3.11" + lifecycle { + create_before_destroy = true + } + + depends_on = [aws_s3_object.load_lambda_code] +} diff --git a/terraform/main.tf b/terraform/main.tf index 2a048b9..3b06701 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -1,26 +1,26 @@ terraform { required_providers { aws = { - source = "hashicorp/aws" - version = "~>5.0" + source = "hashicorp/aws" + version = "~>5.0" } } backend "s3" { bucket = "bentley-project-secrets" - key = "bentley-project/terraform.tfstate" + key = "bentley-project/terraform.tfstate" region = "eu-west-2" } } provider "aws" { - region = "eu-west-2" - default_tags { - tags = { - ProjectName = "Terrific-Totes" - Team = "Team-Bentley" - Environment = "Dev" - GitHubRepo = "de-project-bentley" - ManagedBy = "Terraform" - } + region = "eu-west-2" + default_tags { + tags = { + ProjectName = "Terrific-Totes" + Team = "Team-Bentley" + Environment = "Dev" + GitHubRepo = "de-project-bentley" + ManagedBy = "Terraform" } -} \ No newline at end of file + } +} diff --git a/terraform/s3.tf b/terraform/s3.tf index 4c06b8e..d5cdee3 100644 --- a/terraform/s3.tf +++ b/terraform/s3.tf @@ -1,51 +1,14 @@ ### EXTRACT BUCKET SET-UP resource "aws_s3_bucket" "extract_bucket" { - bucket_prefix = "${var.s3_extract_bucket_name}-" + bucket_prefix = "${var.s3_extract_bucket_name}-" } -# resource "aws_s3_bucket_notification" "extract_bucket_notification" { -# bucket = aws_s3_bucket.extract_bucket.id -# lambda_function { -# lambda_function_arn = aws_lambda_function.extract_lambda.arn -# events = ["s3:ObjectCreated:*"] -# } -# depends_on = [aws_lambda_permission.allow_to_write_to_s3_extract_bucket] -# } # << is this the correct permission dependency? - ### TRANSFORM BUCKET SET-UP resource "aws_s3_bucket" "transform_bucket" { - bucket_prefix = "${var.s3_transform_bucket_name}-" + bucket_prefix = "${var.s3_transform_bucket_name}-" } -# resource "aws_s3_bucket_notification" "transform_bucket_notification" { -# bucket = aws_s3_bucket.transform_bucket.id -# lambda_function { -# lambda_function_arn = aws_lambda_function.transform_lambda.arn -# events = ["s3:ObjectCreated:*"] -# } -# depends_on = [aws_lambda_permission.allow_to_write_to_s3_transform_bucket] -# } # << is this the correct permission dependency? - - ### LAMBDA BUCKET resource "aws_s3_bucket" "lambda_code_bucket" { - bucket_prefix = "${var.s3_code_bucket_name}-" + bucket_prefix = "${var.s3_code_bucket_name}-" } - -# resource "aws_s3_object" "extract_lambda_code" { -# bucket = aws_s3_bucket.lambda_code_bucket.bucket -# key = "${var.extract_lambda_name}/extract_function.zip" -# source = "${path.module}/../extract_function.zip" -# } # << can't figure out how this is being used but we seem to need it - -# resource "aws_s3_object" "transform_lambda_code" { -# bucket = aws_s3_bucket.lambda_code_bucket.bucket -# key = "${var.transform_lambda_name}/transform_function.zip" -# source = "${path.module}/../transform_function.zip" -# } # << can't figure out how this is being used but we seem to need it - -# resource "aws_s3_object" "load_lambda_code" { -# bucket = aws_s3_bucket.lambda_code_bucket.bucket -# key = "${var.load_lambda_name}/load_function.zip" -# source = "${path.module}/../load_function.zip" -# } \ No newline at end of file diff --git a/terraform/vars.tf b/terraform/vars.tf index cc9348a..84824ce 100644 --- a/terraform/vars.tf +++ b/terraform/vars.tf @@ -1,33 +1,33 @@ variable "s3_extract_bucket_name" { - type = string - default = "extract-bucket" + type = string + default = "extract-bucket" } variable "s3_transform_bucket_name" { - type = string - default = "transform-bucket" + type = string + default = "transform-bucket" } variable "s3_code_bucket_name" { - type = string - default = "lambda-bucket" + type = string + default = "lambda-bucket" } variable "extract_lambda_name" { - type = string - default = "extract-lambda" + type = string + default = "extract-lambda" } variable "transform_lambda_name" { - type = string - default = "transform-lambda" + type = string + default = "transform-lambda" } variable "load_lambda_name" { - type = string - default = "load-lambda" + type = string + default = "load-lambda" } data "aws_caller_identity" "current" {} -data "aws_region" "current" {} \ No newline at end of file +data "aws_region" "current" {} -- cgit v1.2.3 From 3f89444cb09f0372b6a7621913944e372acd826c Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Wed, 14 Aug 2024 22:58:50 +0100 Subject: infra(tf): temporarily remove events policies --- terraform/iam.tf | 28 ---------------------------- 1 file changed, 28 deletions(-) (limited to 'terraform') diff --git a/terraform/iam.tf b/terraform/iam.tf index 6c6b4fc..20aeab3 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -143,31 +143,3 @@ resource "aws_iam_role_policy_attachment" "cw_attachment" { ################ # RDS POLICIES # ################ - -################### -# EVENTS POLICIES # -################### - -data "aws_iam_policy_document" "cloudwatch_events_policy" { - statement { - actions = [ - "events:PutRule", - "events:PutTargets", - "events:RemoveTargets", - "events:DeleteRule", - "events:PutEvents" - ] - resources = ["*"] - effect = "Allow" - } -} - -resource "aws_iam_policy" "cloudwatch_events_policy" { - name = "cloudwatch_events_policy" - policy = data.aws_iam_policy_document.cloudwatch_events_policy.json -} - -resource "aws_iam_role_policy_attachment" "cloudwatch_events_attachment" { - role = aws_iam_role.multi_service_role.name - policy_arn = aws_iam_policy.cloudwatch_events_policy.arn -} -- cgit v1.2.3 From 8b975ba92d10c8034bdb35fee19c42b6187ea24f Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Wed, 14 Aug 2024 23:03:14 +0100 Subject: chore(cleanup): remove commented out code --- terraform/iam.tf | 11 ----------- 1 file changed, 11 deletions(-) (limited to 'terraform') diff --git a/terraform/iam.tf b/terraform/iam.tf index 20aeab3..195b07c 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -114,17 +114,6 @@ resource "aws_iam_policy" "s3_write_policy" { policy = data.aws_iam_policy_document.s3_data_policy_doc.json } -# S3 ATTACH POLICY -# resource "aws_iam_role_policy_attachment" "lambda_s3_policy_attachment" { -# for_each = toset([ -# aws_iam_policy.s3_write_policy.arn, -# aws_iam_policy.lambda_execution_policy.arn, -# aws_iam_policy.cw_policy.arn -# ]) -# role = aws_iam_role.multi_service_role.name -# policy_arn = each.value -# } - resource "aws_iam_role_policy_attachment" "s3_attachment" { role = aws_iam_role.multi_service_role.name policy_arn = aws_iam_policy.s3_write_policy.arn -- cgit v1.2.3 From 8ce75bcc1a89000fc0a9fea9b78ad31cd316ca06 Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Wed, 14 Aug 2024 23:04:32 +0100 Subject: chore(cleanup): remove unused rds section --- terraform/iam.tf | 3 --- 1 file changed, 3 deletions(-) (limited to 'terraform') diff --git a/terraform/iam.tf b/terraform/iam.tf index 195b07c..acb98f4 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -129,6 +129,3 @@ resource "aws_iam_role_policy_attachment" "cw_attachment" { policy_arn = aws_iam_policy.cw_policy.arn } -################ -# RDS POLICIES # -################ -- cgit v1.2.3 From c5f840e96b8c1696a6ed506e9260c4f1c26db10d Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Wed, 14 Aug 2024 23:05:26 +0100 Subject: feat(tf): add cloudwatch events iam policies --- terraform/iam.tf | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'terraform') diff --git a/terraform/iam.tf b/terraform/iam.tf index acb98f4..0e5fa6d 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -129,3 +129,30 @@ resource "aws_iam_role_policy_attachment" "cw_attachment" { policy_arn = aws_iam_policy.cw_policy.arn } +################### +# EVENTS POLICIES # +################### + +data "aws_iam_policy_document" "cloudwatch_events_policy" { + statement { + actions = [ + "events:PutRule", + "events:PutTargets", + "events:RemoveTargets", + "events:DeleteRule", + "events:PutEvents" + ] + resources = ["*"] + effect = "Allow" + } +} + +resource "aws_iam_policy" "cloudwatch_events_policy" { + name = "cloudwatch_events_policy" + policy = data.aws_iam_policy_document.cloudwatch_events_policy.json +} + +resource "aws_iam_role_policy_attachment" "cloudwatch_events_attachment" { + role = aws_iam_role.multi_service_role.name + policy_arn = aws_iam_policy.cloudwatch_events_policy.arn +} -- cgit v1.2.3 From d78db8a0f99c778b1e4b401c7cb4a094a5f2b103 Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Thu, 15 Aug 2024 00:24:41 +0100 Subject: fix(infra/tf): add unique id to permissions This was done to resolve issues with `ResourceConflictException` - add random_string resources for every lambda permission to add as suffixes - also add lifecycle options to force recreation whenever the random strings change --- terraform/events.tf | 45 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 34 insertions(+), 11 deletions(-) (limited to 'terraform') diff --git a/terraform/events.tf b/terraform/events.tf index d2e2eb5..263141f 100644 --- a/terraform/events.tf +++ b/terraform/events.tf @@ -1,11 +1,25 @@ +resource "random_string" "eventbridge_suffix" { + length = 8 + special = false + upper = false +} + +resource "random_string" "s3_ingestion_suffix" { + length = 8 + special = false + upper = false +} + +resource "random_string" "s3_transform_suffix" { + length = 8 + special = false + upper = false +} + resource "aws_cloudwatch_event_rule" "lambda_trigger" { name = "lambda-scheduled-trigger" description = "Schedule to trigger the Lambda function" schedule_expression = "rate(30 minutes)" - - lifecycle { - create_before_destroy = true - } } resource "aws_cloudwatch_event_target" "extract_lambda_cw_event" { @@ -16,21 +30,28 @@ resource "aws_cloudwatch_event_target" "extract_lambda_cw_event" { } resource "aws_lambda_permission" "allow_eventbridge" { - statement_id = "AllowExecutionFromEventBridge" + statement_id = "AllowExecutionFromEventBridge${random_string.eventbridge_suffix.result}" action = "lambda:InvokeFunction" - function_name = aws_lambda_function.extract_lambda.function_name #replaced lambda name placeholder + function_name = aws_lambda_function.extract_lambda.function_name principal = "events.amazonaws.com" source_arn = aws_cloudwatch_event_rule.lambda_trigger.arn -} + lifecycle { + replace_triggered_by = [random_string.eventbridge_suffix] + } +} # below is step function 1 resource "aws_lambda_permission" "allow_s3_ingestion" { - statement_id = "AllowS3InvokeLambdaTransform" + statement_id = "AllowS3InvokeLambdaTransform${random_string.s3_ingestion_suffix.result}" action = "lambda:InvokeFunction" function_name = aws_lambda_function.transform_lambda.function_name #replaced lambda name placeholder principal = "s3.amazonaws.com" source_arn = aws_s3_bucket.extract_bucket.arn #replaced bucket name placeholder + + lifecycle { + replace_triggered_by = [random_string.s3_ingestion_suffix] + } } @@ -45,14 +66,16 @@ resource "aws_s3_bucket_notification" "extract_bucket_notification" { depends_on = [aws_lambda_permission.allow_s3_ingestion] } -###### - resource "aws_lambda_permission" "allow_s3_transform_bucket" { - statement_id = "AllowS3InvokeLambdaTransform" + statement_id = "AllowS3InvokeLambdaTransform${random_string.s3_transform_suffix.result}" action = "lambda:InvokeFunction" function_name = aws_lambda_function.transform_lambda.function_name #replaced lambda name placeholder principal = "s3.amazonaws.com" source_arn = aws_s3_bucket.transform_bucket.arn #replaced bucket name placeholder + + lifecycle { + replace_triggered_by = [random_string.s3_transform_suffix] + } } -- cgit v1.2.3 From 79d230f3c76609d32a3d8c553d64f37ce9fe6d09 Mon Sep 17 00:00:00 2001 From: Alex Schofield Date: Thu, 15 Aug 2024 10:15:31 +0100 Subject: fix(tf): create lambda zips before referencing --- terraform/lambda.tf | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) (limited to 'terraform') diff --git a/terraform/lambda.tf b/terraform/lambda.tf index fb0a666..72d1306 100644 --- a/terraform/lambda.tf +++ b/terraform/lambda.tf @@ -1,9 +1,14 @@ # Extract Lambda Function +data "archive_file" "extract_lambda_zip" { + type = "zip" + source_file = "${path.module}/../src/extract_lambda.py" + output_path = "${path.module}/../extract_function.zip" +} resource "aws_s3_object" "extract_lambda_code" { bucket = aws_s3_bucket.lambda_code_bucket.bucket key = "${var.extract_lambda_name}/extract_function.zip" - source = "${path.module}/../extract_function.zip" - etag = filemd5("${path.module}/../extract_function.zip") + source = data.archive_file.extract_lambda_zip.output_path + etag = filemd5(data.archive_file.extract_lambda_zip.output_path) } resource "aws_lambda_function" "extract_lambda" { @@ -22,11 +27,16 @@ resource "aws_lambda_function" "extract_lambda" { } # Transform Lambda Function +data "archive_file" "transform_lambda_zip" { + type = "zip" + source_file = "${path.module}/../src/transform_lambda.py" + output_path = "${path.module}/../transform_function.zip" +} resource "aws_s3_object" "transform_lambda_code" { bucket = aws_s3_bucket.lambda_code_bucket.bucket key = "${var.transform_lambda_name}/transform_function.zip" - source = "${path.module}/../transform_function.zip" - etag = filemd5("${path.module}/../transform_function.zip") + source = data.archive_file.transform_lambda_zip.output_path + etag = filemd5(data.archive_file.transform_lambda_zip.output_path) } resource "aws_lambda_function" "transform_lambda" { @@ -45,11 +55,16 @@ resource "aws_lambda_function" "transform_lambda" { } # Load Lambda Function +data "archive_file" "load_lambda_zip" { + type = "zip" + source_file = "${path.module}/../src/load_lambda.py" + output_path = "${path.module}/../load_function.zip" +} resource "aws_s3_object" "load_lambda_code" { bucket = aws_s3_bucket.lambda_code_bucket.bucket key = "${var.load_lambda_name}/load_function.zip" - source = "${path.module}/../load_function.zip" - etag = filemd5("${path.module}/../load_function.zip") + source = data.archive_file.load_lambda_zip.output_path + etag = filemd5(data.archive_file.load_lambda_zip.output_path) } resource "aws_lambda_function" "load_lambda" { -- cgit v1.2.3