Update module versions, examples and tests (#24)

* Update module versions * Update module versions * Update module versions, examples and tests * Update module versions, examples and tests * Update module versions, examples and tests * Update module versions, examples and tests * Update module versions, examples and tests * Update module versions, examples and tests * Update module versions, examples and tests
cloudposse · Jul 6, 2022 · 4dd990a · 4dd990a
1 parent dc8f0f2
commit 4dd990a
Show file tree

Hide file tree

Showing 25 changed files with 281 additions and 880 deletions.
diff --git a/LICENSE b/LICENSE
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2020 Cloud Posse, LLC
+   Copyright 2021-2022 Cloud Posse, LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

diff --git a/README.md b/README.md
diff --git a/README.yaml b/README.yaml
@@ -52,16 +52,16 @@ related:
     url: "https://github.com/cloudposse/terraform-null-label"
 
 description: |-
-  This module deploys an AWS Lambda function from a zip file or from a docker image. Additionally, it creates an IAM 
-  role for the Lambda function, which optionally attaches policies to allow for Cloudwatch Logs, Cloudwatch Insights, 
+  This module deploys an AWS Lambda function from a Zip file or from a Docker image. Additionally, it creates an IAM 
+  role for the Lambda function, which optionally attaches policies to allow for CloudWatch Logs, Cloudwatch Insights, 
   VPC Access and X-Ray tracing.
-    # Example usage
 
 # How to use this module. Should be an easy example to copy and paste.
 usage: |-
   For a complete example, see [examples/complete](examples/complete).
   For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest)
   (which tests and deploys the example on AWS), see [test](test).
+  
   ```hcl
   module "lambda" {
     source  = "cloudposse/lambda-function/aws"
@@ -75,8 +75,8 @@ usage: |-
   ```
 
 examples: |-
-  Here is an example of using this module:
-  - [`examples/complete`](https://github.com/cloudposse/terraform-aws-lambda-function/) - complete example of using this module
+  - [`examples/complete`](https://github.com/cloudposse/terraform-aws-lambda-function/examples/complete) - complete example of using this module
+  - [`examples/docker-image`](https://github.com/cloudposse/terraform-aws-lambda-function/examples/docker-image) - example of using Lambda with Docker images
 
 # Other files to include in this README from the project folder
 include:
@@ -89,3 +89,5 @@ contributors:
     github: "mcalhoun"
   - name: "PePe Amengual"
     github: "jamengual"
+  - name: "Andriy Knysh"
+    github: "aknysh"
diff --git a/docs/terraform.md b/docs/terraform.md
diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars
@@ -3,6 +3,6 @@ namespace   = "eg"
 environment = "ue2"
 stage       = "test"
 
-function_name = "example-complete-function"
+function_name = "example-complete"
 handler       = "handler.handler"
 runtime       = "nodejs14.x"
diff --git a/examples/complete/handler.js b/examples/complete/handler.js
@@ -1,3 +1,3 @@
 exports.handler = async function (_event, _context) {
-  return { data: "Hello World" };
+    return {data: "Hello World"};
 };
diff --git a/examples/complete/main.tf b/examples/complete/main.tf
@@ -10,6 +10,7 @@ locals {
     join("", data.aws_partition.current.*.partition),
     join("", data.aws_caller_identity.current.*.account_id),
   )
+
   policy_arn_inside = format("%s/%s", local.policy_arn_prefix, local.policy_name_inside)
 
   policy_json = jsonencode({
@@ -53,7 +54,7 @@ resource "aws_iam_policy" "inside" {
   count       = local.enabled ? 1 : 0
   name        = local.policy_name_inside
   path        = "/"
-  description = "My policy attached inside the lambda module"
+  description = "The policy attached inside the Lambda module"
 
   policy = local.policy_json
 }
@@ -62,7 +63,7 @@ resource "aws_iam_policy" "outside" {
   count       = local.enabled ? 1 : 0
   name        = local.policy_name_outside
   path        = "/"
-  description = "My policy attached outside the lambda module"
+  description = "The policy attached outside the Lambda module"
 
   policy = local.policy_json
 }
@@ -76,10 +77,11 @@ resource "aws_iam_role_policy_attachment" "outside" {
 module "lambda" {
   source = "../.."
 
-  filename      = join("", data.archive_file.lambda_zip.*.output_path)
-  function_name = module.label.id
-  handler       = var.handler
-  runtime       = var.runtime
+  filename               = join("", data.archive_file.lambda_zip.*.output_path)
+  function_name          = module.label.id
+  handler                = var.handler
+  runtime                = var.runtime
+  iam_policy_description = var.iam_policy_description
 
   custom_iam_policy_arns = [
     "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
@@ -89,7 +91,5 @@ module "lambda" {
 
   context = module.this.context
 
-  depends_on = [
-    aws_iam_policy.inside,
-  ]
+  depends_on = [aws_iam_policy.inside]
 }
diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf
@@ -4,18 +4,24 @@ variable "region" {
 }
 
 variable "function_name" {
-  description = "Unique name for the Lambda Function."
   type        = string
+  description = "Unique name for the Lambda Function."
 }
 
 variable "handler" {
+  type        = string
   description = "The function entrypoint in your code."
   default     = ""
-  type        = string
 }
 
 variable "runtime" {
+  type        = string
   description = "The runtime environment for the Lambda function you are uploading."
   default     = ""
+}
+
+variable "iam_policy_description" {
   type        = string
+  description = "Description of the IAM policy for the Lambda IAM role"
+  default     = "Minimum SSM read permissions for Lambda"
 }
diff --git a/examples/complete/versions.tf b/examples/complete/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.14"
 
   required_providers {
     aws = {

diff --git a/examples/docker-image/Dockerfile b/examples/docker-image/Dockerfile
@@ -6,4 +6,4 @@ COPY handler.js ${LAMBDA_TASK_ROOT}
 ENV NODE_ENV=production
 
 # start app
-CMD [ "handler.handler" ]
+CMD [ "handler.handler" ]
diff --git a/examples/docker-image/fixtures.us-east-2.tfvars b/examples/docker-image/fixtures.us-east-2.tfvars
@@ -3,6 +3,6 @@ namespace   = "eg"
 environment = "ue2"
 stage       = "test"
 
-function_name = "example-complete-function"
+function_name = "example-docker-image"
 handler       = "handler.handler"
 runtime       = "nodejs14.x"
diff --git a/examples/docker-image/handler.js b/examples/docker-image/handler.js
@@ -1,3 +1,3 @@
 exports.handler = async function (_event, _context) {
-  return { data: "Hello World" };
+    return {data: "Hello World"};
 };
diff --git a/examples/docker-image/main.tf b/examples/docker-image/main.tf
@@ -1,3 +1,11 @@
+data "aws_region" "this" {
+  count = module.this.enabled ? 1 : 0
+}
+
+data "aws_caller_identity" "this" {
+  count = module.this.enabled ? 1 : 0
+}
+
 module "label" {
   source     = "cloudposse/label/null"
   version    = "0.25.0"
@@ -6,67 +14,65 @@ module "label" {
   context = module.this.context
 }
 
+# Cloud Posse does NOT recommend building and pushing images to ECR via Terraform code. This is a job for your CI/CD
+# pipeline. It is only done here for convenience and so that the example can be run locally.
 module "ecr" {
   source  = "cloudposse/ecr/aws"
-  version = "0.32.3"
+  version = "0.34.0"
   name    = module.label.id
 
   context = module.this.context
 }
 
 # Need to sleep for a few seconds after creating the ECR repository before we can push to it
 resource "time_sleep" "wait_15_seconds" {
-  count      = module.this.enabled ? 1 : 0
-  depends_on = [module.ecr]
+  count = module.this.enabled ? 1 : 0
 
   create_duration = "15s"
-}
 
-# Cloud Posse does NOT recommend building and pushing images to ECR via Terraform code. This is a job for your CI/CD
-# pipeline. It is only done here for convenience and so that the example can be run locally.
-data "aws_region" "this" { count = module.this.enabled ? 1 : 0 }
-data "aws_caller_identity" "this" { count = module.this.enabled ? 1 : 0 }
+  depends_on = [module.ecr]
+}
 
 resource "null_resource" "docker_build" {
   count = module.this.enabled ? 1 : 0
+
   provisioner "local-exec" {
     command = "docker build -t ${module.ecr.repository_url} ."
   }
 }
 
 resource "null_resource" "docker_login" {
   count = module.this.enabled ? 1 : 0
+
   provisioner "local-exec" {
-    command = "aws ecr get-login-password --region ${data.aws_region.this[0].name} | docker login --username AWS --password-stdin ${data.aws_caller_identity.this[0].account_id}.dkr.ecr.${data.aws_region.this[0].name}.amazonaws.com"
+    command = "aws ecr get-login-password --region ${join("", data.aws_region.this.*.name)} | docker login --username AWS --password-stdin ${join("", data.aws_caller_identity.this.*.account_id)}.dkr.ecr.${join("", data.aws_region.this.*.name)}.amazonaws.com"
   }
 
-  depends_on = [
-    null_resource.docker_build,
-  ]
+  depends_on = [null_resource.docker_build]
 }
 
 resource "null_resource" "docker_push" {
   count = module.this.enabled ? 1 : 0
+
   provisioner "local-exec" {
     command = "docker push ${module.ecr.repository_url}:latest"
   }
 
   depends_on = [
     time_sleep.wait_15_seconds,
-    null_resource.docker_login,
+    null_resource.docker_login
   ]
 }
 
 module "lambda" {
-
   source = "../.."
 
-  function_name = module.label.id
-  image_uri     = "${module.ecr.repository_url}:latest"
-  package_type  = "Image"
+  function_name          = module.label.id
+  image_uri              = "${module.ecr.repository_url}:latest"
+  package_type           = "Image"
+  iam_policy_description = var.iam_policy_description
 
   context = module.this.context
-  depends_on = [
-    null_resource.docker_push,
-  ]
+
+  depends_on = [null_resource.docker_push]
 }
diff --git a/examples/docker-image/outputs.tf b/examples/docker-image/outputs.tf
@@ -1,4 +1,3 @@
-
 output "arn" {
   description = "ARN of the lambda function"
   value       = module.lambda.arn

diff --git a/examples/docker-image/variables.tf b/examples/docker-image/variables.tf
@@ -4,18 +4,24 @@ variable "region" {
 }
 
 variable "function_name" {
-  description = "Unique name for the Lambda Function."
   type        = string
+  description = "Unique name for the Lambda Function."
 }
 
 variable "handler" {
+  type        = string
   description = "The function entrypoint in your code."
   default     = ""
-  type        = string
 }
 
 variable "runtime" {
+  type        = string
   description = "The runtime environment for the Lambda function you are uploading."
   default     = ""
+}
+
+variable "iam_policy_description" {
   type        = string
+  description = "Description of the IAM policy for the Lambda IAM role"
+  default     = "Minimum SSM read permissions for Lambda"
 }
diff --git a/examples/docker-image/versions.tf b/examples/docker-image/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.0"
+  required_version = ">= 0.14"
 
   required_providers {
     aws = {

diff --git a/iam-role.tf b/iam-role.tf
@@ -1,5 +1,6 @@
 resource "aws_iam_role" "this" {
-  count                = local.enabled ? 1 : 0
+  count = local.enabled ? 1 : 0
+
   name                 = "${var.function_name}-${local.region_name}"
   assume_role_policy   = join("", data.aws_iam_policy_document.assume_role_policy.*.json)
   permissions_boundary = var.permissions_boundary
@@ -13,13 +14,14 @@ data "aws_iam_policy_document" "assume_role_policy" {
 
     principals {
       type        = "Service"
-      identifiers = concat(["lambda.amazonaws.com"], var.lambda_at_edge ? ["edgelambda.amazonaws.com"] : [])
+      identifiers = concat(["lambda.amazonaws.com"], var.lambda_at_edge_enabled ? ["edgelambda.amazonaws.com"] : [])
     }
   }
 }
 
 resource "aws_iam_role_policy_attachment" "cloudwatch_logs" {
-  count      = local.enabled ? 1 : 0
+  count = local.enabled ? 1 : 0
+
   policy_arn = "arn:${local.partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
   role       = aws_iam_role.this[0].name
 }
@@ -63,8 +65,8 @@ data "aws_iam_policy_document" "ssm" {
 resource "aws_iam_policy" "ssm" {
   count = try((local.enabled && var.ssm_parameter_names != null && length(var.ssm_parameter_names) > 0), false) ? 1 : 0
 
-  description = "Provides minimum SSM read permissions."
   name        = "${var.function_name}-ssm-policy-${local.region_name}"
+  description = var.iam_policy_description
   policy      = data.aws_iam_policy_document.ssm[count.index].json
 }
 
@@ -76,7 +78,8 @@ resource "aws_iam_role_policy_attachment" "ssm" {
 }
 
 resource "aws_iam_role_policy_attachment" "custom" {
-  for_each   = local.enabled && length(var.custom_iam_policy_arns) > 0 ? var.custom_iam_policy_arns : toset([])
+  for_each = local.enabled && length(var.custom_iam_policy_arns) > 0 ? var.custom_iam_policy_arns : toset([])
+
   role       = aws_iam_role.this[0].name
   policy_arn = each.key
 }