mirror of
https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git
synced 2026-09-30 05:33:12 +00:00
1ab787308e
Employees and admins can pick, drop, swap, and manage coverage through GET/POST/DELETE /api/shifts. Roster PUT accepts optional email for portal identity. Slack slash commands and App Home admin modals stay in place. Co-authored-by: adam <adam@seahavenind.com>
334 lines
12 KiB
HCL
334 lines
12 KiB
HCL
# Terraform owns the function skeletons (role, runtime, memory, environment).
|
|
# Code is owned by .github/workflows/deploy.yaml, which uploads
|
|
# functions/<name>/<sha>.zip and calls update-function-code. The lifecycle
|
|
# block is the seam: an app deploy is not drift, and a Terraform apply never
|
|
# rolls the code back to the bootstrap stub. GIT_SHA is written into
|
|
# shared/build_info.py at zip time, not set here.
|
|
|
|
data "aws_iam_policy_document" "lambda_assume" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRole"]
|
|
|
|
principals {
|
|
type = "Service"
|
|
identifiers = ["lambda.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
|
|
locals {
|
|
table_arn = aws_dynamodb_table.shifts.arn
|
|
|
|
lambda_identity = {
|
|
slack_bot = [
|
|
{
|
|
sid = "DdbCrud"
|
|
actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
|
|
resources = [local.table_arn, "${local.table_arn}/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "HolidaySchedules"
|
|
actions = ["scheduler:CreateSchedule", "scheduler:DeleteSchedule", "scheduler:GetSchedule"]
|
|
resources = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "PassHolidayScheduler"
|
|
actions = ["iam:PassRole"]
|
|
resources = [local.holiday_scheduler_role_arn]
|
|
condition = {
|
|
test = "StringEquals"
|
|
variable = "iam:PassedToService"
|
|
values = ["scheduler.amazonaws.com"]
|
|
}
|
|
},
|
|
{
|
|
sid = "InvokeHolidayRouter"
|
|
actions = ["lambda:InvokeFunction"]
|
|
resources = [local.holiday_router_arn]
|
|
condition = null
|
|
},
|
|
]
|
|
weekly_post = [
|
|
{
|
|
sid = "DdbCrud"
|
|
actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
|
|
resources = [local.table_arn, "${local.table_arn}/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/slack-bot-token-*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "CheckcomponentsSend"
|
|
actions = ["sqs:SendMessage"]
|
|
resources = [var.checkcomponents_queue_arn]
|
|
condition = null
|
|
},
|
|
]
|
|
roster_sync = [
|
|
{
|
|
sid = "DdbCrud"
|
|
actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
|
|
resources = [local.table_arn, "${local.table_arn}/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/3cx-*"]
|
|
condition = null
|
|
},
|
|
]
|
|
roster_api = [
|
|
{
|
|
sid = "DdbWrite"
|
|
actions = ["dynamodb:UpdateItem", "dynamodb:DeleteItem"]
|
|
resources = [local.table_arn]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/roster-api-token-*"]
|
|
condition = null
|
|
},
|
|
]
|
|
ring_scheduler = [
|
|
{
|
|
sid = "DdbRead"
|
|
actions = ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:DescribeTable"]
|
|
resources = [local.table_arn, "${local.table_arn}/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/3cx-*"]
|
|
condition = null
|
|
},
|
|
]
|
|
holiday_router = [
|
|
{
|
|
sid = "DdbCrud"
|
|
actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
|
|
resources = [local.table_arn, "${local.table_arn}/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/3cx-*"]
|
|
condition = null
|
|
},
|
|
]
|
|
release_notifier = [
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/slack-bot-token-*"]
|
|
condition = null
|
|
},
|
|
]
|
|
portal_api = [
|
|
{
|
|
sid = "DdbCrud"
|
|
actions = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
|
|
resources = [local.table_arn, "${local.table_arn}/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "Secrets"
|
|
actions = ["secretsmanager:GetSecretValue"]
|
|
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "HolidaySchedules"
|
|
actions = ["scheduler:CreateSchedule", "scheduler:DeleteSchedule", "scheduler:GetSchedule"]
|
|
resources = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
|
|
condition = null
|
|
},
|
|
{
|
|
sid = "PassHolidayScheduler"
|
|
actions = ["iam:PassRole"]
|
|
resources = [local.holiday_scheduler_role_arn]
|
|
condition = {
|
|
test = "StringEquals"
|
|
variable = "iam:PassedToService"
|
|
values = ["scheduler.amazonaws.com"]
|
|
}
|
|
},
|
|
{
|
|
sid = "InvokeHolidayRouter"
|
|
actions = ["lambda:InvokeFunction"]
|
|
resources = [local.holiday_router_arn]
|
|
condition = null
|
|
},
|
|
]
|
|
}
|
|
|
|
lambda_env = {
|
|
slack_bot = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
SLACK_BOT_TOKEN_SECRET = "afterhours-shift-manager/slack-bot-token"
|
|
SLACK_SIGNING_SECRET = "afterhours-shift-manager/slack-signing-secret"
|
|
SHIFT_CHANNEL = var.shift_channel
|
|
TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
|
|
QUEUE_NUMBER = var.queue_number
|
|
TZ = var.timezone
|
|
HOLIDAY_ROUTER_ARN = local.holiday_router_arn
|
|
HOLIDAY_SCHEDULER_ROLE_ARN = local.holiday_scheduler_role_arn
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
weekly_post = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
SLACK_BOT_TOKEN_SECRET = "afterhours-shift-manager/slack-bot-token"
|
|
SHIFT_CHANNEL = var.shift_channel
|
|
PAY_REPORT_USER = var.pay_report_user
|
|
TZ = var.timezone
|
|
CHECKCOMPONENTS_QUEUE_URL = var.checkcomponents_queue_url
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
roster_sync = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
|
|
SYNC_GROUP = "DEFAULT"
|
|
TZ = var.timezone
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
roster_api = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
ROSTER_API_TOKEN_SECRET = "afterhours-shift-manager/roster-api-token"
|
|
TZ = var.timezone
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
ring_scheduler = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
|
|
QUEUE_NUMBER = var.queue_number
|
|
TZ = var.timezone
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
holiday_router = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
|
|
TZ = var.timezone
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
release_notifier = {
|
|
SLACK_BOT_TOKEN_SECRET = "afterhours-shift-manager/slack-bot-token"
|
|
SHIFT_CHANNEL = var.shift_channel
|
|
TZ = var.timezone
|
|
SENTRY_DSN = var.sentry_dsn
|
|
}
|
|
portal_api = {
|
|
SHIFT_TABLE = aws_dynamodb_table.shifts.name
|
|
SLACK_BOT_TOKEN_SECRET = "afterhours-shift-manager/slack-bot-token"
|
|
SHIFT_CHANNEL = var.shift_channel
|
|
TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
|
|
QUEUE_NUMBER = var.queue_number
|
|
TZ = var.timezone
|
|
HOLIDAY_ROUTER_ARN = local.holiday_router_arn
|
|
HOLIDAY_SCHEDULER_ROLE_ARN = local.holiday_scheduler_role_arn
|
|
SENTRY_DSN = var.sentry_dsn
|
|
PORTAL_COGNITO_ISSUER = var.portal_cognito_issuer
|
|
PORTAL_COGNITO_AUDIENCE = var.portal_cognito_audience
|
|
PORTAL_COGNITO_TRUST = jsonencode(concat(
|
|
var.portal_cognito_issuer != "" && var.portal_cognito_audience != "" ? [{ issuer = var.portal_cognito_issuer, audience = var.portal_cognito_audience }] : [],
|
|
var.portal_cognito_extra_trust,
|
|
))
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "lambda" {
|
|
for_each = local.functions
|
|
|
|
name = each.value.role_name
|
|
path = "/tf-managed/"
|
|
description = "Lambda execution role for ${each.value.function_name}"
|
|
assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
|
|
permissions_boundary = aws_iam_policy.lambda_boundary.arn
|
|
}
|
|
|
|
data "aws_iam_policy_document" "lambda" {
|
|
for_each = local.functions
|
|
|
|
dynamic "statement" {
|
|
for_each = local.lambda_identity[each.key]
|
|
|
|
content {
|
|
sid = statement.value.sid
|
|
effect = "Allow"
|
|
actions = statement.value.actions
|
|
resources = statement.value.resources
|
|
|
|
dynamic "condition" {
|
|
for_each = try(statement.value.condition, null) == null ? [] : [statement.value.condition]
|
|
|
|
content {
|
|
test = condition.value.test
|
|
variable = condition.value.variable
|
|
values = condition.value.values
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "lambda" {
|
|
for_each = local.functions
|
|
|
|
name = each.key
|
|
role = aws_iam_role.lambda[each.key].id
|
|
policy = data.aws_iam_policy_document.lambda[each.key].json
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "lambda_basic" {
|
|
for_each = local.functions
|
|
|
|
role = aws_iam_role.lambda[each.key].name
|
|
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
|
|
}
|
|
|
|
resource "aws_lambda_function" "this" {
|
|
for_each = local.functions
|
|
|
|
function_name = each.value.function_name
|
|
role = aws_iam_role.lambda[each.key].arn
|
|
handler = each.value.handler
|
|
runtime = "python3.12"
|
|
architectures = ["arm64"]
|
|
memory_size = 1024
|
|
timeout = each.value.timeout
|
|
|
|
s3_bucket = aws_s3_bucket.artifacts.id
|
|
s3_key = aws_s3_object.bootstrap_stub.key
|
|
source_code_hash = data.archive_file.bootstrap_stub.output_base64sha256
|
|
|
|
environment {
|
|
variables = local.lambda_env[each.key]
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [filename, s3_bucket, s3_key, s3_object_version, source_code_hash]
|
|
}
|
|
|
|
depends_on = [
|
|
aws_cloudwatch_log_group.lambda,
|
|
aws_iam_role_policy.lambda,
|
|
aws_iam_role_policy_attachment.lambda_basic,
|
|
]
|
|
}
|