90 lines
1.9 KiB
HCL
90 lines
1.9 KiB
HCL
data "aws_iam_policy_document" "assume_role_policy" {
|
|
statement {
|
|
effect = "Allow"
|
|
|
|
actions = ["sts:AssumeRole"]
|
|
principals {
|
|
type = "Service"
|
|
identifiers = ["lambda.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "role_for_lambda" {
|
|
name = var.role_name
|
|
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
|
|
|
|
depends_on = [data.aws_iam_policy_document.assume_role_policy]
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "lambda_policy" {
|
|
|
|
name = "lambda_policy"
|
|
role = aws_iam_role.role_for_lambda.id
|
|
policy = <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "S3Access",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:GetObject"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::${var.s3_bucket}/files/*.json"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "CloudWatchLogsAccess",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:CreateLogGroup",
|
|
"logs:CreateLogStream",
|
|
"logs:PutLogEvents"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:us-east-1:${var.account_id}:*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
depends_on = [aws_iam_role.role_for_lambda]
|
|
}
|
|
|
|
|
|
resource "aws_iam_policy" "lambda_dynamodb_policy" {
|
|
name = "lambda_dynamodb_policy"
|
|
description = "Policy for Lambda to write to DynamoDB"
|
|
|
|
policy = <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:PutItem"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:dynamodb:us-east-1:${var.account_id}:table/${var.dynamodb_table_name}"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "lambda_role_policy_attachment" {
|
|
policy_arn = aws_iam_policy.lambda_dynamodb_policy.arn
|
|
role = aws_iam_role.role_for_lambda.name
|
|
}
|
|
|
|
output "arn" {
|
|
value = aws_iam_role.role_for_lambda.arn
|
|
}
|
|
|
|
output "role_name" {
|
|
value = aws_iam_role.role_for_lambda.name
|
|
}
|