Skip to content
This repository was archived by the owner on Jan 23, 2025. It is now read-only.

Commit 3b55952

Browse files
robertpeteuilrobertpeteuil
committed
Merge branch 'develop'
2 parents 8f61e6d + 9a37472 commit 3b55952

File tree

4 files changed

+90
-113
lines changed

4 files changed

+90
-113
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ This Lambda Function forwards subject & body of SNS messages to CloudWatch Log G
3535
``` ruby
3636
module "sns_logger" {
3737
source = "robertpeteuil/sns-to-cloudwatch-logs-lambda/aws"
38-
version = "1.0.1"
38+
version = "2.0.0" # HCL2 support for Terraform >= 0.12
39+
# version = "1.0.1" # Latest version for Terraform < 0.12
3940

4041
aws_region = "us-west-2"
4142
sns_topic_name = "projectx-logging"

‎main.tf‎

Lines changed: 51 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
# -----------------------------------------------------------------
44

55
terraform {
6-
required_version = "~> 0.11.7"
6+
required_version = ">= 0.12"
77
}
88

99
provider "aws" {
10-
region = "${var.aws_region}"
11-
version = "~> 2.0"
10+
region = var.aws_region
11+
version = ">= 2.12"
1212
}
1313

1414
# -----------------------------------------------------------------
@@ -17,12 +17,12 @@ provider "aws" {
1717

1818
resource "aws_lambda_layer_version" "logging_base" {
1919
filename = "${path.module}/base_${var.lambda_runtime}.zip"
20-
source_code_hash = "${base64sha256(file("${path.module}/base_${var.lambda_runtime}.zip"))}"
20+
source_code_hash = filebase64sha256("${path.module}/base_${var.lambda_runtime}.zip")
2121

22-
layer_name = "sns-cloudwatch-base-${replace(var.lambda_runtime,".","")}"
22+
layer_name = "sns-cloudwatch-base-${replace(var.lambda_runtime, ".", "")}"
2323
description = "python logging and watchtower libraries"
2424

25-
compatible_runtimes = ["${var.lambda_runtime}"]
25+
compatible_runtimes = [var.lambda_runtime]
2626
}
2727

2828
# -----------------------------------------------------------------
@@ -42,30 +42,30 @@ locals {
4242

4343
# create lambda using function only zip on top of base layer
4444
resource "aws_lambda_function" "sns_cloudwatchlog" {
45-
layers = ["${aws_lambda_layer_version.logging_base.arn}"]
45+
layers = [aws_lambda_layer_version.logging_base.arn]
4646

4747
function_name = "${var.lambda_func_name}-${var.sns_topic_name}"
48-
description = "${length(var.lambda_description) > 0 ? var.lambda_description : local.dynamic_description}"
48+
description = length(var.lambda_description) > 0 ? var.lambda_description : local.dynamic_description
4949

5050
filename = "${path.module}/lambda.zip"
51-
source_code_hash = "${data.archive_file.lambda_function.output_base64sha256}"
51+
source_code_hash = data.archive_file.lambda_function.output_base64sha256
5252

53-
publish = "${var.lambda_publish_func ? 1 : 0}"
54-
role = "${aws_iam_role.lambda_cloudwatch_logs.arn}"
53+
publish = var.lambda_publish_func ? true : false
54+
role = aws_iam_role.lambda_cloudwatch_logs.arn
5555

56-
runtime = "${var.lambda_runtime}"
56+
runtime = var.lambda_runtime
5757
handler = "sns_cloudwatch_gw.main"
58-
timeout = "${var.lambda_timeout}"
59-
memory_size = "${var.lambda_mem_size}"
58+
timeout = var.lambda_timeout
59+
memory_size = var.lambda_mem_size
6060

6161
environment {
6262
variables = {
63-
log_group = "${var.log_group_name}"
64-
log_stream = "${var.log_stream_name}"
63+
log_group = var.log_group_name
64+
log_stream = var.log_stream_name
6565
}
6666
}
6767

68-
tags = "${var.lambda_tags}"
68+
tags = var.lambda_tags
6969
}
7070

7171
# -----------------------------------------------------------------
@@ -76,14 +76,14 @@ resource "aws_lambda_function" "sns_cloudwatchlog" {
7676

7777
# create if specified
7878
resource "aws_sns_topic" "sns_log_topic" {
79-
count = "${var.create_sns_topic ? 1 : 0}"
80-
name = "${var.sns_topic_name}"
79+
count = var.create_sns_topic ? 1 : 0
80+
name = var.sns_topic_name
8181
}
8282

8383
# retrieve topic if not created, arn referenced
8484
data "aws_sns_topic" "sns_log_topic" {
85-
count = "${var.create_sns_topic ? 0 : 1}"
86-
name = "${var.sns_topic_name}"
85+
count = var.create_sns_topic ? 0 : 1
86+
name = var.sns_topic_name
8787
}
8888

8989
# -----------------------------------------------------------------
@@ -92,15 +92,15 @@ data "aws_sns_topic" "sns_log_topic" {
9292
# -----------------------------------------------------------------
9393

9494
resource "aws_cloudwatch_log_group" "sns_logged_item_group" {
95-
count = "${var.create_log_group ? 1 : 0}"
96-
name = "${var.log_group_name}"
97-
retention_in_days = "${var.log_group_retention_days}"
95+
count = var.create_log_group ? 1 : 0
96+
name = var.log_group_name
97+
retention_in_days = var.log_group_retention_days
9898
}
9999

100100
# retrieve log group if not created, arn included in outputs
101101
data "aws_cloudwatch_log_group" "sns_logged_item_group" {
102-
count = "${var.create_log_group ? 0 : 1}"
103-
name = "${var.log_group_name}"
102+
count = var.create_log_group ? 0 : 1
103+
name = var.log_group_name
104104
}
105105

106106
# -----------------------------------------------------------------
@@ -110,45 +110,33 @@ data "aws_cloudwatch_log_group" "sns_logged_item_group" {
110110

111111
# create stream in log_group previously created or specified
112112
resource "aws_cloudwatch_log_stream" "sns_logged_item_stream" {
113-
count = "${var.create_log_stream ? 1 : 0}"
114-
name = "${var.log_stream_name}"
115-
log_group_name = "${var.create_log_group ? join("", aws_cloudwatch_log_group.sns_logged_item_group.*.name) : var.log_group_name}"
113+
count = var.create_log_stream ? 1 : 0
114+
name = var.log_stream_name
115+
log_group_name = var.create_log_group ? aws_cloudwatch_log_group.sns_logged_item_group[0].name : var.log_group_name
116116
}
117117

118118
# -----------------------------------------------------------------
119119
# SUBSCRIBE LAMBDA FUNCTION TO SNS TOPIC
120120
# -----------------------------------------------------------------
121121

122122
resource "aws_sns_topic_subscription" "lambda" {
123-
topic_arn = "${var.create_sns_topic ? join("", aws_sns_topic.sns_log_topic.*.arn) : join("", data.aws_sns_topic.sns_log_topic.*.arn)}"
123+
topic_arn = var.create_sns_topic ? aws_sns_topic.sns_log_topic[0].arn : data.aws_sns_topic.sns_log_topic[0].arn
124124
protocol = "lambda"
125-
endpoint = "${var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.qualified_arn : aws_lambda_function.sns_cloudwatchlog.arn}"
125+
endpoint = var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.qualified_arn : aws_lambda_function.sns_cloudwatchlog.arn
126126
}
127127

128128
# -----------------------------------------------------------------
129129
# ENABLE SNS TOPIC AS LAMBDA FUNCTION TRIGGER
130-
# multiple resource blockss until 'null' parameter feature in Terraform v0.12.0
131130
# -----------------------------------------------------------------
132131

133132
# function published - "qualifier" set to function version
134-
resource "aws_lambda_permission" "sns_cloudwatchlog_published" {
135-
count = "${var.lambda_publish_func ? 1 : 0}"
133+
resource "aws_lambda_permission" "sns_cloudwatchlog_multi" {
136134
statement_id = "AllowExecutionFromSNS"
137135
action = "lambda:InvokeFunction"
138-
function_name = "${aws_lambda_function.sns_cloudwatchlog.function_name}"
136+
function_name = aws_lambda_function.sns_cloudwatchlog.function_name
139137
principal = "sns.amazonaws.com"
140-
source_arn = "${var.create_sns_topic ? join("", aws_sns_topic.sns_log_topic.*.arn) : join("", data.aws_sns_topic.sns_log_topic.*.arn)}"
141-
qualifier = "${aws_lambda_function.sns_cloudwatchlog.version}"
142-
}
143-
144-
# function not published - dont specify "qualifier" parameter
145-
resource "aws_lambda_permission" "sns_cloudwatchlog" {
146-
count = "${var.lambda_publish_func ? 0 : 1}"
147-
statement_id = "AllowExecutionFromSNS"
148-
action = "lambda:InvokeFunction"
149-
function_name = "${aws_lambda_function.sns_cloudwatchlog.function_name}"
150-
principal = "sns.amazonaws.com"
151-
source_arn = "${var.create_sns_topic ? join("", aws_sns_topic.sns_log_topic.*.arn) : join("", data.aws_sns_topic.sns_log_topic.*.arn)}"
138+
source_arn = var.create_sns_topic ? aws_sns_topic.sns_log_topic[0].arn : data.aws_sns_topic.sns_log_topic[0].arn
139+
qualifier = var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.version : null
152140
}
153141

154142
# -------------------------------------------------------------------------------------
@@ -158,22 +146,22 @@ resource "aws_lambda_permission" "sns_cloudwatchlog" {
158146
# Create IAM role
159147
resource "aws_iam_role" "lambda_cloudwatch_logs" {
160148
name = "lambda-${lower(var.lambda_func_name)}-${var.sns_topic_name}"
161-
assume_role_policy = "${data.aws_iam_policy_document.lambda_cloudwatch_logs.json}"
149+
assume_role_policy = data.aws_iam_policy_document.lambda_cloudwatch_logs.json
162150
}
163151

164152
# Add base Lambda Execution policy
165153
resource "aws_iam_role_policy" "lambda_cloudwatch_logs_polcy" {
166154
name = "lambda-${lower(var.lambda_func_name)}-policy-${var.sns_topic_name}"
167-
role = "${aws_iam_role.lambda_cloudwatch_logs.id}"
168-
policy = "${data.aws_iam_policy_document.lambda_cloudwatch_logs_policy.json}"
155+
role = aws_iam_role.lambda_cloudwatch_logs.id
156+
policy = data.aws_iam_policy_document.lambda_cloudwatch_logs_policy.json
169157
}
170158

171159
# JSON POLICY - assume role
172160
data "aws_iam_policy_document" "lambda_cloudwatch_logs" {
173161
statement {
174162
actions = ["sts:AssumeRole"]
175163

176-
principals = {
164+
principals {
177165
type = "Service"
178166
identifiers = ["lambda.amazonaws.com"]
179167
}
@@ -199,7 +187,7 @@ data "aws_iam_policy_document" "lambda_cloudwatch_logs_policy" {
199187

200188
# create cloudwatch event to run every 15 minutes
201189
resource "aws_cloudwatch_event_rule" "warmer" {
202-
count = "${var.create_warmer_event ? 1 : 0}"
190+
count = var.create_warmer_event ? 1 : 0
203191

204192
name = "sns-logger-warmer-${var.sns_topic_name}"
205193
description = "Keeps ${var.lambda_func_name} Warm"
@@ -208,11 +196,12 @@ resource "aws_cloudwatch_event_rule" "warmer" {
208196

209197
# set event target as sns_to_cloudwatch_logs lambda function
210198
resource "aws_cloudwatch_event_target" "warmer" {
211-
count = "${var.create_warmer_event ? 1 : 0}"
199+
count = var.create_warmer_event ? 1 : 0
212200

213-
rule = "${aws_cloudwatch_event_rule.warmer.name}"
201+
# rule = join("", aws_cloudwatch_event_rule.warmer.*.name)
202+
rule = aws_cloudwatch_event_rule.warmer[0].name
214203
target_id = "Lambda"
215-
arn = "${var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.qualified_arn : aws_lambda_function.sns_cloudwatchlog.arn}"
204+
arn = var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.qualified_arn : aws_lambda_function.sns_cloudwatchlog.arn
216205

217206
input = <<JSON
218207
{
@@ -225,28 +214,13 @@ JSON
225214

226215
# -----------------------------------------------------------------
227216
# ENABLE CLOUDWATCH EVENT AS LAMBDA FUNCTION TRIGGER
228-
# multiple resource blockss until 'null' parameter feature in Terraform v0.12.0
229217
# -----------------------------------------------------------------
230218

231-
# function published - "qualifier" set to function version
232-
resource "aws_lambda_permission" "warmer_published" {
233-
count = "${var.create_warmer_event ? var.lambda_publish_func ? 1 : 0 : 0}"
234-
235-
statement_id = "AllowExecutionFromCloudWatch"
236-
action = "lambda:InvokeFunction"
237-
function_name = "${aws_lambda_function.sns_cloudwatchlog.function_name}"
238-
principal = "events.amazonaws.com"
239-
source_arn = "${aws_cloudwatch_event_rule.warmer.arn}"
240-
qualifier = "${aws_lambda_function.sns_cloudwatchlog.version}"
241-
}
242-
243-
# function not published - dont specify "qualifier" parameter
244-
resource "aws_lambda_permission" "warmer" {
245-
count = "${var.create_warmer_event ? var.lambda_publish_func ? 0 : 1 : 0}"
246-
247-
statement_id = "AllowExecutionFromCloudWatch"
248-
action = "lambda:InvokeFunction"
249-
function_name = "${aws_lambda_function.sns_cloudwatchlog.function_name}"
250-
principal = "events.amazonaws.com"
251-
source_arn = "${aws_cloudwatch_event_rule.warmer.arn}"
219+
resource "aws_lambda_permission" "warmer_multi" {
220+
statement_id = "AllowExecutionFromCloudWatch"
221+
action = "lambda:InvokeFunction"
222+
function_name = aws_lambda_function.sns_cloudwatchlog.function_name
223+
principal = "events.amazonaws.com"
224+
source_arn = aws_cloudwatch_event_rule.warmer[0].arn
225+
qualifier = var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.version : null
252226
}

‎outputs.tf‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,65 +4,66 @@
44

55
output "lambda_name" {
66
description = "Name assigned to Lambda Function."
7-
value = "${var.lambda_func_name}"
7+
value = var.lambda_func_name
88
}
99

1010
output "lambda_arn" {
1111
description = "ARN of created Lambda Function."
12-
value = "${var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.qualified_arn : aws_lambda_function.sns_cloudwatchlog.arn}"
12+
value = var.lambda_publish_func ? aws_lambda_function.sns_cloudwatchlog.qualified_arn : aws_lambda_function.sns_cloudwatchlog.arn
1313
}
1414

1515
output "lambda_version" {
1616
description = "Latest published version of Lambda Function."
17-
value = "${aws_lambda_function.sns_cloudwatchlog.version}"
17+
value = aws_lambda_function.sns_cloudwatchlog.version
1818
}
1919

2020
output "lambda_last_modified" {
2121
description = "The date Lambda Function was last modified."
22-
value = "${aws_lambda_function.sns_cloudwatchlog.last_modified}"
22+
value = aws_lambda_function.sns_cloudwatchlog.last_modified
2323
}
2424

2525
output "lambda_iam_role_id" {
2626
description = "Lambda IAM Role ID."
27-
value = "${aws_iam_role.lambda_cloudwatch_logs.id}"
27+
value = aws_iam_role.lambda_cloudwatch_logs.id
2828
}
2929

3030
output "lambda_iam_role_arn" {
3131
description = "Lambda IAM Role ARN."
32-
value = "${aws_iam_role.lambda_cloudwatch_logs.arn}"
32+
value = aws_iam_role.lambda_cloudwatch_logs.arn
3333
}
3434

3535
output "sns_topic_name" {
3636
description = "Name of SNS Topic logging to CloudWatch Log."
37-
value = "${var.sns_topic_name}"
37+
value = var.sns_topic_name
3838
}
3939

4040
output "sns_topic_arn" {
4141
description = "ARN of SNS Topic logging to CloudWatch Log."
42-
value = "${var.create_sns_topic ? join("", aws_sns_topic.sns_log_topic.*.arn) : join("", data.aws_sns_topic.sns_log_topic.*.arn)}"
42+
value = var.create_sns_topic ? aws_sns_topic.sns_log_topic[0].arn : data.aws_sns_topic.sns_log_topic[0].arn
4343
}
4444

4545
output "log_group_name" {
4646
description = "Name of CloudWatch Log Group."
47-
value = "${var.log_group_name}"
47+
value = var.log_group_name
4848
}
4949

5050
output "log_group_arn" {
5151
description = "ARN of CloudWatch Log Group."
52-
value = "${var.create_log_group ? join("", aws_cloudwatch_log_group.sns_logged_item_group.*.arn) : join("", data.aws_cloudwatch_log_group.sns_logged_item_group.*.arn)}"
52+
value = var.create_log_group ? aws_cloudwatch_log_group.sns_logged_item_group[0].arn : data.aws_cloudwatch_log_group.sns_logged_item_group[0].arn
5353
}
5454

5555
output "log_stream_name" {
5656
description = "Name of CloudWatch Log Stream."
57-
value = "${var.log_stream_name}"
57+
value = var.log_stream_name
5858
}
5959

6060
output "log_stream_arn" {
6161
description = "ARN of CloudWatch Log Stream."
62-
value = "${var.create_sns_topic ? join("", aws_sns_topic.sns_log_topic.*.arn) : join("", data.aws_sns_topic.sns_log_topic.*.arn)}"
62+
value = var.create_sns_topic ? aws_sns_topic.sns_log_topic[0].arn : data.aws_sns_topic.sns_log_topic[0].arn
6363
}
6464

6565
output "cloudwatch_event_rule_arn" {
6666
description = "ARN of CloudWatch Trigger Event created to prevent hibernation."
67-
value = "${join("", aws_cloudwatch_event_rule.warmer.*.arn)}"
67+
value = aws_cloudwatch_event_rule.warmer[0].arn
6868
}
69+

0 commit comments

Comments
 (0)