Categorygithub.com/launchbynttdata/tf-aws-module_primitive-lambda_function
module
0.0.0-20250204002315-2e865373f9f8
Repository: https://github.com/launchbynttdata/tf-aws-module_primitive-lambda_function.git
Documentation: pkg.go.dev

# README

tf-aws-module_collection-lambda_function

License License: CC BY-NC-ND 4.0

Overview

Provisions a Lambda Function.

Pre-Commit hooks

.pre-commit-config.yaml file defines certain pre-commit hooks that are relevant to terraform, golang and common linting tasks. There are no custom hooks added.

commitlint hook enforces commit message in certain format. The commit contains the following structural elements, to communicate intent to the consumers of your commit messages:

  • fix: a commit of the type fix patches a bug in your codebase (this correlates with PATCH in Semantic Versioning).
  • feat: a commit of the type feat introduces a new feature to the codebase (this correlates with MINOR in Semantic Versioning).
  • BREAKING CHANGE: a commit that has a footer BREAKING CHANGE:, or appends a ! after the type/scope, introduces a breaking API change (correlating with MAJOR in Semantic Versioning). A BREAKING CHANGE can be part of commits of any type. footers other than BREAKING CHANGE: may be provided and follow a convention similar to git trailer format.
  • build: a commit of the type build adds changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
  • chore: a commit of the type chore adds changes that don't modify src or test files
  • ci: a commit of the type ci adds changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
  • docs: a commit of the type docs adds documentation only changes
  • perf: a commit of the type perf adds code change that improves performance
  • refactor: a commit of the type refactor adds code change that neither fixes a bug nor adds a feature
  • revert: a commit of the type revert reverts a previous commit
  • style: a commit of the type style adds code changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
  • test: a commit of the type test adds missing tests or correcting existing tests

Base configuration used for this project is commitlint-config-conventional (based on the Angular convention)

If you are a developer using vscode, this plugin may be helpful.

detect-secrets-hook prevents new secrets from being introduced into the baseline. TODO: INSERT DOC LINK ABOUT HOOKS

In order for pre-commit hooks to work properly

  • You need to have the pre-commit package manager installed. Here are the installation instructions.
  • pre-commit would install all the hooks when commit message is added by default except for commitlint hook. commitlint hook would need to be installed manually using the command below
pre-commit install --hook-type commit-msg

To test the resource group module locally

  1. For development/enhancements to this module locally, you'll need to install all of its components. This is controlled by the configure target in the project's Makefile. Before you can run configure, familiarize yourself with the variables in the Makefile and ensure they're pointing to the right places.
make configure

This adds in several files and directories that are ignored by git. They expose many new Make targets.

  1. THIS STEP APPLIES ONLY TO MICROSOFT AZURE. IF YOU ARE USING A DIFFERENT PLATFORM PLEASE SKIP THIS STEP. The first target you care about is env. This is the common interface for setting up environment variables. The values of the environment variables will be used to authenticate with cloud provider from local development workstation.

make configure command will bring down azure_env.sh file on local workstation. Devloper would need to modify this file, replace the environment variable values with relevant values.

These environment variables are used by terratest integration suit.

Service principle used for authentication(value of ARM_CLIENT_ID) should have below privileges on resource group within the subscription.

"Microsoft.Resources/subscriptions/resourceGroups/write"
"Microsoft.Resources/subscriptions/resourceGroups/read"
"Microsoft.Resources/subscriptions/resourceGroups/delete"

Then run this make target to set the environment variables on developer workstation.

make env
  1. The first target you care about is check.

Pre-requisites Before running this target it is important to ensure that, developer has created files mentioned below on local workstation under root directory of git repository that contains code for primitives/segments. Note that these files are azure specific. If primitive/segment under development uses any other cloud provider than azure, this section may not be relevant.

  • A file named provider.tf with contents below
provider "azurerm" {
  features {}
}
  • A file named terraform.tfvars which contains key value pair of variables used.

Note that since these files are added in gitignore they would not be checked in into primitive/segment's git repo.

After creating these files, for running tests associated with the primitive/segment, run

make check

If make check target is successful, developer is good to commit the code to primitive/segment's git repo.

make check target

  • runs terraform commands to lint,validate and plan terraform code.
  • runs conftests. conftests make sure policy checks are successful.
  • runs terratest. This is integration test suit.
  • runs opa tests

Requirements

NameVersion
terraform~> 1.5
aws~> 5.14

Providers

No providers.

Modules

NameSourceVersion
lambda_functionterraform-aws-modules/lambda/aws~> 7.4

Resources

No resources.

Inputs

NameDescriptionTypeDefaultRequired
nameThe name of this Lambda Functionstringn/ayes
descriptionDescription of your Lambda Functionstring""no
handlerLambda Function entrypoint in your codestring"index.lambda_handler"no
runtimeLambda Function runtimestring"python3.9"no
architectures(Optional) Instruction set architecture for your Lambda function. Valid architectures are x86_64 (default) and arm64.list(string)
[
"x86_64"
]
no
publishWhether to publish creation/change as new Lambda Function Version.booltrueno
ephemeral_storage_sizemount of ephemeral storage (/tmp) in MB your Lambda Function can use at runtime. Valid values are between 512 MB to 10,240 MB (10 GB).number512no
environment_variablesA map that defines environment variables for the Lambda Function.map(string){}no
memory_sizeAmount of memory in MB your Lambda Function can use at runtime. Valid values are between 128 MB to 10,240 MB (10 GB), in 64 MB increments.number128no
timeoutThe amount of time your Lambda Function has to run in seconds. The maximum lifetime of a Lambda function execution is 15 minutes (900 seconds).number3no
create_packageControls whether Lambda package should be createdboolfalseno
source_pathThe absolute path to a local file or directory containing your Lambda source code. Only valid if create_package is set to true.anynullno
zip_file_pathPath of the source zip file with respect to module rootstringnullno
store_on_s3Whether to store produced artifacts on S3 or locally.boolfalseno
s3_existing_packageThe S3 bucket object with keys bucket, key, version pointing to an existing zip-file to use. Only valid if create_package is set to false.map(string)nullno
s3_bucketS3 bucket to store artifacts. Required if store_on_s3 is set to true, ignored otherwise.stringnullno
s3_prefixDirectory name where artifacts should be stored in the S3 bucket. Defaults to builds. Required if store_on_s3 is set to true, ignored otherwise.string"builds"no
layersList of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function.list(string)nullno
hash_extraThe string to add into hashing function. Useful when building same source path for different functions.string""no
ignore_source_code_hashWhether to ignore changes to the function's source code hash. Set to true if you manage infrastructure and code deployments separately.boolfalseno
authorization_typeThe type of authentication that the Lambda Function URL uses. Set to AWS_IAM to restrict access to authenticated IAM users only. Set to NONE to bypass IAM authentication and create a public endpoint (default).string"NONE"no
corsCORS settings to be used by the Lambda Function URL
object({
allow_credentials = optional(bool, false)
allow_headers = optional(list(string), null)
allow_methods = optional(list(string), null)
allow_origins = optional(list(string), null)
expose_headers = optional(list(string), null)
max_age = optional(number, 0)
})
{}no
create_lambda_function_urlWhether the Lambda Function URL resource should be created (default true).booltrueno
invoke_modeInvoke mode of the Lambda Function URL. Valid values are BUFFERED (default) and RESPONSE_STREAM.string"BUFFERED"no
attach_policy_statementsControls whether policy_statements should be added to IAM role for Lambda Functionboolfalseno
policy_statementsMap of dynamic policy statements to attach to Lambda Function rolemap(string){}no
attach_policyControls whether policy should be added to IAM role for Lambda Functionboolfalseno
policyPolicy statement ARN to attach to Lambda Function rolestringnullno
attach_policiesControls whether policies should be added to IAM role for Lambda Functionboolfalseno
policiesList of policy statement ARNs to attach to Lambda Function rolelist(string)[]no
attach_policy_jsonControls whether policy_json should be added to IAM role for Lambda Functionboolfalseno
policy_jsonAn additional policy document as JSON to attach to the Lambda Function rolestringnullno
attach_policy_jsonsControls whether policy_jsons should be added to IAM role for Lambda Functionboolfalseno
policy_jsonsAn additional policy documents as JSON to attach to the Lambda Function rolelist(string)[]no
attach_dead_letter_policyControls whether SNS/SQS dead letter notification policy should be added to IAM role for Lambda Function. Defaults to false.boolfalseno
dead_letter_target_arnThe ARN of an SNS topic or SQS queue to notify when an invocation fails.stringnullno
attach_network_policyControls whether VPC/network policy should be added to IAM role for Lambda Functionboolfalseno
attach_async_event_policyControls whether async event policy should be added to IAM role for Lambda Functionboolfalseno
attach_tracing_policyControls whether X-Ray tracing policy should be added to IAM role for Lambda Functionboolfalseno
assume_role_policy_statementsMap of dynamic policy statements for assuming Lambda Function role (trust relationship)map(string){}no
trusted_entitiesList of additional trusted entities for assuming Lambda Function role (trust relationship)any[]no
allowed_triggersMap of allowed triggers to create Lambda permissionsmap(any){}no
attach_cloudwatch_logs_policyControls whether CloudWatch Logs policy should be added to IAM role for Lambda Functionbooltrueno
attach_create_log_group_permissionControls whether to add the create log group permission to the CloudWatch logs policybooltrueno
cloudwatch_logs_kms_key_idThe ARN of the KMS Key to use when encrypting log data.stringnullno
cloudwatch_logs_log_group_classSpecified the log class of the log group. Possible values are: STANDARD (default) or INFREQUENT_ACCESSstring"STANDARD"no
cloudwatch_logs_retention_in_daysSpecifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Defaults to 30.number30no
cloudwatch_logs_skip_destroyWhether to keep the log group (and any logs it may contain) at destroy time. Defaults to false.boolfalseno
cloudwatch_logs_tagsA map of tags to assign to the logs resource.map(string){}no
tracing_modeTracing mode of the Lambda Function. Valid value can be either PassThrough (default) or Active.string"PassThrough"no
vpc_security_group_idsList of security group ids when Lambda Function should run in the VPC.list(string)nullno
vpc_subnet_idsList of subnet ids when Lambda Function should run in the VPC. Usually private or intra subnets.list(string)nullno
lambda_at_edgeSet this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the functionboolfalseno
lambda_at_edge_logs_all_regionsWhether to specify a wildcard in IAM policy used by Lambda@Edge to allow logging in all regionsbooltrueno
tagsMap of tags to apply to this resource.map(string){}no
createControls whether resources should be created.boolfalseno

Outputs

NameDescription
lambda_function_arnn/a
lambda_function_namen/a
lambda_cloudwatch_log_group_arnn/a
lambda_cloudwatch_log_group_namen/a
lambda_function_urln/a
lambda_role_arnn/a
lambda_role_namen/a

# Packages

No description provided by the author