mirror of
https://github.com/Sea-Haven-Industries/front-integrations.git
synced 2026-09-30 18:53:13 +00:00
Adam Moussa
1ad265b177
Freeze SAM CD and add Terraform for seahaven-prod (Lambdas, DynamoDB, EventBridge, alarms) so HCP becomes the sole deploy path. Include prod secret ARNs in the tfvars example for workspace wiring.
53 lines
1.6 KiB
HCL
53 lines
1.6 KiB
HCL
data "aws_iam_policy_document" "lambda_assume" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRole"]
|
|
|
|
principals {
|
|
type = "Service"
|
|
identifiers = ["lambda.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "sla_monitor" {
|
|
name = "front-sla-monitor"
|
|
path = "/tf-managed/"
|
|
assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
|
|
permissions_boundary = local.boundary_arn
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "sla_monitor_basic" {
|
|
role = aws_iam_role.sla_monitor.name
|
|
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "sla_monitor_secrets" {
|
|
name = "secretsmanager-get"
|
|
role = aws_iam_role.sla_monitor.id
|
|
policy = local.sla_monitor_secrets_policy_json
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "sla_monitor_ddb" {
|
|
name = "dynamodb-crud"
|
|
role = aws_iam_role.sla_monitor.id
|
|
policy = local.sla_monitor_ddb_policy_json
|
|
}
|
|
|
|
resource "aws_iam_role" "user_sync" {
|
|
name = "front-user-sync"
|
|
path = "/tf-managed/"
|
|
assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
|
|
permissions_boundary = local.boundary_arn
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "user_sync_basic" {
|
|
role = aws_iam_role.user_sync.name
|
|
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "user_sync_secrets" {
|
|
name = "secretsmanager-get"
|
|
role = aws_iam_role.user_sync.id
|
|
policy = local.user_sync_secrets_policy_json
|
|
}
|