afterhours-shift-manager/terraform/lambda.tf

# Leftover Lambda IAM roles from dual-run. The seven functions are gone;
# weekly-post remains so paychex-checkcomponents can keep that principal
# until a follow-up queue-policy apply drops it.

data "aws_iam_policy_document" "lambda_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

locals {
  table_arn = aws_dynamodb_table.shifts.arn

  lambda_identity = {
    slack_bot = [
      {
        sid       = "DdbCrud"
        actions   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
        resources = [local.table_arn, "${local.table_arn}/*"]
        condition = null
      },
      {
        sid       = "Secrets"
        actions   = ["secretsmanager:GetSecretValue"]
        resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*"]
        condition = null
      },
      {
        sid       = "HolidaySchedules"
        actions   = ["scheduler:CreateSchedule", "scheduler:DeleteSchedule", "scheduler:GetSchedule"]
        resources = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
        condition = null
      },
      {
        sid       = "PassHolidayScheduler"
        actions   = ["iam:PassRole"]
        resources = [local.holiday_scheduler_role_arn]
        condition = {
          test     = "StringEquals"
          variable = "iam:PassedToService"
          values   = ["scheduler.amazonaws.com"]
        }
      },
      {
        sid       = "InvokeHolidayRouter"
        actions   = ["lambda:InvokeFunction"]
        resources = [local.holiday_router_arn]
        condition = null
      },
    ]
    weekly_post = concat(
      [
        {
          sid       = "DdbCrud"
          actions   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
          resources = [local.table_arn, "${local.table_arn}/*"]
          condition = null
        },
        {
          sid       = "Secrets"
          actions   = ["secretsmanager:GetSecretValue"]
          resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/slack-bot-token-*"]
          condition = null
        },
      ],
      var.checkcomponents_queue_arn == "" ? [] : [
        {
          sid       = "CheckcomponentsSend"
          actions   = ["sqs:SendMessage"]
          resources = [var.checkcomponents_queue_arn]
          condition = null
        },
      ],
    ),
    roster_sync = [
      {
        sid       = "DdbCrud"
        actions   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
        resources = [local.table_arn, "${local.table_arn}/*"]
        condition = null
      },
      {
        sid       = "Secrets"
        actions   = ["secretsmanager:GetSecretValue"]
        resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/3cx-*"]
        condition = null
      },
    ]
    roster_api = [
      {
        sid       = "DdbWrite"
        actions   = ["dynamodb:UpdateItem", "dynamodb:DeleteItem"]
        resources = [local.table_arn]
        condition = null
      },
      {
        sid       = "Secrets"
        actions   = ["secretsmanager:GetSecretValue"]
        resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/roster-api-token-*"]
        condition = null
      },
    ]
    ring_scheduler = [
      {
        sid       = "DdbRead"
        actions   = ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:DescribeTable"]
        resources = [local.table_arn, "${local.table_arn}/*"]
        condition = null
      },
      {
        sid       = "Secrets"
        actions   = ["secretsmanager:GetSecretValue"]
        resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/3cx-*"]
        condition = null
      },
    ]
    holiday_router = [
      {
        sid       = "DdbCrud"
        actions   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
        resources = [local.table_arn, "${local.table_arn}/*"]
        condition = null
      },
      {
        sid       = "Secrets"
        actions   = ["secretsmanager:GetSecretValue"]
        resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/3cx-*"]
        condition = null
      },
    ]
    portal_api = [
      {
        sid       = "DdbCrud"
        actions   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
        resources = [local.table_arn, "${local.table_arn}/*"]
        condition = null
      },
      {
        sid       = "Secrets"
        actions   = ["secretsmanager:GetSecretValue"]
        resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*"]
        condition = null
      },
      {
        sid       = "HolidaySchedules"
        actions   = ["scheduler:CreateSchedule", "scheduler:DeleteSchedule", "scheduler:GetSchedule"]
        resources = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
        condition = null
      },
      {
        sid       = "PassHolidayScheduler"
        actions   = ["iam:PassRole"]
        resources = [local.holiday_scheduler_role_arn]
        condition = {
          test     = "StringEquals"
          variable = "iam:PassedToService"
          values   = ["scheduler.amazonaws.com"]
        }
      },
      {
        sid       = "InvokeHolidayRouter"
        actions   = ["lambda:InvokeFunction"]
        resources = [local.holiday_router_arn]
        condition = null
      },
    ]
  }

  lambda_env = {
    slack_bot = {
      SHIFT_TABLE                = aws_dynamodb_table.shifts.name
      SLACK_BOT_TOKEN_SECRET     = "afterhours-shift-manager/slack-bot-token"
      SLACK_SIGNING_SECRET       = "afterhours-shift-manager/slack-signing-secret"
      SHIFT_CHANNEL              = var.shift_channel
      TCX_SECRET_PREFIX          = "afterhours-shift-manager/3cx-"
      QUEUE_NUMBER               = var.queue_number
      TZ                         = var.timezone
      HOLIDAY_ROUTER_ARN         = local.holiday_router_arn
      HOLIDAY_SCHEDULER_ROLE_ARN = local.holiday_scheduler_role_arn
      SENTRY_DSN                 = var.sentry_dsn
    }
    weekly_post = {
      SHIFT_TABLE               = aws_dynamodb_table.shifts.name
      SLACK_BOT_TOKEN_SECRET    = "afterhours-shift-manager/slack-bot-token"
      SHIFT_CHANNEL             = var.shift_channel
      PAY_REPORT_USER           = var.pay_report_user
      TZ                        = var.timezone
      CHECKCOMPONENTS_QUEUE_URL = var.checkcomponents_queue_url
      SENTRY_DSN                = var.sentry_dsn
    }
    roster_sync = {
      SHIFT_TABLE       = aws_dynamodb_table.shifts.name
      TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
      SYNC_GROUP        = "DEFAULT"
      TZ                = var.timezone
      SENTRY_DSN        = var.sentry_dsn
    }
    roster_api = {
      SHIFT_TABLE             = aws_dynamodb_table.shifts.name
      ROSTER_API_TOKEN_SECRET = "afterhours-shift-manager/roster-api-token"
      TZ                      = var.timezone
      SENTRY_DSN              = var.sentry_dsn
    }
    ring_scheduler = {
      SHIFT_TABLE       = aws_dynamodb_table.shifts.name
      TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
      QUEUE_NUMBER      = var.queue_number
      TZ                = var.timezone
      SENTRY_DSN        = var.sentry_dsn
    }
    holiday_router = {
      SHIFT_TABLE       = aws_dynamodb_table.shifts.name
      TCX_SECRET_PREFIX = "afterhours-shift-manager/3cx-"
      TZ                = var.timezone
      SENTRY_DSN        = var.sentry_dsn
    }
    portal_api = {
      SHIFT_TABLE                = aws_dynamodb_table.shifts.name
      SLACK_BOT_TOKEN_SECRET     = "afterhours-shift-manager/slack-bot-token"
      SHIFT_CHANNEL              = var.shift_channel
      TCX_SECRET_PREFIX          = "afterhours-shift-manager/3cx-"
      QUEUE_NUMBER               = var.queue_number
      TZ                         = var.timezone
      HOLIDAY_ROUTER_ARN         = local.holiday_router_arn
      HOLIDAY_SCHEDULER_ROLE_ARN = local.holiday_scheduler_role_arn
      SENTRY_DSN                 = var.sentry_dsn
      PORTAL_COGNITO_ISSUER      = var.portal_cognito_issuer
      PORTAL_COGNITO_AUDIENCE    = var.portal_cognito_audience
      PORTAL_COGNITO_TRUST = jsonencode(concat(
        var.portal_cognito_issuer != "" && var.portal_cognito_audience != "" ? [{ issuer = var.portal_cognito_issuer, audience = var.portal_cognito_audience }] : [],
        var.portal_cognito_extra_trust,
      ))
    }
  }
}

resource "aws_iam_role" "lambda" {
  for_each = local.functions

  name                 = each.value.role_name
  path                 = "/tf-managed/"
  description          = "Lambda execution role for ${each.value.function_name}"
  assume_role_policy   = data.aws_iam_policy_document.lambda_assume.json
  permissions_boundary = aws_iam_policy.lambda_boundary.arn
}

data "aws_iam_policy_document" "lambda" {
  for_each = local.functions

  dynamic "statement" {
    for_each = local.lambda_identity[each.key]

    content {
      sid       = statement.value.sid
      effect    = "Allow"
      actions   = statement.value.actions
      resources = statement.value.resources

      dynamic "condition" {
        for_each = try(statement.value.condition, null) == null ? [] : [statement.value.condition]

        content {
          test     = condition.value.test
          variable = condition.value.variable
          values   = condition.value.values
        }
      }
    }
  }
}

resource "aws_iam_role_policy" "lambda" {
  for_each = local.functions

  name   = each.key
  role   = aws_iam_role.lambda[each.key].id
  policy = data.aws_iam_policy_document.lambda[each.key].json
}

resource "aws_iam_role_policy_attachment" "lambda_basic" {
  for_each = local.functions

  role       = aws_iam_role.lambda[each.key].name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}