-
Notifications
You must be signed in to change notification settings - Fork 10
/
lambda.tf
executable file
·66 lines (57 loc) · 1.56 KB
/
lambda.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
resource "aws_lambda_function" "catalog-writer" {
# If the file is not in the current working directory you will need to include a
# path.module in the filename.
filename = "catalog-writer.zip"
function_name = "catalog-writer"
role = aws_iam_role.iam_for_lambda.arn
handler = "code.lambda_handler"
source_code_hash = filebase64sha256("catalog-writer.zip")
runtime = "python3.9"
}
// dynamodb table Write Policy
data "aws_iam_policy_document" "inline_policy" {
statement {
actions = [
"dynamodb:DeleteItem",
"dynamodb:DescribeTable",
"dynamodb:GetItem",
"dynamodb:GetRecords",
"dynamodb:ListTables",
"dynamodb:PutItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:UpdateItem",
"dynamodb:UpdateTable",
]
resources = [aws_dynamodb_table.apps_storage.arn]
effect = "Allow"
}
}
resource "aws_iam_role" "iam_for_lambda" {
name = "lambda-role"
inline_policy {
name = "policy-dynamodb-writer"
policy = data.aws_iam_policy_document.inline_policy.json
}
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Effect": "Allow"
}
]
}
EOF
}
resource "aws_lambda_permission" "allow_bucket" {
statement_id = "AllowExecutionFromS3Bucket"
action = "lambda:InvokeFunction"
function_name = aws_lambda_function.catalog-writer.arn
principal = "s3.amazonaws.com"
source_arn = aws_s3_bucket.example_bucket.arn
}