-
Notifications
You must be signed in to change notification settings - Fork 108
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* add showmigrations lambda * debug lambda * update show migrations V2 * import aws lambdas utils * add debug message * Add pulumi for lambda & lambda call from github actions * fix github actions * fix github actions work dir * pass docker image tag * pass docker image tag * update dependency * update dependency * update envs for lambda call * update lambda call * setup secret key * update stack name * remove unused file
- Loading branch information
Showing
9 changed files
with
380 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| from io import StringIO | ||
|
|
||
| from django.core.management import call_command | ||
|
|
||
| # pylint: disable=unused-import | ||
| import aws_lambdas.utils | ||
|
|
||
|
|
||
| # pylint: disable=unused-argument | ||
| def handler(event, context): | ||
| """ | ||
| Run show migrations command and return the output. | ||
| """ | ||
|
|
||
| try: | ||
| print("Running showmigrations command") | ||
| output = StringIO() | ||
| call_command("showmigrations", stdout=output) | ||
| print("Done running showmigrations command") | ||
| return {"statusCode": 200, "body": output.getvalue()} | ||
| except Exception as e: | ||
| return {"statusCode": 500, "body": str(e)} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| name: passport-scorer-ops | ||
| runtime: nodejs | ||
| description: A project to manage ops tools | ||
| config: | ||
| pulumi:tags: | ||
| value: | ||
| pulumi:template: typescript |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| import * as pulumi from "@pulumi/pulumi"; | ||
|
|
||
| export const stack = pulumi.getStack(); // values : review, staging & production | ||
|
|
||
| export const coreInfraOutputs = new pulumi.StackReference( | ||
| `passportxyz/core-infra/${stack}` | ||
| ); | ||
|
|
||
| export const coreRdsSecretArn = coreInfraOutputs.getOutput("coreRdsSecretArn"); | ||
| export const coreVpcId = coreInfraOutputs.getOutput("vpcId"); | ||
| export const corePrivateSubnetIds = | ||
| coreInfraOutputs.getOutput("privateSubnetIds"); | ||
|
|
||
| export const rdsSecretArn = coreInfraOutputs.getOutput("rdsSecretArn"); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| import * as pulumi from "@pulumi/pulumi"; | ||
| import * as aws from "@pulumi/aws"; | ||
| import { createLambdaFunction } from "./lambda"; | ||
| import { stack, coreVpcId, corePrivateSubnetIds, rdsSecretArn } from "./config"; | ||
|
|
||
| const dockerImageTag = process.env.DOCKER_IMAGE_TAG; | ||
| const awsAccNo = aws.getCallerIdentity().then((caller) => caller.accountId); | ||
|
|
||
| const dockerCmd = ["v2.aws_lambdas.showmigrations_GET.handler"]; | ||
|
|
||
| const { lambdaFunction, lambdaFunctionUrl } = pulumi | ||
| .all([coreVpcId, corePrivateSubnetIds, awsAccNo, rdsSecretArn]) | ||
| .apply(([vpcId, subnetIds, _awsAccNo, _rdsSecretArn]) => { | ||
| const dockerImageUri = `${_awsAccNo}.dkr.ecr.us-west-2.amazonaws.com/submit-passport-lambdas:${dockerImageTag}`; | ||
| return createLambdaFunction( | ||
| "showmigrations", | ||
| "Run showmigrations cmd", | ||
| dockerImageUri, | ||
| dockerCmd, | ||
| vpcId, | ||
| subnetIds, | ||
| [_rdsSecretArn], | ||
| { | ||
| CORE_SECRET_ARN: _rdsSecretArn, | ||
| SECRET_KEY: "1234", | ||
| } | ||
| ); | ||
| }); | ||
| export const lambdaUrl = lambdaFunctionUrl.functionUrl.apply((url) => url); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,177 @@ | ||
| import * as aws from "@pulumi/aws"; | ||
| import * as pulumi from "@pulumi/pulumi"; | ||
| import { defaultTags } from "./tags"; | ||
| import { coreRdsSecretArn } from "./config"; | ||
| ////////////////////////////////////////////////////////////// | ||
| // Create a Lambda function | ||
| ////////////////////////////////////////////////////////////// | ||
|
|
||
| export function createLambdaFunction( | ||
| name: string, | ||
| lambdaDescription: string, | ||
| dockerImageUri: string, | ||
| dockerCmd: string[], | ||
| vpcId: string, | ||
| vpcSubnetIds: string[], | ||
| secretManagerArns: string[], | ||
| environmentVariables: Record<string, string> | ||
| ) { | ||
| // manage lambda role | ||
|
|
||
| const lambdaRole = new aws.iam.Role(`${name}-role`, { | ||
| assumeRolePolicy: JSON.stringify({ | ||
| Version: "2012-10-17", | ||
| Statement: [ | ||
| { | ||
| Action: "sts:AssumeRole", | ||
| Principal: { | ||
| Service: "lambda.amazonaws.com", | ||
| }, | ||
| Effect: "Allow", | ||
| Sid: `${name}LambdaAssumeRole`, | ||
| }, | ||
| ], | ||
| }), | ||
| tags: { | ||
| ...defaultTags, | ||
| Name: `${name}-role`, | ||
| }, | ||
| }); | ||
|
|
||
| // Manage log group permissions | ||
| const logPolicy = new aws.iam.Policy(`${name}-log-policy`, { | ||
| name: `${name}-log-policy`, | ||
| policy: JSON.stringify({ | ||
| Version: "2012-10-17", | ||
| Statement: [ | ||
| { | ||
| Action: ["logs:*"], | ||
| Effect: "Allow", | ||
| Resource: `arn:aws:logs:*:*:*`, | ||
| }, | ||
| ], | ||
| }), | ||
| }); | ||
| new aws.iam.RolePolicyAttachment(`${name}-log-policy-attachment`, { | ||
| policyArn: logPolicy.arn, | ||
| role: lambdaRole.name, | ||
| }); | ||
|
|
||
| // TODO: function accepts a list of additional policies to attach to the role . | ||
| if (vpcId) { | ||
| // add VPC required permissions | ||
| const vpcPolicy = new aws.iam.Policy(`${name}-vpc-policy`, { | ||
| name: `${name}-vpc-policy`, | ||
| policy: JSON.stringify({ | ||
| Version: "2012-10-17", | ||
| Statement: [ | ||
| { | ||
| Action: [ | ||
| "ec2:CreateNetworkInterface", | ||
| "ec2:DescribeNetworkInterfaces", | ||
| "ec2:DeleteNetworkInterface", | ||
| ], | ||
| Effect: "Allow", | ||
| Resource: "*", | ||
| }, | ||
| ], | ||
| }), | ||
| }); | ||
|
|
||
| new aws.iam.RolePolicyAttachment(`${name}-vpc-policy-attachment`, { | ||
| policyArn: vpcPolicy.arn, | ||
| role: lambdaRole.name, | ||
| }); | ||
| } | ||
|
|
||
| // Manage secrets manager | ||
| if (secretManagerArns.length > 0) { | ||
| const secretPolicy = new aws.iam.Policy(`${name}-secret-policy`, { | ||
| name: `${name}-secret-policy`, | ||
| policy: JSON.stringify({ | ||
| Version: "2012-10-17", | ||
| Statement: [ | ||
| { | ||
| Action: ["secretsmanager:GetSecretValue"], | ||
| Effect: "Allow", | ||
| Resource: secretManagerArns, | ||
| }, | ||
| ], | ||
| }), | ||
| }); | ||
| new aws.iam.RolePolicyAttachment(`${name}-secret-policy-attachment`, { | ||
| policyArn: secretPolicy.arn, | ||
| role: lambdaRole.name, | ||
| }); | ||
| } | ||
|
|
||
| // This should be created & parsed only if VPC id is provided | ||
| const lambdaSecurityGroup = new aws.ec2.SecurityGroup(`${name}-sg`, { | ||
| vpcId: vpcId, | ||
| ingress: [ | ||
| { | ||
| protocol: "-1", | ||
| fromPort: 0, | ||
| toPort: 0, | ||
| cidrBlocks: ["0.0.0.0/0"], //TODO: this should be restricted | ||
| }, | ||
| ], | ||
| egress: [ | ||
| { | ||
| protocol: "-1", | ||
| fromPort: 0, | ||
| toPort: 0, | ||
| cidrBlocks: ["0.0.0.0/0"], | ||
| }, | ||
| ], | ||
| tags: { | ||
| ...defaultTags, | ||
| Name: `${name}-sg`, | ||
| }, | ||
| }); | ||
|
|
||
| const lambdaLogGroup = new aws.cloudwatch.LogGroup(`${name}-log-group`, { | ||
| name: `/aws/lambda/${name}`, | ||
| retentionInDays: 14, | ||
| tags: { | ||
| ...defaultTags, | ||
| Name: `${name}-log-group`, | ||
| }, | ||
| }); | ||
|
|
||
| const lambdaFunction = new aws.lambda.Function(`${name}-function`, { | ||
| name: name, | ||
| description: lambdaDescription, | ||
| role: lambdaRole.arn, | ||
| packageType: "Image", | ||
| imageUri: dockerImageUri, | ||
| imageConfig: { | ||
| commands: dockerCmd, | ||
| }, | ||
| memorySize: 128, | ||
| timeout: 120, | ||
| vpcConfig: { | ||
| securityGroupIds: [lambdaSecurityGroup.id], | ||
| subnetIds: vpcSubnetIds, | ||
| }, | ||
| loggingConfig: { | ||
| logFormat: "Text", // select between Text and structured JSON format for your function's logs. | ||
| logGroup: lambdaLogGroup.name, | ||
| // systemLogLevel : "DEBUG" // for JSON structured logs, choose the detail level of the Lambda platform event logs sent to CloudWatch, such as ERROR, DEBUG, or INFO. | ||
| }, | ||
| environment: { | ||
| variables: environmentVariables, | ||
| }, | ||
| }); | ||
|
|
||
| //TODO: make the creation of URL conditional | ||
| const lambdaFunctionUrl = new aws.lambda.FunctionUrl(`${name}-url`, { | ||
| functionName: lambdaFunction.name, | ||
| authorizationType: "AWS_IAM", // Set to "NONE" to bypass IAM authentication and create a public endpoint. | ||
| }); | ||
|
|
||
| return { | ||
| lambdaFunction, | ||
| lambdaFunctionUrl, | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| import { stack } from "./config"; | ||
|
|
||
| export const defaultTags = { | ||
| Application: "ops", | ||
| Repo: "https://github.com/passportxyz/core-infra", | ||
| PulumiStack: stack, | ||
| Environment: stack, | ||
| ManagedBy: "pulumi", | ||
| Name: "missing", | ||
| }; |
Oops, something went wrong.