forked from terraform-aws-modules/terraform-aws-notify-slack
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathiam.tf
64 lines (52 loc) · 1.46 KB
/
iam.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
locals {
lambda_policy_document = [{
sid = "AllowWriteToCloudwatchLogs"
effect = "Allow"
actions = [
"logs:CreateLogStream",
"logs:PutLogEvents",
]
resources = [aws_cloudwatch_log_group.lambda[0].arn]
}]
lambda_policy_document_kms = var.kms_key_arn != "" ? [{
sid = "AllowKMSDecrypt"
effect = "Allow"
actions = ["kms:Decrypt"]
resources = [var.kms_key_arn]
}] : []
}
data "aws_iam_policy_document" "assume_role" {
count = var.create ? 1 : 0
statement {
effect = "Allow"
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["lambda.amazonaws.com"]
}
}
}
data "aws_iam_policy_document" "lambda" {
count = var.create ? 1 : 0
dynamic "statement" {
for_each = concat(local.lambda_policy_document, local.lambda_policy_document_kms)
content {
sid = statement.value.sid
effect = statement.value.effect
actions = statement.value.actions
resources = statement.value.resources
}
}
}
resource "aws_iam_role" "lambda" {
count = var.create ? 1 : 0
name_prefix = "lambda"
assume_role_policy = data.aws_iam_policy_document.assume_role[0].json
tags = merge(var.tags, var.iam_role_tags)
}
resource "aws_iam_role_policy" "lambda" {
count = var.create ? 1 : 0
name_prefix = "lambda-policy-"
role = aws_iam_role.lambda[0].id
policy = data.aws_iam_policy_document.lambda[0].json
}