diff --git a/README.md b/README.md index eec47f0..3cff5f0 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,9 @@ ## Modules -No modules. +| Name | Source | Version | +|------|--------|---------| +| [role](#module\_role) | git@github.e.it.census.gov:terraform-modules/aws-iam-role.git | n/a | ## Resources @@ -22,6 +24,9 @@ No modules. | [aws_dynamodb_table.table](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource | | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_iam_policy.lambda_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | +| [aws_iam_policy_document.lambda_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.lambda_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | ## Inputs @@ -31,7 +36,9 @@ No modules. | [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no | | [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no | | [component\_tags](#input\_component\_tags) | Additional tags for Components (s3, kms, ddb) | `map(map(string))` |
{
"ddb": {},
"kms": {},
"s3": {}
} | no |
-| [dynamodb\_table](#input\_dynamodb\_table) | Different DynamoDB table to override default of var.name) | `string` | `null` | no |
+| [create](#input\_create) | Flag to indicate whether to create the resources or not (default: true) | `bool` | `true` | no |
+| [dynamodb\_table\_name](#input\_dynamodb\_table\_name) | Different DynamoDB table name to override default of var.name) | `string` | `null` | no |
+| [lambda\_name](#input\_lambda\_name) | Different Lambda name to override default of var.name) | `string` | `null` | no |
| [name](#input\_name) | Name to use within all the created resources (default: inf-dynamic-route53) | `string` | `"inf-dynamic-route53"` | no |
| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
| [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
diff --git a/dynamodb.tf b/dynamodb.tf
index e6f2f0c..0a83d84 100644
--- a/dynamodb.tf
+++ b/dynamodb.tf
@@ -1,9 +1,9 @@
locals {
- dynamodb_table = var.dynamodb_table != null ? var.dynamodb_table : local.name
+ dynamodb_table_name = var.dynamodb_table_name != null ? var.dynamodb_table_name : local.name
}
resource "aws_dynamodb_table" "table" {
- name = local.dynamodb_table
+ name = local.dynamodb_table_name
hash_key = "InstanceId"
billing_mode = "PROVISIONED"
read_capacity = 4
@@ -22,7 +22,7 @@ resource "aws_dynamodb_table" "table" {
local.base_tags,
var.tags,
lookup(var.component_tags, "ddb", {}),
- map("Name", local.dynamodb_table),
+ map("Name", local.dynamodb_table_name),
)
lifecycle {
diff --git a/role.tf b/role.tf
new file mode 100644
index 0000000..b2a4a8f
--- /dev/null
+++ b/role.tf
@@ -0,0 +1,75 @@
+locals {
+ lambda_name = var.lambda_name != null ? var.lambda_name : local.name
+ lambda_policies = ["AWSLambdaBasicExecutionRole"]
+}
+
+module "role" {
+ source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git"
+
+ role_description = "Lambda role for Dynamic Route53"
+ role_name = local.lambda_name
+ enable_ldap_creation = false
+ assume_policy_document = data.aws_iam_policy_document.lambda_assume.json
+ attached_policies = [for k, v in data.aws_iam_policy.lambda_policies : k.arn]
+ inline_policies = [{ name = var.name, policy = data.aws_iam_policy_document.lambda_policy.json }]
+}
+
+data "aws_iam_policy" "lambda_policies" {
+ for_each = toset(local.lambda_policies)
+ name = each.key
+}
+
+data "aws_iam_policy_document" "lambda_policy" {
+ statement {
+ sid = "AllowRoute53"
+ effect = "Allow"
+ actions = [
+ "route53:ListHostedZones*",
+ "route53:ListResourceRecordSets",
+ "route53:GetHostedZone*",
+ "route53:ChangeResourceRecordSets",
+ ]
+ resources = ["*"]
+ }
+ statement {
+ sid = "EC2"
+ effect = "Allow"
+ actions = ["ec2:Describe*"]
+ resources = ["*"]
+ }
+ statement {
+ sid = "DynamoDBGlobal"
+ effect = "Allow"
+ actions = ["dynamodb:ListTables"]
+ resources = ["*"]
+ }
+ statement {
+ sid = "DynamoDBTable"
+ effect = "Allow"
+ actions = [
+ "dynamodb:BatchGet*",
+ "dynamodb:DeleteItem",
+ "dynamodb:Describe*",
+ "dynamodb:Get*",
+ "dynamodb:List*",
+ "dynamodb:PutItem",
+ "dynamodb:Query",
+ "dynamodb:Scan",
+ "dynamodb:UpdateItem",
+ ]
+ resources = [aws_dynamodb_table.table.arn]
+ }
+}
+
+data "aws_iam_policy_document" "lambda_assume" {
+ statement {
+ sid = "LambdaAssumeRole"
+ effect = "Allow"
+ actions = ["sts:AssumeRole"]
+
+ principals {
+ type = "Service"
+ identifiers = ["lambda.amazonaws.com"]
+ }
+ }
+}
diff --git a/variables.create.tf b/variables.create.tf
new file mode 100644
index 0000000..7613cac
--- /dev/null
+++ b/variables.create.tf
@@ -0,0 +1,5 @@
+variable "create" {
+ description = "Flag to indicate whether to create the resources or not (default: true)"
+ type = bool
+ default = true
+}
diff --git a/variables.tf b/variables.tf
index 86415fe..e1c9ca6 100644
--- a/variables.tf
+++ b/variables.tf
@@ -4,9 +4,14 @@ variable "name" {
default = "inf-dynamic-route53"
}
+variable "dynamodb_table_name" {
+ description = "Different DynamoDB table name to override default of var.name)"
+ type = string
+ default = null
+}
-variable "dynamodb_table" {
- description = "Different DynamoDB table to override default of var.name)"
+variable "lambda_name" {
+ description = "Different Lambda name to override default of var.name)"
type = string
default = null
}
diff --git a/version.tf b/version.tf
index fa2705b..0d48594 100644
--- a/version.tf
+++ b/version.tf
@@ -1,3 +1,3 @@
locals {
- _module_version = "1.0.0"
+ _module_version = "0.0.2"
}