Skip to content

Commit

Permalink
style: replace string interpolation with format() org-wide convention
Browse files Browse the repository at this point in the history 
- locals.tf: all resource/log group name expressions
- lambda.tf: path.module archive sources and layer source_path
- sqs.tf: policy_id fields and owner ARN identifiers
- policies.tf: all ARN constructions (iam, lambda, logs, rds-db) and org path
- roles.tf: module source git@ format + role_description strings

Also corrects roles.tf module sources from git::https:// to git@ per
terraform-support naming convention.
  • Loading branch information
Dave Arnold committed Jul 8, 2026
1 parent 78f3ea2 commit 74ed0ef
Show file tree
Hide file tree
Showing 5 changed files with 48 additions and 48 deletions.
14 changes: 7 additions & 7 deletions lambda.tf
View file
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
data "archive_file" "dispatcher" {
type = "zip"
source_dir = "${path.module}/lambda-dispatcher"
output_path = "${path.module}/builds/dispatcher.zip"
source_dir = format("%v/lambda-dispatcher", path.module)
output_path = format("%v/builds/dispatcher.zip", path.module)
}

data "archive_file" "step_result" {
type = "zip"
source_dir = "${path.module}/lambda-step-result"
output_path = "${path.module}/builds/step-result.zip"
source_dir = format("%v/lambda-step-result", path.module)
output_path = format("%v/builds/step-result.zip", path.module)
}

data "archive_file" "worker" {
type = "zip"
source_dir = "${path.module}/lambda-worker"
output_path = "${path.module}/builds/worker.zip"
source_dir = format("%v/lambda-worker", path.module)
output_path = format("%v/builds/worker.zip", path.module)
}

module "lambda_layer" {
Expand All @@ -30,7 +30,7 @@ module "lambda_layer" {

source_path = [
{
path = "${path.module}/lambda-layer"
path = format("%v/lambda-layer", path.module)
pip_requirements = true
prefix_in_zip = "python"
}
Expand Down
38 changes: 19 additions & 19 deletions locals.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,33 +8,33 @@ locals {
tags_iam = merge(module.tags.tags, module.tags.finops_roles["iam"])

# ─── Resource Names ─────────────────────────────────────────────────────────
lambda_dispatcher_name = "${var.name_prefix}-dispatcher"
lambda_step_result_name = "${var.name_prefix}-step-result"
lambda_worker_name = "${var.name_prefix}-worker-lambda"
lambda_layer_name = "${var.name_prefix}-layer-v1"
lambda_dispatcher_name = format("%v-dispatcher", var.name_prefix)
lambda_step_result_name = format("%v-step-result", var.name_prefix)
lambda_worker_name = format("%v-worker-lambda", var.name_prefix)
lambda_layer_name = format("%v-layer-v1", var.name_prefix)

sqs_dispatch_lambda_name = "${var.name_prefix}-dispatch-lambda"
sqs_dispatch_remote_execution_name = "${var.name_prefix}-dispatch-remote-execution"
sqs_results_name = "${var.name_prefix}-results"
sqs_dispatch_lambda_name = format("%v-dispatch-lambda", var.name_prefix)
sqs_dispatch_remote_execution_name = format("%v-dispatch-remote-execution", var.name_prefix)
sqs_results_name = format("%v-results", var.name_prefix)

db_cluster_name = var.name_prefix
db_instance_name = "${var.name_prefix}-instance-1"
db_name = replace("${var.name_prefix}_db", "-", "_")
db_user_name = "${replace(var.name_prefix, "-", "")}lambda_iam"
db_instance_name = format("%v-instance-1", var.name_prefix)
db_name = replace(format("%v_db", var.name_prefix), "-", "_")
db_user_name = format("%vlambda_iam", replace(var.name_prefix, "-", ""))

kms_alias_name = "k-kms-${var.name_prefix}"
kms_alias_name = format("k-kms-%v", var.name_prefix)

patch_role_name = var.name_prefix
patch_execution_role_name = "${var.name_prefix}-execution"
patch_execproxy_role_name = "${var.name_prefix}-execproxy"
patch_execution_role_name = format("%v-execution", var.name_prefix)
patch_execproxy_role_name = format("%v-execproxy", var.name_prefix)

patch_policy_name = "p-${var.name_prefix}"
patch_execution_policy_name = "p-${var.name_prefix}-execution"
patch_execproxy_policy_name = "p-${var.name_prefix}-execproxy"
patch_policy_name = format("p-%v", var.name_prefix)
patch_execution_policy_name = format("p-%v-execution", var.name_prefix)
patch_execproxy_policy_name = format("p-%v-execproxy", var.name_prefix)

log_group_dispatcher = "/aws/lambda/${local.lambda_dispatcher_name}"
log_group_step_result = "/aws/lambda/${local.lambda_step_result_name}"
log_group_worker = "/aws/lambda/${local.lambda_worker_name}"
log_group_dispatcher = format("/aws/lambda/%v", local.lambda_dispatcher_name)
log_group_step_result = format("/aws/lambda/%v", local.lambda_step_result_name)
log_group_worker = format("/aws/lambda/%v", local.lambda_worker_name)

# ─── ARN helpers ────────────────────────────────────────────────────────────
partition = data.aws_partition.current.partition
Expand Down
20 changes: 10 additions & 10 deletions policies.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@ data "aws_iam_policy_document" "patch_role_assume" {
actions = ["sts:AssumeRole"]
principals {
type = "AWS"
identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
}
condition {
test = "ArnLike"
variable = "aws:PrincipalArn"
values = ["arn:${local.partition}:iam::${local.account_id}:role/${local.patch_execution_role_name}"]
values = [format("arn:%v:iam::%v:role/%v", local.partition, local.account_id, local.patch_execution_role_name)]
}
condition {
test = "ForAnyValue:StringLike"
variable = "aws:PrincipalOrgPaths"
values = ["${data.aws_organizations_organization.org.id}/*"]
values = [format("%v/*", data.aws_organizations_organization.org.id)]
}
}
}
Expand All @@ -36,7 +36,7 @@ data "aws_iam_policy_document" "patch_execution_role_assume" {
actions = ["sts:AssumeRole"]
principals {
type = "AWS"
identifiers = ["arn:${local.partition}:iam::${local.account_id}:role/${local.patch_execproxy_role_name}"]
identifiers = [format("arn:%v:iam::%v:role/%v", local.partition, local.account_id, local.patch_execproxy_role_name)]
}
}
}
Expand Down Expand Up @@ -94,9 +94,9 @@ data "aws_iam_policy_document" "patch_execution_role" {
effect = "Allow"
actions = ["lambda:InvokeFunction"]
resources = [
"arn:${local.partition}:lambda:${local.region}:${local.account_id}:function/${local.lambda_dispatcher_name}",
"arn:${local.partition}:lambda:${local.region}:${local.account_id}:function/${local.lambda_worker_name}",
"arn:${local.partition}:lambda:${local.region}:${local.account_id}:function/${local.lambda_step_result_name}",
format("arn:%v:lambda:%v:%v:function/%v", local.partition, local.region, local.account_id, local.lambda_dispatcher_name),
format("arn:%v:lambda:%v:%v:function/%v", local.partition, local.region, local.account_id, local.lambda_worker_name),
format("arn:%v:lambda:%v:%v:function/%v", local.partition, local.region, local.account_id, local.lambda_step_result_name),
]
}
statement {
Expand All @@ -109,7 +109,7 @@ data "aws_iam_policy_document" "patch_execution_role" {
]
# Scoped to log groups owned by this module
resources = [
"arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:/aws/lambda/${var.name_prefix}*",
format("arn:%v:logs:%v:%v:log-group:/aws/lambda/%v*", local.partition, local.region, local.account_id, var.name_prefix),
]
}
statement {
Expand Down Expand Up @@ -149,7 +149,7 @@ data "aws_iam_policy_document" "patch_execution_role" {
effect = "Allow"
actions = ["rds-db:connect"]
resources = [
"arn:${local.partition}:rds-db:${local.region}:${local.account_id}:dbuser:cluster-*/${local.db_user_name}",
format("arn:%v:rds-db:%v:%v:dbuser:cluster-*/%v", local.partition, local.region, local.account_id, local.db_user_name),
]
}
}
Expand All @@ -160,7 +160,7 @@ data "aws_iam_policy_document" "patch_execproxy_role" {
effect = "Allow"
actions = ["rds-db:connect"]
resources = [
"arn:${local.partition}:rds-db:${local.region}:${local.account_id}:dbuser:cluster-*/${local.db_user_name}",
format("arn:%v:rds-db:%v:%v:dbuser:cluster-*/%v", local.partition, local.region, local.account_id, local.db_user_name),
]
}
statement {
Expand Down
12 changes: 6 additions & 6 deletions roles.tf
View file
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# patch_role — assumed by patch_execution_role to perform EC2 operations in target accounts
module "patch_role" {
source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"

role_name = local.patch_role_name
role_description = "Assumed by ${local.patch_execution_role_name} to execute patching operations on EC2 instances in target accounts"
role_description = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name)
assume_policy_document = data.aws_iam_policy_document.patch_role_assume.json
attached_policies = [aws_iam_policy.patch_role.arn]

Expand All @@ -12,10 +12,10 @@ module "patch_role" {

# patch_execution_role — assumed by Lambda functions to orchestrate patching
module "patch_execution_role" {
source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"

role_name = local.patch_execution_role_name
role_description = "Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume ${local.patch_role_name} in target accounts"
role_description = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name)
assume_policy_document = data.aws_iam_policy_document.patch_execution_role_assume.json
attached_policies = [aws_iam_policy.patch_execution_role.arn]

Expand All @@ -26,10 +26,10 @@ module "patch_execution_role" {
# This instance profile is used by the EC2 host running p4proxy to authenticate
# to RDS via IAM and to assume patch_execution_role for orchestration tasks.
module "patch_execproxy_role" {
source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade"
source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade"

role_name = local.patch_execproxy_role_name
role_description = "Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of ${local.patch_execution_role_name}"
role_description = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name)
assume_policy_document = data.aws_iam_policy_document.patch_execproxy_role_assume.json
attached_policies = [aws_iam_policy.patch_execproxy_role.arn]
enable_instance_profile = true
Expand Down
12 changes: 6 additions & 6 deletions sqs.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# policy_id and sid are set explicitly per review feedback.

data "aws_iam_policy_document" "sqs_dispatch_lambda" {
policy_id = "${local.sqs_dispatch_lambda_name}-policy"
policy_id = format("%v-policy", local.sqs_dispatch_lambda_name)

statement {
sid = "AllowAccountOwnerFullAccess"
Expand All @@ -12,15 +12,15 @@ data "aws_iam_policy_document" "sqs_dispatch_lambda" {

principals {
type = "AWS"
identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
}

resources = [aws_sqs_queue.dispatch_lambda.arn]
}
}

data "aws_iam_policy_document" "sqs_dispatch_remote_execution" {
policy_id = "${local.sqs_dispatch_remote_execution_name}-policy"
policy_id = format("%v-policy", local.sqs_dispatch_remote_execution_name)

statement {
sid = "AllowAccountOwnerFullAccess"
Expand All @@ -29,15 +29,15 @@ data "aws_iam_policy_document" "sqs_dispatch_remote_execution" {

principals {
type = "AWS"
identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
}

resources = [aws_sqs_queue.dispatch_remote_execution.arn]
}
}

data "aws_iam_policy_document" "sqs_results" {
policy_id = "${local.sqs_results_name}-policy"
policy_id = format("%v-policy", local.sqs_results_name)

statement {
sid = "AllowAccountOwnerFullAccess"
Expand All @@ -46,7 +46,7 @@ data "aws_iam_policy_document" "sqs_results" {

principals {
type = "AWS"
identifiers = ["arn:${local.partition}:iam::${local.account_id}:root"]
identifiers = [format("arn:%v:iam::%v:root", local.partition, local.account_id)]
}

resources = [aws_sqs_queue.results.arn]
Expand Down

0 comments on commit 74ed0ef

Please sign in to comment.