# README
tf-aws-module_collection-lambda_function
Overview
Provisions a Lambda Function.
Pre-Commit hooks
.pre-commit-config.yaml file defines certain pre-commit
hooks that are relevant to terraform, golang and common linting tasks. There are no custom hooks added.
commitlint
hook enforces commit message in certain format. The commit contains the following structural elements, to communicate intent to the consumers of your commit messages:
- fix: a commit of the type
fix
patches a bug in your codebase (this correlates with PATCH in Semantic Versioning). - feat: a commit of the type
feat
introduces a new feature to the codebase (this correlates with MINOR in Semantic Versioning). - BREAKING CHANGE: a commit that has a footer
BREAKING CHANGE:
, or appends a!
after the type/scope, introduces a breaking API change (correlating with MAJOR in Semantic Versioning). A BREAKING CHANGE can be part of commits of any type. footers other than BREAKING CHANGE: may be provided and follow a convention similar to git trailer format. - build: a commit of the type
build
adds changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm) - chore: a commit of the type
chore
adds changes that don't modify src or test files - ci: a commit of the type
ci
adds changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs) - docs: a commit of the type
docs
adds documentation only changes - perf: a commit of the type
perf
adds code change that improves performance - refactor: a commit of the type
refactor
adds code change that neither fixes a bug nor adds a feature - revert: a commit of the type
revert
reverts a previous commit - style: a commit of the type
style
adds code changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc) - test: a commit of the type
test
adds missing tests or correcting existing tests
Base configuration used for this project is commitlint-config-conventional (based on the Angular convention)
If you are a developer using vscode, this plugin may be helpful.
detect-secrets-hook
prevents new secrets from being introduced into the baseline. TODO: INSERT DOC LINK ABOUT HOOKS
In order for pre-commit
hooks to work properly
- You need to have the pre-commit package manager installed. Here are the installation instructions.
pre-commit
would install all the hooks when commit message is added by default except forcommitlint
hook.commitlint
hook would need to be installed manually using the command below
pre-commit install --hook-type commit-msg
To test the resource group module locally
- For development/enhancements to this module locally, you'll need to install all of its components. This is controlled by the
configure
target in the project'sMakefile
. Before you can runconfigure
, familiarize yourself with the variables in theMakefile
and ensure they're pointing to the right places.
make configure
This adds in several files and directories that are ignored by git
. They expose many new Make targets.
- THIS STEP APPLIES ONLY TO MICROSOFT AZURE. IF YOU ARE USING A DIFFERENT PLATFORM PLEASE SKIP THIS STEP. The first target you care about is
env
. This is the common interface for setting up environment variables. The values of the environment variables will be used to authenticate with cloud provider from local development workstation.
make configure
command will bring down azure_env.sh
file on local workstation. Devloper would need to modify this file, replace the environment variable values with relevant values.
These environment variables are used by terratest
integration suit.
Service principle used for authentication(value of ARM_CLIENT_ID) should have below privileges on resource group within the subscription.
"Microsoft.Resources/subscriptions/resourceGroups/write"
"Microsoft.Resources/subscriptions/resourceGroups/read"
"Microsoft.Resources/subscriptions/resourceGroups/delete"
Then run this make target to set the environment variables on developer workstation.
make env
- The first target you care about is
check
.
Pre-requisites
Before running this target it is important to ensure that, developer has created files mentioned below on local workstation under root directory of git repository that contains code for primitives/segments. Note that these files are azure
specific. If primitive/segment under development uses any other cloud provider than azure, this section may not be relevant.
- A file named
provider.tf
with contents below
provider "azurerm" {
features {}
}
- A file named
terraform.tfvars
which contains key value pair of variables used.
Note that since these files are added in gitignore
they would not be checked in into primitive/segment's git repo.
After creating these files, for running tests associated with the primitive/segment, run
make check
If make check
target is successful, developer is good to commit the code to primitive/segment's git repo.
make check
target
- runs
terraform commands
tolint
,validate
andplan
terraform code. - runs
conftests
.conftests
make surepolicy
checks are successful. - runs
terratest
. This is integration test suit. - runs
opa
tests
Requirements
Name | Version |
---|---|
terraform | ~> 1.5 |
aws | ~> 5.14 |
Providers
No providers.
Modules
Name | Source | Version |
---|---|---|
lambda_function | terraform-aws-modules/lambda/aws | ~> 7.4 |
Resources
No resources.
Inputs
Name | Description | Type | Default | Required |
---|---|---|---|---|
name | The name of this Lambda Function | string | n/a | yes |
description | Description of your Lambda Function | string | "" | no |
handler | Lambda Function entrypoint in your code | string | "index.lambda_handler" | no |
runtime | Lambda Function runtime | string | "python3.9" | no |
architectures | (Optional) Instruction set architecture for your Lambda function. Valid architectures are x86_64 (default) and arm64. | list(string) | [ | no |
publish | Whether to publish creation/change as new Lambda Function Version. | bool | true | no |
ephemeral_storage_size | mount of ephemeral storage (/tmp) in MB your Lambda Function can use at runtime. Valid values are between 512 MB to 10,240 MB (10 GB). | number | 512 | no |
environment_variables | A map that defines environment variables for the Lambda Function. | map(string) | {} | no |
memory_size | Amount of memory in MB your Lambda Function can use at runtime. Valid values are between 128 MB to 10,240 MB (10 GB), in 64 MB increments. | number | 128 | no |
timeout | The amount of time your Lambda Function has to run in seconds. The maximum lifetime of a Lambda function execution is 15 minutes (900 seconds). | number | 3 | no |
create_package | Controls whether Lambda package should be created | bool | false | no |
source_path | The absolute path to a local file or directory containing your Lambda source code. Only valid if create_package is set to true . | any | null | no |
zip_file_path | Path of the source zip file with respect to module root | string | null | no |
store_on_s3 | Whether to store produced artifacts on S3 or locally. | bool | false | no |
s3_existing_package | The S3 bucket object with keys bucket, key, version pointing to an existing zip-file to use. Only valid if create_package is set to false . | map(string) | null | no |
s3_bucket | S3 bucket to store artifacts. Required if store_on_s3 is set to true , ignored otherwise. | string | null | no |
s3_prefix | Directory name where artifacts should be stored in the S3 bucket. Defaults to builds . Required if store_on_s3 is set to true , ignored otherwise. | string | "builds" | no |
layers | List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. | list(string) | null | no |
hash_extra | The string to add into hashing function. Useful when building same source path for different functions. | string | "" | no |
ignore_source_code_hash | Whether to ignore changes to the function's source code hash. Set to true if you manage infrastructure and code deployments separately. | bool | false | no |
authorization_type | The type of authentication that the Lambda Function URL uses. Set to AWS_IAM to restrict access to authenticated IAM users only. Set to NONE to bypass IAM authentication and create a public endpoint (default). | string | "NONE" | no |
cors | CORS settings to be used by the Lambda Function URL | object({ | {} | no |
create_lambda_function_url | Whether the Lambda Function URL resource should be created (default true). | bool | true | no |
invoke_mode | Invoke mode of the Lambda Function URL. Valid values are BUFFERED (default) and RESPONSE_STREAM . | string | "BUFFERED" | no |
attach_policy_statements | Controls whether policy_statements should be added to IAM role for Lambda Function | bool | false | no |
policy_statements | Map of dynamic policy statements to attach to Lambda Function role | map(string) | {} | no |
attach_policy | Controls whether policy should be added to IAM role for Lambda Function | bool | false | no |
policy | Policy statement ARN to attach to Lambda Function role | string | null | no |
attach_policies | Controls whether policies should be added to IAM role for Lambda Function | bool | false | no |
policies | List of policy statement ARNs to attach to Lambda Function role | list(string) | [] | no |
attach_policy_json | Controls whether policy_json should be added to IAM role for Lambda Function | bool | false | no |
policy_json | An additional policy document as JSON to attach to the Lambda Function role | string | null | no |
attach_policy_jsons | Controls whether policy_jsons should be added to IAM role for Lambda Function | bool | false | no |
policy_jsons | An additional policy documents as JSON to attach to the Lambda Function role | list(string) | [] | no |
attach_dead_letter_policy | Controls whether SNS/SQS dead letter notification policy should be added to IAM role for Lambda Function. Defaults to false . | bool | false | no |
dead_letter_target_arn | The ARN of an SNS topic or SQS queue to notify when an invocation fails. | string | null | no |
attach_network_policy | Controls whether VPC/network policy should be added to IAM role for Lambda Function | bool | false | no |
attach_async_event_policy | Controls whether async event policy should be added to IAM role for Lambda Function | bool | false | no |
attach_tracing_policy | Controls whether X-Ray tracing policy should be added to IAM role for Lambda Function | bool | false | no |
assume_role_policy_statements | Map of dynamic policy statements for assuming Lambda Function role (trust relationship) | map(string) | {} | no |
trusted_entities | List of additional trusted entities for assuming Lambda Function role (trust relationship) | any | [] | no |
allowed_triggers | Map of allowed triggers to create Lambda permissions | map(any) | {} | no |
attach_cloudwatch_logs_policy | Controls whether CloudWatch Logs policy should be added to IAM role for Lambda Function | bool | true | no |
attach_create_log_group_permission | Controls whether to add the create log group permission to the CloudWatch logs policy | bool | true | no |
cloudwatch_logs_kms_key_id | The ARN of the KMS Key to use when encrypting log data. | string | null | no |
cloudwatch_logs_log_group_class | Specified the log class of the log group. Possible values are: STANDARD (default) or INFREQUENT_ACCESS | string | "STANDARD" | no |
cloudwatch_logs_retention_in_days | Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Defaults to 30. | number | 30 | no |
cloudwatch_logs_skip_destroy | Whether to keep the log group (and any logs it may contain) at destroy time. Defaults to false. | bool | false | no |
cloudwatch_logs_tags | A map of tags to assign to the logs resource. | map(string) | {} | no |
tracing_mode | Tracing mode of the Lambda Function. Valid value can be either PassThrough (default) or Active. | string | "PassThrough" | no |
vpc_security_group_ids | List of security group ids when Lambda Function should run in the VPC. | list(string) | null | no |
vpc_subnet_ids | List of subnet ids when Lambda Function should run in the VPC. Usually private or intra subnets. | list(string) | null | no |
lambda_at_edge | Set this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the function | bool | false | no |
lambda_at_edge_logs_all_regions | Whether to specify a wildcard in IAM policy used by Lambda@Edge to allow logging in all regions | bool | true | no |
tags | Map of tags to apply to this resource. | map(string) | {} | no |
create | Controls whether resources should be created. | bool | false | no |
Outputs
Name | Description |
---|---|
lambda_function_arn | n/a |
lambda_function_name | n/a |
lambda_cloudwatch_log_group_arn | n/a |
lambda_cloudwatch_log_group_name | n/a |
lambda_function_url | n/a |
lambda_role_arn | n/a |
lambda_role_name | n/a |