mirror of
https://github.com/Sea-Haven-Industries/front-integrations.git
synced 2026-09-30 23:33:12 +00:00
7bbdbabe3a
* feat(terraform): migrate front-integrations to HCP Terraform Freeze SAM CD and add Terraform for seahaven-prod (Lambdas, DynamoDB, EventBridge, alarms) so HCP becomes the sole deploy path. Include prod secret ARNs in the tfvars example for workspace wiring. * fix(terraform): reject symlink sources in Lambda package build
53 lines
1.6 KiB
HCL
53 lines
1.6 KiB
HCL
data "aws_iam_policy_document" "lambda_assume" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRole"]
|
|
|
|
principals {
|
|
type = "Service"
|
|
identifiers = ["lambda.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "sla_monitor" {
|
|
name = "front-sla-monitor"
|
|
path = "/tf-managed/"
|
|
assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
|
|
permissions_boundary = local.boundary_arn
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "sla_monitor_basic" {
|
|
role = aws_iam_role.sla_monitor.name
|
|
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "sla_monitor_secrets" {
|
|
name = "secretsmanager-get"
|
|
role = aws_iam_role.sla_monitor.id
|
|
policy = local.sla_monitor_secrets_policy_json
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "sla_monitor_ddb" {
|
|
name = "dynamodb-crud"
|
|
role = aws_iam_role.sla_monitor.id
|
|
policy = local.sla_monitor_ddb_policy_json
|
|
}
|
|
|
|
resource "aws_iam_role" "user_sync" {
|
|
name = "front-user-sync"
|
|
path = "/tf-managed/"
|
|
assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
|
|
permissions_boundary = local.boundary_arn
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "user_sync_basic" {
|
|
role = aws_iam_role.user_sync.name
|
|
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "user_sync_secrets" {
|
|
name = "secretsmanager-get"
|
|
role = aws_iam_role.user_sync.id
|
|
policy = local.user_sync_secrets_policy_json
|
|
}
|