generated from plus3it/repo-template
-
Notifications
You must be signed in to change notification settings - Fork 2
/
main.tf
122 lines (103 loc) · 3.38 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
##############################
# Lambda
##############################
module "lambda" {
source = "git::https://github.com/terraform-aws-modules/terraform-aws-lambda.git?ref=v7.14.0"
function_name = "${var.project_name}-delete-default-cloudtrail"
description = "Lambda function deleting cloudtrail and associated bucket"
handler = "delete_default_cloudtrail.lambda_handler"
tags = var.tags
attach_policy_json = true
policy_json = data.aws_iam_policy_document.lambda.json
artifacts_dir = var.lambda.artifacts_dir
build_in_docker = var.lambda.build_in_docker
create_package = var.lambda.create_package
ignore_source_code_hash = var.lambda.ignore_source_code_hash
local_existing_package = var.lambda.local_existing_package
recreate_missing_package = var.lambda.recreate_missing_package
ephemeral_storage_size = var.lambda.ephemeral_storage_size
runtime = var.lambda.runtime
s3_bucket = var.lambda.s3_bucket
s3_existing_package = var.lambda.s3_existing_package
s3_prefix = var.lambda.s3_prefix
store_on_s3 = var.lambda.store_on_s3
timeout = var.lambda.timeout
environment_variables = {
LOG_LEVEL = var.log_level
ASSUME_ROLE_NAME = var.assume_role_name
CLOUDTRAIL_NAME_PREFIX = var.cloudtrail_name_prefix
DRY_RUN = var.dry_run
ERROR_NOT_FOUND = var.error_not_found
}
source_path = [
{
path = "${path.module}/src"
pip_requirements = true
patterns = ["!\\.terragrunt-source-manifest"]
}
]
}
data "aws_iam_policy_document" "lambda" {
statement {
sid = "AllowAssumeRole"
actions = [
"sts:AssumeRole"
]
resources = [
"arn:${data.aws_partition.current.partition}:iam::*:role/${var.assume_role_name}"
]
}
}
##############################
# Events
##############################
locals {
lambda_name = module.lambda.lambda_function_name
event_types = {
CreateAccountResult = jsonencode(
{
"detail" : {
"eventSource" : ["organizations.amazonaws.com"],
"eventName" : ["CreateAccountResult"]
"serviceEventDetails" : {
"createAccountStatus" : {
"state" : ["SUCCEEDED"]
}
}
}
}
)
InviteAccountToOrganization = jsonencode(
{
"detail" : {
"eventSource" : ["organizations.amazonaws.com"],
"eventName" : ["InviteAccountToOrganization"]
}
}
)
}
}
resource "aws_cloudwatch_event_rule" "this" {
for_each = var.event_types
name = "${var.project_name}-${each.value}"
description = "Managed by Terraform"
event_pattern = local.event_types[each.value]
event_bus_name = var.event_bus_name
tags = var.tags
}
resource "aws_cloudwatch_event_target" "this" {
for_each = aws_cloudwatch_event_rule.this
rule = each.value.name
arn = module.lambda.lambda_function_arn
}
resource "aws_lambda_permission" "events" {
for_each = aws_cloudwatch_event_rule.this
action = "lambda:InvokeFunction"
function_name = module.lambda.lambda_function_name
principal = "events.amazonaws.com"
source_arn = each.value.arn
}
##############################
# Common
##############################
data "aws_partition" "current" {}