Skip to content

Commit

Permalink
♻️ Use inline instead of managed policies
Browse files Browse the repository at this point in the history
  • Loading branch information
@RafaelWO
RafaelWO committed Aug 29, 2024
1 parent 1d12240 commit f86cdf4
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 78 deletions.
18 changes: 6 additions & 12 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -689,23 +689,17 @@ No modules.
| Name | Type |
|------|------|
| [aws_cloudwatch_log_group.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
| [aws_iam_policy.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_role.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy_attachment.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy_attachment.additional_many](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.additional_one](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_lambda_event_source_mapping.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
Expand Down
72 changes: 12 additions & 60 deletions iam.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -131,20 +131,12 @@ data "aws_iam_policy_document" "logs" {
}
}

resource "aws_iam_policy" "logs" {
resource "aws_iam_role_policy" "logs" {
count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0

name = "${local.policy_name}-logs"
path = var.policy_path
role = aws_iam_role.lambda[0].name
policy = data.aws_iam_policy_document.logs[0].json
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "logs" {
count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0

role = aws_iam_role.lambda[0].name
policy_arn = aws_iam_policy.logs[0].arn
}

#####################
Expand All @@ -168,20 +160,12 @@ data "aws_iam_policy_document" "dead_letter" {
}
}

resource "aws_iam_policy" "dead_letter" {
resource "aws_iam_role_policy" "dead_letter" {
count = local.create_role && var.attach_dead_letter_policy ? 1 : 0

name = "${local.policy_name}-dl"
path = var.policy_path
role = aws_iam_role.lambda[0].name
policy = data.aws_iam_policy_document.dead_letter[0].json
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "dead_letter" {
count = local.create_role && var.attach_dead_letter_policy ? 1 : 0

role = aws_iam_role.lambda[0].name
policy_arn = aws_iam_policy.dead_letter[0].arn
}

######
Expand Down Expand Up @@ -259,60 +243,36 @@ data "aws_iam_policy_document" "async" {
}
}

resource "aws_iam_policy" "async" {
resource "aws_iam_role_policy" "async" {
count = local.create_role && var.attach_async_event_policy ? 1 : 0

name = "${local.policy_name}-async"
path = var.policy_path
role = aws_iam_role.lambda[0].name
policy = data.aws_iam_policy_document.async[0].json
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "async" {
count = local.create_role && var.attach_async_event_policy ? 1 : 0

role = aws_iam_role.lambda[0].name
policy_arn = aws_iam_policy.async[0].arn
}

###########################
# Additional policy (JSON)
###########################

resource "aws_iam_policy" "additional_json" {
resource "aws_iam_role_policy" "additional_json" {
count = local.create_role && var.attach_policy_json ? 1 : 0

name = local.policy_name
path = var.policy_path
role = aws_iam_role.lambda[0].name
policy = var.policy_json
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "additional_json" {
count = local.create_role && var.attach_policy_json ? 1 : 0

role = aws_iam_role.lambda[0].name
policy_arn = aws_iam_policy.additional_json[0].arn
}

#####################################
# Additional policies (list of JSON)
#####################################

resource "aws_iam_policy" "additional_jsons" {
resource "aws_iam_role_policy" "additional_jsons" {
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0

name = "${local.policy_name}-${count.index}"
path = var.policy_path
role = aws_iam_role.lambda[0].name
policy = var.policy_jsons[count.index]
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "additional_jsons" {
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0

role = aws_iam_role.lambda[0].name
policy_arn = aws_iam_policy.additional_jsons[count.index].arn
}

###########################
Expand Down Expand Up @@ -383,18 +343,10 @@ data "aws_iam_policy_document" "additional_inline" {
}
}

resource "aws_iam_policy" "additional_inline" {
resource "aws_iam_role_policy" "additional_inline" {
count = local.create_role && var.attach_policy_statements ? 1 : 0

name = "${local.policy_name}-inline"
path = var.policy_path
role = aws_iam_role.lambda[0].name
policy = data.aws_iam_policy_document.additional_inline[0].json
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "additional_inline" {
count = local.create_role && var.attach_policy_statements ? 1 : 0

role = aws_iam_role.lambda[0].name
policy_arn = aws_iam_policy.additional_inline[0].arn
}
6 changes: 0 additions & 6 deletions main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -153,14 +153,8 @@ resource "aws_lambda_function" "this" {
aws_cloudwatch_log_group.lambda,

# Before the lambda is created the execution role with all its policies should be ready
aws_iam_role_policy_attachment.additional_inline,
aws_iam_role_policy_attachment.additional_json,
aws_iam_role_policy_attachment.additional_jsons,
aws_iam_role_policy_attachment.additional_many,
aws_iam_role_policy_attachment.additional_one,
aws_iam_role_policy_attachment.async,
aws_iam_role_policy_attachment.logs,
aws_iam_role_policy_attachment.dead_letter,
aws_iam_role_policy_attachment.vpc,
aws_iam_role_policy_attachment.tracing,
]
Expand Down

0 comments on commit f86cdf4

Please sign in to comment.