leaflambda.tf

provider "aws" {
  region     = "${var.region}"
}

resource "aws_s3_bucket" "cache_and_data_s3bucket" {
    bucket = "${var.cache_and_data_s3_bucket}"
    acl    = "private"
}


######## IAM role for lambda execution ################
resource "aws_iam_role" "role_for_lambda" {
    name               = "${var.role_for_lambda_name}"
    path               = "/service-role/"
    assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}


############ Add policies to the new role:
data "aws_iam_policy" "AmazonS3FullAccess" {
  arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}
resource "aws_iam_role_policy_attachment" "AmazonS3FullAccess-policy-attachment-VASDESDA" {
  role = "${aws_iam_role.role_for_lambda.name}"
  policy_arn = "${data.aws_iam_policy.AmazonS3FullAccess.arn}"
}

data "aws_iam_policy" "AWSLambdaExecute" {
  arn = "arn:aws:iam::aws:policy/AWSLambdaExecute"
}
resource "aws_iam_role_policy_attachment" "AWSLambdaExecute-policy-attachment-VASDESDA" {
  role = "${aws_iam_role.role_for_lambda.name}"
  policy_arn = "${data.aws_iam_policy.AWSLambdaExecute.arn}"
}

data "aws_iam_policy" "AWSLambdaBasicExecutionRole" {
  arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
resource "aws_iam_role_policy_attachment" "AWSLambdaBasicExecutionRole-policy-attachment-VASDESDA" {
  role = "${aws_iam_role.role_for_lambda.name}"
  policy_arn = "${data.aws_iam_policy.AWSLambdaBasicExecutionRole.arn}"
}

data "aws_iam_policy" "AWSLambdaFullAccess" {
  arn = "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
}
resource "aws_iam_role_policy_attachment" "AWSLambdaFullAccess-policy-attachment-VASDESDA" {
  role = "${aws_iam_role.role_for_lambda.name}"
  policy_arn = "${data.aws_iam_policy.AWSLambdaFullAccess.arn}"
}



# Create the actual lambda
resource "aws_lambda_function" "test_lambda" {
  filename         = "deploy.zip"
  function_name    = "autogenerated_leaf_lambda"
  role             = "${aws_iam_role.role_for_lambda.arn}"
  handler          = "service.handler"
  source_code_hash = "${base64sha256(file("deploy.zip"))}"
  runtime          = "python2.7"
  timeout          = 300

  environment {
    variables = {
      username = "${var.nissan_username}",
      password = "${var.nissan_password}",
      bucket = "${var.cache_and_data_s3_bucket}"
      prefix = "leaflambda2"
    }
  }
}

#-------------------------------------------------------------------------------------------
# Create the cloudwatch event that triggers the lambda every hour

resource "aws_cloudwatch_event_rule" "every_hour" {
    name = "every-hour"
    description = "Fires every 60 minutes"
    schedule_expression = "rate(60 minutes)"
}
resource "aws_cloudwatch_event_target" "ping_leaf_every_hour" {
    rule = "${aws_cloudwatch_event_rule.every_hour.name}"
    target_id = "${aws_lambda_function.test_lambda.function_name}"
    arn = "${aws_lambda_function.test_lambda.arn}"
}
resource "aws_lambda_permission" "allow_cloudwatch_to_call_ping_leaf" {
    statement_id = "AllowExecutionFromCloudWatch"
    action = "lambda:InvokeFunction"
    function_name = "${aws_lambda_function.test_lambda.function_name}"
    principal = "events.amazonaws.com"
    source_arn = "${aws_cloudwatch_event_rule.every_hour.arn}"
}