fix: patch4 module cleanup batch (10106/10107/10109/10110/10111)

lambda-dispatcher/src/lambda_function.py

@@ -7,11 +7,10 @@
 logger = logging.getLogger()
 logger.setLevel(logging.INFO)
 
-# Load the three queue URLs into a hash (dictionary)
+# Load the two queue URLs into a hash (dictionary)
 QUEUE_MAP = {
     1: os.environ.get('TARGET_SQS_QUEUE_LAMBDA_URL'),           # Lambda Workers
     2: os.environ.get('TARGET_SQS_QUEUE_REMOTEEXECUTION_URL'), # Remote Execution
-    3: os.environ.get('TARGET_SQS_QUEUE_AUTOMATIONDOC_URL')    # Automation Documents
 }
 
 # Validate that all queues are configured

lambda.tf

@@ -59,7 +59,6 @@ resource "aws_lambda_function" "dispatcher" {
 
   environment {
     variables = {
-      TARGET_SQS_QUEUE_AUTOMATIONDOC_URL   = "unused"
       TARGET_SQS_QUEUE_LAMBDA_URL          = aws_sqs_queue.dispatch_lambda.url
       TARGET_SQS_QUEUE_REMOTEEXECUTION_URL = aws_sqs_queue.dispatch_remote_execution.url
     }

policies.tf

@@ -20,14 +20,6 @@ data "aws_iam_policy_document" "patch_role_assume" {
       values   = ["${data.aws_organizations_organization.org.id}/*"]
     }
   }
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-    principals {
-      type        = "Service"
-      identifiers = ["lambda.amazonaws.com"]
-    }
-  }
 }
 
 data "aws_iam_policy_document" "patch_execution_role_assume" {
@@ -171,6 +163,12 @@ data "aws_iam_policy_document" "patch_execproxy_role" {
       "arn:${local.partition}:rds-db:${local.region}:${local.account_id}:dbuser:cluster-*/${local.db_user_name}",
     ]
   }
+  statement {
+    sid       = "AssumePatchExecutionRole"
+    effect    = "Allow"
+    actions   = ["sts:AssumeRole"]
+    resources = [module.patch_execution_role.role_arn]
+  }
 }
 
 # ─── IAM Policies ────────────────────────────────────────────────────────────

roles.tf

@@ -1,6 +1,6 @@
 # patch_role — assumed by patch_execution_role to perform EC2 operations in target accounts
 module "patch_role" {
-  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"
+  source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
 
   role_name              = local.patch_role_name
   role_description       = "Assumed by ${local.patch_execution_role_name} to execute patching operations on EC2 instances in target accounts"
@@ -12,7 +12,7 @@ module "patch_role" {
 
 # patch_execution_role — assumed by Lambda functions to orchestrate patching
 module "patch_execution_role" {
-  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"
+  source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
 
   role_name              = local.patch_execution_role_name
   role_description       = "Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume ${local.patch_role_name} in target accounts"
@@ -26,7 +26,7 @@ module "patch_execution_role" {
 # This instance profile is used by the EC2 host running p4proxy to authenticate
 # to RDS via IAM and to assume patch_execution_role for orchestration tasks.
 module "patch_execproxy_role" {
-  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"
+  source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
 
   role_name               = local.patch_execproxy_role_name
   role_description        = "Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of ${local.patch_execution_role_name}"

versions.tf

@@ -9,9 +9,5 @@ terraform {
       source  = "hashicorp/archive"
       version = ">= 2.0"
     }
-    null = {
-      source  = "hashicorp/null"
-      version = ">= 3.0"
-    }
   }
 }