-
-
Notifications
You must be signed in to change notification settings - Fork 41
/
Copy pathlambda.tf
143 lines (133 loc) · 5.79 KB
/
lambda.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
///////////////////////////////////////////////////[ LAMBDA IMAGE OPTIMIZATION ]//////////////////////////////////////////
# # ---------------------------------------------------------------------------------------------------------------------#
# Create Lambda IAM role and attach policy permissions
# # ---------------------------------------------------------------------------------------------------------------------#
resource "aws_cloudwatch_log_group" "lambda" {
name = "/lambda/${aws_lambda_function.image_optimization.function_name}/"
retention_in_days = 7
}
data "aws_iam_policy_document" "lambda" {
statement {
sid = "LambdaLog"
effect = "Allow"
actions = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
]
resources = ["*"]
}
statement {
sid = "LambdaAccess"
effect = "Allow"
actions = [
"ec2:CreateNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSubnets",
"ec2:DeleteNetworkInterface",
"ec2:AssignPrivateIpAddresses",
"ec2:UnassignPrivateIpAddresses"
]
resources = ["*"]
}
}
resource "aws_iam_policy" "lambda" {
name = "${local.project}-lambda"
path = "/"
description = "IAM policy for lambda"
policy = data.aws_iam_policy_document.lambda.json
}
resource "aws_iam_role_policy_attachment" "lambda" {
role = aws_iam_role.lambda.name
policy_arn = aws_iam_policy.lambda.arn
}
data "aws_iam_policy_document" "assume_role" {
statement {
effect = "Allow"
principals {
type = "Service"
identifiers = ["lambda.amazonaws.com"]
}
actions = ["sts:AssumeRole"]
}
}
resource "aws_iam_role" "lambda" {
name = "${local.project}-lambda"
assume_role_policy = data.aws_iam_policy_document.assume_role.json
}
# # ---------------------------------------------------------------------------------------------------------------------#
# Create Lambda permissions for CloudFront
# # ---------------------------------------------------------------------------------------------------------------------#
resource "aws_lambda_permission" "this" {
provider = aws.useast1
statement_id = "AllowCloudFrontServicePrincipal"
action = "lambda:InvokeFunctionUrl"
function_name = aws_lambda_function.image_optimization.function_name
principal = "cloudfront.amazonaws.com"
source_arn = aws_cloudfront_distribution.this.arn
qualifier = aws_lambda_alias.image_optimization.name
}
# # ---------------------------------------------------------------------------------------------------------------------#
# Create Lambda function npm package
# # ---------------------------------------------------------------------------------------------------------------------#
resource "null_resource" "npm_install" {
provisioner "local-exec" {
command = "cd ${abspath(path.root)}/lambda/image_optimization && npm install"
}
triggers = {
always_run = "${filesha256("${abspath(path.root)}/lambda/image_optimization/index.mjs")}"
}
}
# # ---------------------------------------------------------------------------------------------------------------------#
# Create Lambda function zip archive
# # ---------------------------------------------------------------------------------------------------------------------#
data "archive_file" "lambda_image_optimization" {
depends_on = [null_resource.npm_install]
type = "zip"
source_dir = "${abspath(path.root)}/lambda/image_optimization"
output_file_mode = "0666"
output_path = "${abspath(path.root)}/lambda/image_optimization.zip"
}
# # ---------------------------------------------------------------------------------------------------------------------#
# Lambda function with variables
# # ---------------------------------------------------------------------------------------------------------------------#
resource "aws_lambda_function" "image_optimization" {
provider = aws.useast1
function_name = "${local.project}-image-optimization"
role = aws_iam_role.lambda.arn
filename = data.archive_file.lambda_image_optimization.output_path
source_code_hash = data.archive_file.lambda_image_optimization.output_base64sha256
runtime = "nodejs20.x"
handler = "index.handler"
memory_size = 256
timeout = 30
publish = true
environment {
variables = {
s3BucketRegion = aws_s3_bucket.this["media"].region
originalImageBucketName = aws_s3_bucket.this["media"].id
transformedImageBucketName = aws_s3_bucket.this["media-optimized"].id
transformedImageCacheTTL = "max-age=31622400"
maxImageSize = "4700000"
}
}
}
# # ---------------------------------------------------------------------------------------------------------------------#
# Lambda function url
# # ---------------------------------------------------------------------------------------------------------------------#
resource "aws_lambda_function_url" "image_optimization" {
provider = aws.useast1
function_name = aws_lambda_function.image_optimization.function_name
qualifier = aws_lambda_alias.image_optimization.name
authorization_type = "AWS_IAM"
}
# # ---------------------------------------------------------------------------------------------------------------------#
# Lambda function alias
# # ---------------------------------------------------------------------------------------------------------------------#
resource "aws_lambda_alias" "image_optimization" {
provider = aws.useast1
name = "${local.project}-image-optimization"
description = "Lambda image optimization alias for ${local.project}"
function_name = aws_lambda_function.image_optimization.arn
function_version = "$LATEST"
}