tf-aws-module_primitive-lambda_function

module
v0.0.0-...-e64ae61 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 20, 2025 License: Apache-2.0

README

tf-aws-module_primitive-lambda_function

License

Overview

Provisions a Lambda Function.

Pre-Commit hooks

.pre-commit-config.yaml file defines certain pre-commit hooks that are relevant to terraform, golang and common linting tasks. There are no custom hooks added.

commitlint hook enforces commit message in certain format. The commit contains the following structural elements, to communicate intent to the consumers of your commit messages:

  • fix: a commit of the type fix patches a bug in your codebase (this correlates with PATCH in Semantic Versioning).
  • feat: a commit of the type feat introduces a new feature to the codebase (this correlates with MINOR in Semantic Versioning).
  • BREAKING CHANGE: a commit that has a footer BREAKING CHANGE:, or appends a ! after the type/scope, introduces a breaking API change (correlating with MAJOR in Semantic Versioning). A BREAKING CHANGE can be part of commits of any type. footers other than BREAKING CHANGE: may be provided and follow a convention similar to git trailer format.
  • build: a commit of the type build adds changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
  • chore: a commit of the type chore adds changes that don't modify src or test files
  • ci: a commit of the type ci adds changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
  • docs: a commit of the type docs adds documentation only changes
  • perf: a commit of the type perf adds code change that improves performance
  • refactor: a commit of the type refactor adds code change that neither fixes a bug nor adds a feature
  • revert: a commit of the type revert reverts a previous commit
  • style: a commit of the type style adds code changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
  • test: a commit of the type test adds missing tests or correcting existing tests

Base configuration used for this project is commitlint-config-conventional (based on the Angular convention)

If you are a developer using vscode, this plugin may be helpful.

detect-secrets-hook prevents new secrets from being introduced into the baseline. TODO: INSERT DOC LINK ABOUT HOOKS

In order for pre-commit hooks to work properly

  • You need to have the pre-commit package manager installed. Here are the installation instructions.
  • pre-commit would install all the hooks when commit message is added by default except for commitlint hook. commitlint hook would need to be installed manually using the command below
pre-commit install --hook-type commit-msg

To test the resource group module locally

  1. For development/enhancements to this module locally, you'll need to install all of its components. This is controlled by the configure target in the project's Makefile. Before you can run configure, familiarize yourself with the variables in the Makefile and ensure they're pointing to the right places.
make configure

This adds in several files and directories that are ignored by git. They expose many new Make targets.

  1. THIS STEP APPLIES ONLY TO MICROSOFT AZURE. IF YOU ARE USING A DIFFERENT PLATFORM PLEASE SKIP THIS STEP. The first target you care about is env. This is the common interface for setting up environment variables. The values of the environment variables will be used to authenticate with cloud provider from local development workstation.

make configure command will bring down azure_env.sh file on local workstation. Devloper would need to modify this file, replace the environment variable values with relevant values.

These environment variables are used by terratest integration suit.

Service principle used for authentication(value of ARM_CLIENT_ID) should have below privileges on resource group within the subscription.

"Microsoft.Resources/subscriptions/resourceGroups/write"
"Microsoft.Resources/subscriptions/resourceGroups/read"
"Microsoft.Resources/subscriptions/resourceGroups/delete"

Then run this make target to set the environment variables on developer workstation.

make env
  1. The first target you care about is check.

Pre-requisites Before running this target it is important to ensure that, developer has created files mentioned below on local workstation under root directory of git repository that contains code for primitives/segments. Note that these files are azure specific. If primitive/segment under development uses any other cloud provider than azure, this section may not be relevant.

  • A file named provider.tf with contents below
provider "azurerm" {
  features {}
}
  • A file named terraform.tfvars which contains key value pair of variables used.

Note that since these files are added in gitignore they would not be checked in into primitive/segment's git repo.

After creating these files, for running tests associated with the primitive/segment, run

make check

If make check target is successful, developer is good to commit the code to primitive/segment's git repo.

make check target

  • runs terraform commands to lint,validate and plan terraform code.
  • runs conftests. conftests make sure policy checks are successful.
  • runs terratest. This is integration test suit.
  • runs opa tests

Requirements

Name Version
terraform ~> 1.5
aws ~> 5.14

Providers

No providers.

Modules

Name Source Version
lambda_function terraform-aws-modules/lambda/aws ~> 7.4

Resources

No resources.

Inputs

Name Description Type Default Required
name The name of this Lambda Function string n/a yes
description Description of your Lambda Function string "" no
handler Lambda Function entrypoint in your code string "index.lambda_handler" no
runtime Lambda Function runtime string "python3.9" no
architectures (Optional) Instruction set architecture for your Lambda function. Valid architectures are x86_64 (default) and arm64. list(string)
[
"x86_64"
]
no
publish Whether to publish creation/change as new Lambda Function Version. bool true no
ephemeral_storage_size mount of ephemeral storage (/tmp) in MB your Lambda Function can use at runtime. Valid values are between 512 MB to 10,240 MB (10 GB). number 512 no
environment_variables A map that defines environment variables for the Lambda Function. map(string) {} no
memory_size Amount of memory in MB your Lambda Function can use at runtime. Valid values are between 128 MB to 10,240 MB (10 GB), in 64 MB increments. number 128 no
timeout The amount of time your Lambda Function has to run in seconds. The maximum lifetime of a Lambda function execution is 15 minutes (900 seconds). number 3 no
create_package Controls whether Lambda package should be created bool false no
source_path The absolute path to a local file or directory containing your Lambda source code. Only valid if create_package is set to true. any null no
zip_file_path Path of the source zip file with respect to module root string null no
store_on_s3 Whether to store produced artifacts on S3 or locally. bool false no
s3_existing_package The S3 bucket object with keys bucket, key, version pointing to an existing zip-file to use. Only valid if create_package is set to false. map(string) null no
s3_bucket S3 bucket to store artifacts. Required if store_on_s3 is set to true, ignored otherwise. string null no
s3_prefix Directory name where artifacts should be stored in the S3 bucket. Defaults to builds. Required if store_on_s3 is set to true, ignored otherwise. string "builds" no
layers List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. list(string) null no
hash_extra The string to add into hashing function. Useful when building same source path for different functions. string "" no
ignore_source_code_hash Whether to ignore changes to the function's source code hash. Set to true if you manage infrastructure and code deployments separately. bool false no
authorization_type The type of authentication that the Lambda Function URL uses. Set to AWS_IAM to restrict access to authenticated IAM users only. Set to NONE to bypass IAM authentication and create a public endpoint (default). string "NONE" no
cors CORS settings to be used by the Lambda Function URL
object({
allow_credentials = optional(bool, false)
allow_headers = optional(list(string), null)
allow_methods = optional(list(string), null)
allow_origins = optional(list(string), null)
expose_headers = optional(list(string), null)
max_age = optional(number, 0)
})
{} no
create_lambda_function_url Whether the Lambda Function URL resource should be created (default true). bool true no
invoke_mode Invoke mode of the Lambda Function URL. Valid values are BUFFERED (default) and RESPONSE_STREAM. string "BUFFERED" no
attach_policy_statements Controls whether policy_statements should be added to IAM role for Lambda Function bool false no
policy_statements Map of dynamic policy statements to attach to Lambda Function role any {} no
attach_policy Controls whether policy should be added to IAM role for Lambda Function bool false no
policy Policy statement ARN to attach to Lambda Function role string null no
attach_policies Controls whether policies should be added to IAM role for Lambda Function bool false no
policies List of policy statement ARNs to attach to Lambda Function role list(string) [] no
attach_policy_json Controls whether policy_json should be added to IAM role for Lambda Function bool false no
policy_json An additional policy document as JSON to attach to the Lambda Function role string null no
attach_policy_jsons Controls whether policy_jsons should be added to IAM role for Lambda Function bool false no
policy_jsons An additional policy documents as JSON to attach to the Lambda Function role list(string) [] no
attach_dead_letter_policy Controls whether SNS/SQS dead letter notification policy should be added to IAM role for Lambda Function. Defaults to false. bool false no
dead_letter_target_arn The ARN of an SNS topic or SQS queue to notify when an invocation fails. string null no
attach_network_policy Controls whether VPC/network policy should be added to IAM role for Lambda Function bool false no
attach_async_event_policy Controls whether async event policy should be added to IAM role for Lambda Function bool false no
attach_tracing_policy Controls whether X-Ray tracing policy should be added to IAM role for Lambda Function bool false no
assume_role_policy_statements Map of dynamic policy statements for assuming Lambda Function role (trust relationship) map(string) {} no
trusted_entities List of additional trusted entities for assuming Lambda Function role (trust relationship) any [] no
allowed_triggers Map of allowed triggers to create Lambda permissions map(any) {} no
attach_cloudwatch_logs_policy Controls whether CloudWatch Logs policy should be added to IAM role for Lambda Function bool true no
attach_create_log_group_permission Controls whether to add the create log group permission to the CloudWatch logs policy bool true no
cloudwatch_logs_kms_key_id The ARN of the KMS Key to use when encrypting log data. string null no
cloudwatch_logs_log_group_class Specified the log class of the log group. Possible values are: STANDARD (default) or INFREQUENT_ACCESS string "STANDARD" no
cloudwatch_logs_retention_in_days Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Defaults to 30. number 30 no
cloudwatch_logs_skip_destroy Whether to keep the log group (and any logs it may contain) at destroy time. Defaults to false. bool false no
cloudwatch_logs_tags A map of tags to assign to the logs resource. map(string) {} no
tracing_mode Tracing mode of the Lambda Function. Valid value can be either PassThrough (default) or Active. string "PassThrough" no
vpc_security_group_ids List of security group ids when Lambda Function should run in the VPC. list(string) null no
vpc_subnet_ids List of subnet ids when Lambda Function should run in the VPC. Usually private or intra subnets. list(string) null no
lambda_at_edge Set this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the function bool false no
lambda_at_edge_logs_all_regions Whether to specify a wildcard in IAM policy used by Lambda@Edge to allow logging in all regions bool true no
tags Map of tags to apply to this resource. map(string) {} no
create Controls whether resources should be created. bool false no

Outputs

Name Description
lambda_function_arn n/a
lambda_function_name n/a
lambda_cloudwatch_log_group_arn n/a
lambda_cloudwatch_log_group_name n/a
lambda_function_url n/a
lambda_role_arn n/a
lambda_role_name n/a

Directories

Path Synopsis
tests

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL