-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1 from sudoblark/feature/initial-module-setup
Initial module setup
- Loading branch information
Showing
26 changed files
with
915 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 1.5.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| locals { | ||
| actual_iam_policy_documents = { | ||
| for rule in var.raw_event_bridge_rules : | ||
| rule.suffix => { | ||
| statements = rule.iam_policy_statements | ||
| } if length(rule.iam_policy_statements) > 0 | ||
| } | ||
| } | ||
|
|
||
| data "aws_iam_policy_document" "event_bridge_target_policy" { | ||
| for_each = local.actual_iam_policy_documents | ||
|
|
||
| dynamic "statement" { | ||
| for_each = each.value["statements"] | ||
|
|
||
| content { | ||
| sid = statement.value["sid"] | ||
| actions = statement.value["actions"] | ||
| resources = statement.value["resources"] | ||
|
|
||
| dynamic "condition" { | ||
| for_each = statement.value["conditions"] | ||
|
|
||
| content { | ||
| test = condition.value["test"] | ||
| variable = condition.value["variable"] | ||
| values = condition.value["values"] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| data "aws_iam_policy_document" "allow_event_bridge_assume" { | ||
| statement { | ||
| actions = ["sts:AssumeRole"] | ||
| principals { | ||
| type = "Service" | ||
| identifiers = ["events.amazonaws.com"] | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| module "rule" { | ||
| source = "./modules/rule" | ||
| for_each = { for rule in var.raw_event_bridge_rules : rule.suffix => rule } | ||
|
|
||
| environment = var.environment | ||
| application_name = var.application_name | ||
| event_name_suffix = each.value["suffix"] | ||
| event_description = each.value["description"] | ||
| event_schedule = each.value["schedule"] | ||
| event_pattern = each.value["pattern"] | ||
| state = each.value["state"] | ||
| ignore_state = each.value["ignore_state"] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| locals { | ||
| event_bridge_targets = flatten([ | ||
| for rule in var.raw_event_bridge_rules : [ | ||
| for target in rule.targets : { | ||
| identifier = format("%s/%s", rule.suffix, target.name), | ||
| event_rule : module.rule[rule.suffix].name | ||
| event_target : target.name | ||
| event_target_arn : target.arn | ||
| event_target_role_arn : try(aws_iam_role.invoke_role[rule.suffix].arn, null) | ||
| event_target_input : target.input | ||
| event_target_input_path : target.input_path | ||
| event_target_input_transformer : target.input_transformer | ||
| } | ||
| ] | ||
| ]) | ||
| } | ||
|
|
||
| module "target" { | ||
| source = "./modules/target" | ||
|
|
||
| for_each = { for target in local.event_bridge_targets : target.identifier => target } | ||
|
|
||
| event_rule = each.value["event_rule"] | ||
| event_target = each.value["event_target"] | ||
| event_target_arn = each.value["event_target_arn"] | ||
| event_target_role_arn = each.value["event_target_role_arn"] | ||
| event_target_input = each.value["event_target_input"] | ||
| event_target_input_path = each.value["event_target_input_path"] | ||
| event_target_input_transformer = each.value["event_target_input_transformer"] | ||
|
|
||
|
|
||
| depends_on = [ | ||
| module.rule, | ||
| data.aws_iam_policy_document.event_bridge_target_policy, | ||
| data.aws_iam_policy_document.allow_event_bridge_assume | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 1.5.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # Get current region | ||
| data "aws_region" "current_region" {} | ||
|
|
||
| # Retrieve the current AWS Account info | ||
| data "aws_caller_identity" "current_account" {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| /* | ||
| Data structure | ||
| --------------- | ||
| A list of dictionaries, where each dictionary has the following attributes: | ||
| REQUIRED | ||
| --------- | ||
| - suffix : Friendly name for the rule in Event Bridge | ||
| - description : A friendly description of what the Event Bridge rule does | ||
| - targets : A list of dictionaries with the following attributes, defining what target this event triggers: | ||
| -- name : A friendly name for the target, if lambda this should be the lambda name | ||
| -- arn : The ARN of the resource being targeted | ||
| MUTUALLY EXCLUSIVE TARGETS INPUTS: | ||
| -- input : OPTIONAL JSON string of input to pass to target, defaults to null | ||
| -- input_path : OPTIONAL value of the JSONPath that is used for extracting part of the matched event when passing it to the target, defaults to null. | ||
| -- input_transformer : OPTIONAL parameters used when you are providing a custom input to a target based on certain event data, defaults to null. | ||
| One of the following, but not both: | ||
| - schedule : The scheduling expression. For example, cron(0 20 * * ? *) or rate(5 minutes) | ||
| - pattern : Pattern for the event to match on, should be jsonencoded dictionary | ||
| OPTIONAL | ||
| --------- | ||
| By default we deploy event bridge rules as disabled, and ignore state on apply, such that | ||
| enabling/disabling event bridge rules is always a manual affair rather than doing via Terraform. But via the below | ||
| optional values this may be changed on a per-rule basis. | ||
| - state : By default DISABLED, can set to ENABLED or ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS | ||
| - ignore_state : By default true, can set to false. | ||
| IAM role Statement and Role Suffix to be used for this target when the rule is triggered. | ||
| Required if ecs_target is used or target in arn is EC2 instance, Kinesis data stream, Step Functions state machine, | ||
| or Event Bus in different account or region. | ||
| - iam_role_suffix : IAM role suffix for the event bridge Role having permission to invoke target AWS Service | ||
| - iam_policy_statements : A list of dictionaries where each dictionary is an IAM statement defining Event Bridge permissions | ||
| -- conditions : An OPTIONAL list of dictionaries, which each defines: | ||
| --- test : Test condition for limiting the action | ||
| --- variable : Value to test | ||
| --- values : A list of strings, denoting what to test for | ||
| */ | ||
|
|
||
| locals { | ||
| raw_event_bridge_rules = [ | ||
| # Rule is enabled and its state is managed with Terraform | ||
| { | ||
| suffix = "sagemaker-promotion" | ||
| description = "Trigger SageMaker model promotion when package state changes" | ||
| state = "ENABLED" | ||
| ignore_state = "false" | ||
| targets = [ | ||
| { | ||
| name = "my-promotion-lambda" | ||
| arn = "arn:aws:lambda:${data.aws_region.current_region.name}:${data.aws_caller_identity.current_account.account_id}:function:my-promotion-lambda" | ||
| } | ||
| ] | ||
| pattern = jsonencode({ | ||
| source = ["aws.sagemaker"] | ||
| detail-type = ["SageMaker Model Package State Change"] | ||
| detail = { | ||
| "ModelPackageGroupName" : [ | ||
| { | ||
| "exists" : true | ||
| } | ||
| ] | ||
| } | ||
| }) | ||
| }, | ||
| # Rule is disabled, by state is not managed by Terraform, thus it may be enabled/disabled in the account | ||
| # manually by individuals | ||
| { | ||
| suffix = "hourly-healthcheck" | ||
| description = "EventBridge Schedule Rule to trigger hourly healthcheck lambda" | ||
| schedule = "cron(0 0 * * ? *)" | ||
| targets = [ | ||
| { | ||
| name = "hourly-healthcheck-lambda" | ||
| arn = "arn:aws:lambda:${data.aws_region.current_region.name}:${data.aws_caller_identity.current_account.account_id}:function:hourly-healthcheck-lambda" | ||
| } | ||
| ] | ||
| iam_role_suffix = "healthcheck" | ||
| }, | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| terraform { | ||
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 5.27.0" | ||
| } | ||
| } | ||
| required_version = "~> 1.5.0" | ||
| } | ||
|
|
||
| provider "aws" { | ||
| region = "eu-west-2" | ||
| } | ||
|
|
||
| module "event_bridge" { | ||
| source = "github.com/sudoblark/sudoblark.terraform.module.aws.event_bridge_rule?ref=1.0.0" | ||
|
|
||
| application_name = var.application_name | ||
| environment = var.environment | ||
| raw_event_bridge_rules = local.raw_event_bridge_rules | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| variable "environment" { | ||
| description = "Which environment this is being instantiated in." | ||
| type = string | ||
| validation { | ||
| condition = contains(["dev", "test", "prod"], var.environment) | ||
| error_message = "Must be either dev, test or prod" | ||
| } | ||
| default = "prod" | ||
| } | ||
|
|
||
| variable "application_name" { | ||
| description = "Name of the application utilising the resource resource." | ||
| type = string | ||
| default = "demo-app" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 1.5.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # Get current region | ||
| data "aws_region" "current_region" {} | ||
|
|
||
| # Retrieve the current AWS Account info | ||
| data "aws_caller_identity" "current_account" {} |
Oops, something went wrong.