Skip to content

Commit e1c768b

Browse files
antonbabenkoantonbabenko
committedNov 21, 2020
Initial commit
·
v4.2.1v0.1.0
0 parents  commit e1c768b

19 files changed

+2108
-0
lines changed
 

‎.chglog/CHANGELOG.tpl.md

+111
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
# Change Log
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
{{ if .Versions -}}
6+
<a name="unreleased"></a>
7+
## [Unreleased]
8+
{{ if .Unreleased.CommitGroups -}}
9+
{{ range .Unreleased.CommitGroups -}}
10+
### {{ .Title }}
11+
{{ range .Commits -}}
12+
{{/* SKIPPING RULES - START */ -}}
13+
{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
14+
{{- if not (contains .Subject "[ci skip]") -}}
15+
{{- if not (contains .Subject "[skip ci]") -}}
16+
{{- if not (hasPrefix .Subject "Merge pull request ") -}}
17+
{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
18+
{{- /* SKIPPING RULES - END */ -}}
19+
- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
20+
{{/* SKIPPING RULES - START */ -}}
21+
{{ end -}}
22+
{{ end -}}
23+
{{ end -}}
24+
{{ end -}}
25+
{{ end -}}
26+
{{/* SKIPPING RULES - END */ -}}
27+
{{ end }}
28+
{{ end -}}
29+
{{ else }}
30+
{{ range .Unreleased.Commits -}}
31+
{{/* SKIPPING RULES - START */ -}}
32+
{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
33+
{{- if not (contains .Subject "[ci skip]") -}}
34+
{{- if not (contains .Subject "[skip ci]") -}}
35+
{{- if not (hasPrefix .Subject "Merge pull request ") -}}
36+
{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
37+
{{- /* SKIPPING RULES - END */ -}}
38+
- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
39+
{{/* SKIPPING RULES - START */ -}}
40+
{{ end -}}
41+
{{ end -}}
42+
{{ end -}}
43+
{{ end -}}
44+
{{ end -}}
45+
{{/* SKIPPING RULES - END */ -}}
46+
{{ end }}
47+
{{ end -}}
48+
{{ end -}}
49+
50+
{{ range .Versions }}
51+
<a name="{{ .Tag.Name }}"></a>
52+
## {{ if .Tag.Previous }}[{{ .Tag.Name }}]{{ else }}{{ .Tag.Name }}{{ end }} - {{ datetime "2006-01-02" .Tag.Date }}
53+
{{ if .CommitGroups -}}
54+
{{ range .CommitGroups -}}
55+
### {{ .Title }}
56+
{{ range .Commits -}}
57+
{{/* SKIPPING RULES - START */ -}}
58+
{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
59+
{{- if not (contains .Subject "[ci skip]") -}}
60+
{{- if not (contains .Subject "[skip ci]") -}}
61+
{{- if not (hasPrefix .Subject "Merge pull request ") -}}
62+
{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
63+
{{- /* SKIPPING RULES - END */ -}}
64+
- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
65+
{{/* SKIPPING RULES - START */ -}}
66+
{{ end -}}
67+
{{ end -}}
68+
{{ end -}}
69+
{{ end -}}
70+
{{ end -}}
71+
{{/* SKIPPING RULES - END */ -}}
72+
{{ end }}
73+
{{ end -}}
74+
{{ else }}
75+
{{ range .Commits -}}
76+
{{/* SKIPPING RULES - START */ -}}
77+
{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
78+
{{- if not (contains .Subject "[ci skip]") -}}
79+
{{- if not (contains .Subject "[skip ci]") -}}
80+
{{- if not (hasPrefix .Subject "Merge pull request ") -}}
81+
{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
82+
{{- /* SKIPPING RULES - END */ -}}
83+
- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
84+
{{/* SKIPPING RULES - START */ -}}
85+
{{ end -}}
86+
{{ end -}}
87+
{{ end -}}
88+
{{ end -}}
89+
{{ end -}}
90+
{{/* SKIPPING RULES - END */ -}}
91+
{{ end }}
92+
{{ end -}}
93+
94+
{{- if .NoteGroups -}}
95+
{{ range .NoteGroups -}}
96+
### {{ .Title }}
97+
{{ range .Notes }}
98+
{{ .Body }}
99+
{{ end }}
100+
{{ end -}}
101+
{{ end -}}
102+
{{ end -}}
103+
104+
{{- if .Versions }}
105+
[Unreleased]: {{ .Info.RepositoryURL }}/compare/{{ $latest := index .Versions 0 }}{{ $latest.Tag.Name }}...HEAD
106+
{{ range .Versions -}}
107+
{{ if .Tag.Previous -}}
108+
[{{ .Tag.Name }}]: {{ $.Info.RepositoryURL }}/compare/{{ .Tag.Previous.Name }}...{{ .Tag.Name }}
109+
{{ end -}}
110+
{{ end -}}
111+
{{ end -}}

‎.chglog/config.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
style: github
2+
template: CHANGELOG.tpl.md
3+
info:
4+
title: CHANGELOG
5+
repository_url: https://github.com/terraform-aws-modules/terraform-aws-step-function
6+
options:
7+
header:
8+
pattern: "^(.*)$"
9+
pattern_maps:
10+
- Subject

‎.editorconfig

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# EditorConfig is awesome: http://EditorConfig.org
2+
# Uses editorconfig to maintain consistent coding styles
3+
4+
# top-most EditorConfig file
5+
root = true
6+
7+
# Unix-style newlines with a newline ending every file
8+
[*]
9+
charset = utf-8
10+
end_of_line = lf
11+
indent_size = 2
12+
indent_style = space
13+
insert_final_newline = true
14+
max_line_length = 80
15+
trim_trailing_whitespace = true
16+
17+
[*.py]
18+
indent_size = 4
19+
20+
[*.{tf,tfvars}]
21+
indent_size = 2
22+
indent_style = space
23+
24+
[*.md]
25+
max_line_length = 0
26+
trim_trailing_whitespace = false
27+
28+
[Makefile]
29+
tab_width = 2
30+
indent_style = tab
31+
32+
[COMMIT_EDITMSG]
33+
max_line_length = 0

‎.gitignore

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.terraform
2+
*.tfstate.backup
3+
*.tfstate
4+
*.tfvars
5+
*.tfplan
6+
7+
builds/
8+
9+
__pycache__/

‎.pre-commit-config.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
repos:
2+
- repo: git://github.com/antonbabenko/pre-commit-terraform
3+
rev: v1.45.0
4+
hooks:
5+
- id: terraform_fmt
6+
- id: terraform_validate
7+
- id: terraform_docs
8+
- id: terraform_tflint
9+
args:
10+
- '--args=--only=terraform_deprecated_interpolation'
11+
- '--args=--only=terraform_deprecated_index'
12+
- '--args=--only=terraform_unused_declarations'
13+
- '--args=--only=terraform_comment_syntax'
14+
- '--args=--only=terraform_documented_outputs'
15+
- '--args=--only=terraform_documented_variables'
16+
- '--args=--only=terraform_typed_variables'
17+
- '--args=--only=terraform_module_pinned_source'
18+
- '--args=--only=terraform_naming_convention'
19+
- '--args=--only=terraform_required_version'
20+
- '--args=--only=terraform_required_providers'
21+
- '--args=--only=terraform_standard_module_structure'
22+
- '--args=--only=terraform_workspace_remote'
23+
- repo: git://github.com/pre-commit/pre-commit-hooks
24+
rev: v3.3.0
25+
hooks:
26+
- id: check-merge-conflict

‎CHANGELOG.md

+305
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,305 @@
1+
# Change Log
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
<a name="unreleased"></a>
6+
## [Unreleased]
7+
8+
9+
10+
<a name="v1.29.0"></a>
11+
## [v1.29.0] - 2020-11-19
12+
13+
- feat: Customizable prefixes for IAM policies (as for IAM role) ([#74](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/74))
14+
15+
16+
<a name="v1.28.0"></a>
17+
## [v1.28.0] - 2020-11-17
18+
19+
- feat: Updated range of supported versions of Terraform and providers ([#71](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/71))
20+
21+
22+
<a name="v1.27.0"></a>
23+
## [v1.27.0] - 2020-11-02
24+
25+
- ci: Updated pre-commit hooks, added terraform_validate ([#68](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/68))
26+
27+
28+
<a name="v1.26.0"></a>
29+
## [v1.26.0] - 2020-10-27
30+
31+
- fix: Removed hash_extra_paths to have the same hash for multiple executors ([#66](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/66))
32+
33+
34+
<a name="v1.25.0"></a>
35+
## [v1.25.0] - 2020-10-26
36+
37+
- fix: Fixed concurrent builds ([#65](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/65))
38+
- chore: Upgraded pre-commit-terraform to fix terraform-docs
39+
40+
41+
<a name="v1.24.0"></a>
42+
## [v1.24.0] - 2020-09-23
43+
44+
- feat: Added tflint as pre-commit hook ([#60](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/60))
45+
46+
47+
<a name="v1.23.0"></a>
48+
## [v1.23.0] - 2020-09-14
49+
50+
- feat: Added support for policy_jsons (list of strings) ([#58](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/58))
51+
52+
53+
<a name="v1.22.0"></a>
54+
## [v1.22.0] - 2020-08-26
55+
56+
- feat: Updated submodules to support Terraform 0.13
57+
58+
59+
<a name="v1.21.0"></a>
60+
## [v1.21.0] - 2020-08-25
61+
62+
- fix: os xcode python interpreter ([#50](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/50))
63+
- docs: Updated description for provisioned_concurrent_executions (closes [#38](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/38))
64+
- chore: Set number_of_policies in example
65+
66+
67+
<a name="v1.20.0"></a>
68+
## [v1.20.0] - 2020-08-19
69+
70+
- fix: Fix policy attachments for managed policies ([#45](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/45))
71+
- feat: Add support for EFS File System Config ([#46](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/46))
72+
- feat: Bump version of AWS provider to support v3
73+
- feat: Upgraded Terraform version supported
74+
- docs: Updated FAQ with info about "We currently do not support adding policies for "
75+
- fix: Adds region wildcard to log group arn when lambda[@edge](https://github.com/edge) ([#35](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/35))
76+
- fix: Fixed issue with zip renaming on Windows platform ([#32](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/32))
77+
- feat: docker image building for installing pip requirements independently from OS ([#31](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/31))
78+
- fix: Fixed patterns applying ([#30](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/30))
79+
- fix: Fixed DUMP_ENV logging level ([#28](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/28))
80+
- fix: Fixed IAM policy attachment with multiple functions ([#26](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/26))
81+
- feat: Added support for variety of options for source_path, closes [#12](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/12) ([#25](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/25))
82+
- Updated examples and readme
83+
- Added more samples to examples/simple/main.tf
84+
- package.py - Log directories with ending /
85+
- package.py - Log skipped items + made uniform some messages
86+
- package.py - Added support for comments in patterns
87+
- package.py - Renamed: logger -> log
88+
- feat: Added ZipContentFilter class to apply patterns filtering
89+
- package.py - Fixed and improved logging
90+
- package.py - Added BuildPlanManager initial implementation
91+
- package.py - Fixed building in docker
92+
- package.py - Implemented ZipFileStream.write_file
93+
- feat: In-place zip archiving
94+
- package.py - Removed dir changing on zip archive generation
95+
- package.py - Simplified emit_dir_files func
96+
- package.py - Fixed timestamp appling
97+
- package.py - Added hidden hash command to calculate Lambda's content hash
98+
- package.py - Finished ZipFileStream.write_dirs implementation
99+
- package.py - Moved borrowed ZipInfo.from_file to a ZipWriteStream class
100+
- package.py - Added initial ZipFileStream skel
101+
- package.py - Move out inner functions from *_command functions
102+
- feat: Added pid to the prepare stage log records
103+
- feat: Added AWS CodeDeploy group name to outputs
104+
- fix: Create AWS CodeDeploy resources conditionally
105+
- fix: Do not create AWS Cloudwatch log group for Lambda Layers
106+
- feat: Add Cloudwatch Logs resources (or use existing) ([#24](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/24))
107+
108+
109+
<a name="v1.6.1"></a>
110+
## [v1.6.1] - 2020-08-14
111+
112+
- fix: Added support for AWS provider v3 used by notify-slack module with Terraform 0.12
113+
114+
115+
<a name="v1.19.0"></a>
116+
## [v1.19.0] - 2020-08-14
117+
118+
- feat: Add support for EFS File System Config ([#46](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/46))
119+
120+
121+
<a name="v1.18.0"></a>
122+
## [v1.18.0] - 2020-08-13
123+
124+
- feat: Bump version of AWS provider to support v3
125+
126+
127+
<a name="v1.17.0"></a>
128+
## [v1.17.0] - 2020-07-20
129+
130+
- feat: Upgraded Terraform version supported
131+
132+
133+
<a name="v1.16.0"></a>
134+
## [v1.16.0] - 2020-06-26
135+
136+
- docs: Updated FAQ with info about "We currently do not support adding policies for "
137+
138+
139+
<a name="v1.15.0"></a>
140+
## [v1.15.0] - 2020-06-24
141+
142+
- fix: Adds region wildcard to log group arn when lambda[@edge](https://github.com/edge) ([#35](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/35))
143+
144+
145+
<a name="v1.14.0"></a>
146+
## [v1.14.0] - 2020-06-18
147+
148+
- fix: Fixed issue with zip renaming on Windows platform ([#32](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/32))
149+
150+
151+
<a name="v1.13.0"></a>
152+
## [v1.13.0] - 2020-06-17
153+
154+
- feat: docker image building for installing pip requirements independently from OS ([#31](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/31))
155+
156+
157+
<a name="v1.12.0"></a>
158+
## [v1.12.0] - 2020-06-16
159+
160+
- fix: Fixed patterns applying ([#30](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/30))
161+
- fix: Fixed DUMP_ENV logging level ([#28](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/28))
162+
163+
164+
<a name="v1.11.0"></a>
165+
## [v1.11.0] - 2020-06-16
166+
167+
- fix: Fixed IAM policy attachment with multiple functions ([#26](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/26))
168+
169+
170+
<a name="v1.10.0"></a>
171+
## [v1.10.0] - 2020-06-14
172+
173+
- feat: Added support for variety of options for source_path, closes [#12](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/12) ([#25](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/25))
174+
- Updated examples and readme
175+
- Added more samples to examples/simple/main.tf
176+
- package.py - Log directories with ending /
177+
- package.py - Log skipped items + made uniform some messages
178+
- package.py - Added support for comments in patterns
179+
- package.py - Renamed: logger -> log
180+
- feat: Added ZipContentFilter class to apply patterns filtering
181+
- package.py - Fixed and improved logging
182+
- package.py - Added BuildPlanManager initial implementation
183+
- package.py - Fixed building in docker
184+
- package.py - Implemented ZipFileStream.write_file
185+
- feat: In-place zip archiving
186+
- package.py - Removed dir changing on zip archive generation
187+
- package.py - Simplified emit_dir_files func
188+
- package.py - Fixed timestamp appling
189+
- package.py - Added hidden hash command to calculate Lambda's content hash
190+
- package.py - Finished ZipFileStream.write_dirs implementation
191+
- package.py - Moved borrowed ZipInfo.from_file to a ZipWriteStream class
192+
- package.py - Added initial ZipFileStream skel
193+
- package.py - Move out inner functions from *_command functions
194+
- feat: Added pid to the prepare stage log records
195+
196+
197+
<a name="v1.9.0"></a>
198+
## [v1.9.0] - 2020-06-12
199+
200+
- feat: Added AWS CodeDeploy group name to outputs
201+
202+
203+
<a name="v1.8.0"></a>
204+
## [v1.8.0] - 2020-06-12
205+
206+
- fix: Create AWS CodeDeploy resources conditionally
207+
- fix: Do not create AWS Cloudwatch log group for Lambda Layers
208+
209+
210+
<a name="v1.7.0"></a>
211+
## [v1.7.0] - 2020-06-12
212+
213+
- feat: Add Cloudwatch Logs resources (or use existing) ([#24](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/24))
214+
215+
216+
<a name="v1.6.0"></a>
217+
## [v1.6.0] - 2020-06-11
218+
219+
- feat: Added package debug levels
220+
221+
222+
<a name="v1.5.0"></a>
223+
## [v1.5.0] - 2020-06-10
224+
225+
- fix: Added dependency for aws_s3_bucket_object, fixes [#15](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/15) ([#19](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/19))
226+
- feat: Added support for one-shot artifacts build to skip recreation of missing packages ([#20](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/20))
227+
228+
229+
<a name="v1.4.0"></a>
230+
## [v1.4.0] - 2020-06-10
231+
232+
- feat: Added deploy module to do complex deployments using AWS CodeDeploy ([#17](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/17))
233+
- feat: Stable zip archives - v1 ([#18](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/18))
234+
- feat: Added better support for Lambda Alias resources via separate submodule ([#14](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/14))
235+
- feat: Reliable passing build plan by a separate file + minor changes ([#13](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/13))
236+
237+
238+
<a name="v1.3.0"></a>
239+
## [v1.3.0] - 2020-06-07
240+
241+
- fix: Computed values in number of policies
242+
243+
244+
<a name="v1.2.0"></a>
245+
## [v1.2.0] - 2020-06-07
246+
247+
- feat: Added support for Lambda Permissions for allowed triggers ([#11](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/11))
248+
- docs: Added link to apigateway-v2 module
249+
250+
251+
<a name="v1.1.0"></a>
252+
## [v1.1.0] - 2020-06-05
253+
254+
- feat: Added 4 new ways to customize IAM policies for Lambda Function ([#10](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/10))
255+
- Fixed README
256+
- Updated README formatting
257+
258+
259+
<a name="v1.0.0"></a>
260+
## [v1.0.0] - 2020-06-04
261+
262+
- Updated README formatting
263+
- Initial terraform-aws-lambda implementation
264+
- Added example of Dockerfile for custom AWS Lambda build env
265+
- Added initial draft implementation of lambda.py and package.tf
266+
267+
268+
<a name="v0.0.1"></a>
269+
## v0.0.1 - 2020-06-02
270+
271+
- first commit
272+
273+
274+
[Unreleased]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.29.0...HEAD
275+
[v1.29.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.28.0...v1.29.0
276+
[v1.28.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.27.0...v1.28.0
277+
[v1.27.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.26.0...v1.27.0
278+
[v1.26.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.25.0...v1.26.0
279+
[v1.25.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.24.0...v1.25.0
280+
[v1.24.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.23.0...v1.24.0
281+
[v1.23.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.22.0...v1.23.0
282+
[v1.22.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.21.0...v1.22.0
283+
[v1.21.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.20.0...v1.21.0
284+
[v1.20.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.6.1...v1.20.0
285+
[v1.6.1]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.19.0...v1.6.1
286+
[v1.19.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.18.0...v1.19.0
287+
[v1.18.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.17.0...v1.18.0
288+
[v1.17.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.16.0...v1.17.0
289+
[v1.16.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.15.0...v1.16.0
290+
[v1.15.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.14.0...v1.15.0
291+
[v1.14.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.13.0...v1.14.0
292+
[v1.13.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.12.0...v1.13.0
293+
[v1.12.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.11.0...v1.12.0
294+
[v1.11.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.10.0...v1.11.0
295+
[v1.10.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.9.0...v1.10.0
296+
[v1.9.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.8.0...v1.9.0
297+
[v1.8.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.7.0...v1.8.0
298+
[v1.7.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.6.0...v1.7.0
299+
[v1.6.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.5.0...v1.6.0
300+
[v1.5.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.4.0...v1.5.0
301+
[v1.4.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.3.0...v1.4.0
302+
[v1.3.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.2.0...v1.3.0
303+
[v1.2.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.1.0...v1.2.0
304+
[v1.1.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v1.0.0...v1.1.0
305+
[v1.0.0]: https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v0.0.1...v1.0.0

‎LICENSE

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright 2020 Anton Babenko (Betajob AS)
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.

‎Makefile

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
.PHONY: changelog release
2+
3+
changelog:
4+
git-chglog -o CHANGELOG.md --next-tag `semtag final -s minor -o`
5+
6+
release:
7+
semtag final -s minor

‎README.md

+194
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
# AWS Step Functions Terraform module
2+
3+
Terraform module, which creates AWS Step Functions as well as required IAM role and IAM policies for [Integrated Services](https://docs.aws.amazon.com/step-functions/latest/dg/service-integration-iam-templates.html).
4+
5+
This Terraform module is the part of [serverless.tf framework](https://github.com/antonbabenko/serverless.tf), which aims to simplify all operations when working with the serverless in Terraform.
6+
7+
8+
## Features
9+
10+
- [x] Creates AWS Step Function
11+
- [x] Conditional creation for many types of resources
12+
- [x] Support IAM policy attachments for [Integrated Services (eg, Lambda, SQS, ECS, EKS, Batch, DynamoDB, etc)](https://docs.aws.amazon.com/step-functions/latest/dg/service-integration-iam-templates.html) and various ways to create and attach additional policies
13+
14+
15+
## Usage
16+
17+
### Step Function
18+
19+
```hcl
20+
module "step_function" {
21+
source = "terraform-aws-modules/step-function/aws"
22+
23+
name = "my-step-function"
24+
definition = <<EOF
25+
{
26+
"Comment": "A Hello World example of the Amazon States Language using Pass states",
27+
"StartAt": "Hello",
28+
"States": {
29+
"Hello": {
30+
"Type": "Pass",
31+
"Result": "Hello",
32+
"Next": "World"
33+
},
34+
"World": {
35+
"Type": "Pass",
36+
"Result": "World",
37+
"End": true
38+
}
39+
}
40+
}
41+
EOF
42+
43+
service_integrations = {
44+
dynamodb = {
45+
dynamodb = ["arn:aws:dynamodb:eu-west-1:052212379155:table/Test"]
46+
}
47+
48+
lambda = {
49+
lambda = ["arn:aws:lambda:eu-west-1:123456789012:function:test1", "arn:aws:lambda:eu-west-1:123456789012:function:test2"]
50+
}
51+
}
52+
53+
tags = {
54+
Module = "my"
55+
}
56+
}
57+
```
58+
59+
## Service integration policies
60+
61+
There are predefined policies for all available integrations (see `aws_service_policies` in `locals.tf` for values) which can be used as a key inside `service_integrations` argument.
62+
63+
Each key of `aws_service_policies` contains configuration for the IAM policy statements which will be combined with the values specified in `service_integrations` argument.
64+
65+
Example of `service_integrations` arguments:
66+
67+
```hcl
68+
module "step_function" {
69+
source = "terraform-aws-modules/step-function/aws"
70+
71+
# ... omitted
72+
service_integrations = {
73+
xray = {
74+
xray = true # the value of default_resources key will be used when key value is `true`
75+
}
76+
77+
sqs = {
78+
sqs = "arn:aws:sqs:..." # sqs queue ARN is required because there is no default_resources key for such integration
79+
}
80+
81+
# Special case to deny all actions for the step function (this will override all IAM policies allowed for the function)
82+
no_tasks = {
83+
deny_all = true
84+
}
85+
}
86+
}
87+
```
88+
89+
90+
## Additional IAM policies for Step Function
91+
92+
In addition to all supported AWS service integrations you may want to create and attach additional policies.
93+
94+
There are 5 supported ways to attach additional IAM policies to IAM role used by Step Function:
95+
96+
1. `policy_json` - JSON string or heredoc, when `attach_policy_json = true`.
97+
1. `policy_jsons` - List of JSON strings or heredoc, when `attach_policy_jsons = true` and `number_of_policy_jsons > 0`.
98+
1. `policy` - ARN of existing IAM policy, when `attach_policy = true`.
99+
1. `policies` - List of ARNs of existing IAM policies, when `attach_policies = true` and `number_of_policies > 0`.
100+
1. `policy_statements` - Map of maps to define IAM statements which will be generated as IAM policy. Requires `attach_policy_statements = true`. See `examples/complete` for more information.
101+
102+
103+
## Conditional creation
104+
105+
Sometimes you need to have a way to create resources conditionally, so the solution is to specify `create` arguments.
106+
107+
```hcl
108+
module "step_function" {
109+
source = "terraform-aws-modules/step-function/aws"
110+
111+
create = false # to disable all resources
112+
create_role = false # to control creation of the IAM role and policies required for Step Function
113+
114+
# ... omitted
115+
}
116+
```
117+
118+
119+
## Examples
120+
121+
* [Complete](https://github.com/terraform-aws-modules/terraform-aws-step-function/tree/master/examples/complete) - Create Step Function and required IAM resources in various combinations with all supported features.
122+
123+
124+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
125+
## Requirements
126+
127+
| Name | Version |
128+
|------|---------|
129+
| terraform | >= 0.12.6 |
130+
| aws | >= 2.67 |
131+
132+
## Providers
133+
134+
| Name | Version |
135+
|------|---------|
136+
| aws | >= 2.67 |
137+
138+
## Inputs
139+
140+
| Name | Description | Type | Default | Required |
141+
|------|-------------|------|---------|:--------:|
142+
| attach\_policies | Controls whether list of policies should be added to IAM role | `bool` | `false` | no |
143+
| attach\_policies\_for\_integrations | Whether to attach AWS Service policies to IAM role | `bool` | `true` | no |
144+
| attach\_policy | Controls whether policy should be added to IAM role | `bool` | `false` | no |
145+
| attach\_policy\_json | Controls whether policy\_json should be added to IAM role | `bool` | `false` | no |
146+
| attach\_policy\_jsons | Controls whether policy\_jsons should be added to IAM role | `bool` | `false` | no |
147+
| attach\_policy\_statements | Controls whether policy\_statements should be added to IAM role | `bool` | `false` | no |
148+
| aws\_region\_assume\_role | Name of AWS regions where IAM role can be assumed by the Step Function | `string` | `""` | no |
149+
| create | Whether to create Step Function resource | `bool` | `true` | no |
150+
| create\_role | Whether to create IAM role for the Step Function | `bool` | `true` | no |
151+
| definition | The Amazon States Language definition of the Step Function | `string` | `""` | no |
152+
| name | The name of the Step Function | `string` | `""` | no |
153+
| number\_of\_policies | Number of policies to attach to IAM role | `number` | `0` | no |
154+
| number\_of\_policy\_jsons | Number of policies JSON to attach to IAM role | `number` | `0` | no |
155+
| policies | List of policy statements ARN to attach to IAM role | `list(string)` | `[]` | no |
156+
| policy | An additional policy document ARN to attach to IAM role | `string` | `null` | no |
157+
| policy\_json | An additional policy document as JSON to attach to IAM role | `string` | `null` | no |
158+
| policy\_jsons | List of additional policy documents as JSON to attach to IAM role | `list(string)` | `[]` | no |
159+
| policy\_statements | Map of dynamic policy statements to attach to IAM role | `any` | `{}` | no |
160+
| role\_arn | The Amazon Resource Name (ARN) of the IAM role to use for this Step Function | `string` | `""` | no |
161+
| role\_description | Description of IAM role to use for Step Function | `string` | `null` | no |
162+
| role\_force\_detach\_policies | Specifies to force detaching any policies the IAM role has before destroying it. | `bool` | `true` | no |
163+
| role\_name | Name of IAM role to use for Step Function | `string` | `null` | no |
164+
| role\_path | Path of IAM role to use for Step Function | `string` | `null` | no |
165+
| role\_permissions\_boundary | The ARN of the policy that is used to set the permissions boundary for the IAM role used by Step Function | `string` | `null` | no |
166+
| role\_tags | A map of tags to assign to IAM role | `map(string)` | `{}` | no |
167+
| service\_integrations | Map of AWS service integrations to allow in IAM role policy | `any` | `{}` | no |
168+
| tags | Maps of tags to assign to the Step Function | `map(string)` | `{}` | no |
169+
| trusted\_entities | Step Function additional trusted entities for assuming roles (trust relationship) | `list(string)` | `[]` | no |
170+
| use\_existing\_role | Whether to use an existing IAM role for this Step Function | `bool` | `false` | no |
171+
172+
## Outputs
173+
174+
| Name | Description |
175+
|------|-------------|
176+
| this\_role\_arn | The ARN of the IAM role created for the Step Function |
177+
| this\_role\_name | The name of the IAM role created for the Step Function |
178+
| this\_state\_machine\_arn | The ARN of the Step Function |
179+
| this\_state\_machine\_creation\_date | The date the Step Function was created |
180+
| this\_state\_machine\_id | The ARN of the Step Function |
181+
| this\_state\_machine\_status | The current status of the Step Function |
182+
183+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
184+
185+
## Authors
186+
187+
Module managed by [Anton Babenko](https://github.com/antonbabenko). Check out [serverless.tf](https://serverless.tf) to learn more about doing serverless with Terraform.
188+
189+
Please reach out to [Betajob](https://www.betajob.com/) if you are looking for commercial support for your Terraform, AWS, or serverless project.
190+
191+
192+
## License
193+
194+
Apache 2 Licensed. See LICENSE for full details.

‎examples/complete/README.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Complete AWS Step Function example
2+
3+
Configuration in this directory creates AWS Step Function and IAM role with large variety of supported AWS Service integrations and custom policies.
4+
5+
Note: You probably don't need to set custom/additional policies but use `service_integrations` only.
6+
7+
8+
## Usage
9+
10+
To run this example you need to execute:
11+
12+
```bash
13+
$ terraform init
14+
$ terraform plan
15+
$ terraform apply
16+
```
17+
18+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
19+
20+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
21+
## Requirements
22+
23+
| Name | Version |
24+
|------|---------|
25+
| terraform | >= 0.12.6 |
26+
| aws | >= 2.67 |
27+
| random | >= 2 |
28+
29+
## Providers
30+
31+
| Name | Version |
32+
|------|---------|
33+
| aws | >= 2.67 |
34+
| random | >= 2 |
35+
36+
## Inputs
37+
38+
No input.
39+
40+
## Outputs
41+
42+
| Name | Description |
43+
|------|-------------|
44+
| this\_role\_arn | The ARN of the IAM role created for the State Machine |
45+
| this\_role\_name | The name of the IAM role created for the State Machine |
46+
| this\_state\_machine\_arn | The ARN of the State Machine |
47+
| this\_state\_machine\_creation\_date | The date the State Machine was created |
48+
| this\_state\_machine\_id | The ARN of the State Machine |
49+
| this\_state\_machine\_status | The current status of the State Machine |
50+
51+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/complete/main.tf

+156
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
4+
# Make it faster by skipping something
5+
skip_get_ec2_platforms = true
6+
skip_metadata_api_check = true
7+
skip_region_validation = true
8+
skip_credentials_validation = true
9+
skip_requesting_account_id = true
10+
}
11+
12+
locals {
13+
definition_template = <<EOF
14+
{
15+
"Comment": "A Hello World example of the Amazon States Language using Pass states",
16+
"StartAt": "Hello",
17+
"States": {
18+
"Hello": {
19+
"Type": "Pass",
20+
"Result": "Hello",
21+
"Next": "World"
22+
},
23+
"World": {
24+
"Type": "Pass",
25+
"Result": "World",
26+
"End": true
27+
}
28+
}
29+
}
30+
EOF
31+
}
32+
33+
34+
module "step_function" {
35+
source = "../../"
36+
37+
name = random_pet.this.id
38+
39+
definition = local.definition_template
40+
41+
service_integrations = {
42+
43+
dynamodb = {
44+
dynamodb = ["arn:aws:dynamodb:eu-west-1:052212379155:table/Test"]
45+
}
46+
47+
athena_StartQueryExecution_Sync = {
48+
athena = ["arn:aws:athena:eu-west-1:123456789012:something1:test1"]
49+
glue = ["arn:aws:glue:eu-west-1:123456789012:something2:test1"]
50+
s3 = true # options: true (use default value from `aws_service_policies`) or provide a list of ARNs
51+
lakeformation = ["arn:aws:lakeformation:eu-west-1:123456789012:something3:test1"]
52+
}
53+
54+
lambda = {
55+
lambda = ["arn:aws:lambda:eu-west-1:123456789012:function:test1", "arn:aws:lambda:eu-west-1:123456789012:function:test2"]
56+
}
57+
58+
xray = {
59+
xray = true
60+
}
61+
62+
no_tasks = {
63+
deny_all = true
64+
}
65+
}
66+
67+
######################
68+
# Additional policies
69+
# Probably you are not going to need them (use `service_integrations` instead)!
70+
######################
71+
72+
attach_policy_json = true
73+
policy_json = <<EOF
74+
{
75+
"Version": "2012-10-17",
76+
"Statement": [
77+
{
78+
"Effect": "Allow",
79+
"Action": [
80+
"xray:GetSamplingStatisticSummaries"
81+
],
82+
"Resource": ["*"]
83+
}
84+
]
85+
}
86+
EOF
87+
88+
attach_policy_jsons = true
89+
policy_jsons = [<<EOF
90+
{
91+
"Version": "2012-10-17",
92+
"Statement": [
93+
{
94+
"Effect": "Allow",
95+
"Action": [
96+
"xray:*"
97+
],
98+
"Resource": ["*"]
99+
}
100+
]
101+
}
102+
EOF
103+
]
104+
number_of_policy_jsons = 1
105+
106+
attach_policy = true
107+
policy = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
108+
109+
attach_policies = true
110+
policies = ["arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess"]
111+
number_of_policies = 1
112+
113+
attach_policy_statements = true
114+
policy_statements = {
115+
dynamodb = {
116+
effect = "Allow",
117+
actions = ["dynamodb:BatchWriteItem"],
118+
resources = ["arn:aws:dynamodb:eu-west-1:052212379155:table/Test"]
119+
},
120+
s3_read = {
121+
effect = "Deny",
122+
actions = ["s3:HeadObject", "s3:GetObject"],
123+
resources = ["arn:aws:s3:::my-bucket/*"]
124+
}
125+
}
126+
127+
###########################
128+
# END: Additional policies
129+
###########################
130+
131+
tags = {
132+
Module = "step_function"
133+
}
134+
}
135+
136+
###########
137+
# Disabled
138+
###########
139+
140+
module "disabled_step_function" {
141+
source = "../../"
142+
143+
create = false
144+
}
145+
146+
##################
147+
# Extra resources
148+
##################
149+
150+
resource "random_pet" "this" {
151+
length = 2
152+
}
153+
154+
resource "aws_sqs_queue" "queue" {
155+
name = random_pet.this.id
156+
}

‎examples/complete/outputs.tf

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# State Machine
2+
output "this_state_machine_id" {
3+
description = "The ARN of the State Machine"
4+
value = module.step_function.this_state_machine_id
5+
}
6+
7+
output "this_state_machine_arn" {
8+
description = "The ARN of the State Machine"
9+
value = module.step_function.this_state_machine_arn
10+
}
11+
12+
output "this_state_machine_creation_date" {
13+
description = "The date the State Machine was created"
14+
value = module.step_function.this_state_machine_creation_date
15+
}
16+
17+
output "this_state_machine_status" {
18+
description = "The current status of the State Machine"
19+
value = module.step_function.this_state_machine_status
20+
}
21+
22+
# IAM Role
23+
output "this_role_arn" {
24+
description = "The ARN of the IAM role created for the State Machine"
25+
value = module.step_function.this_role_arn
26+
}
27+
28+
output "this_role_name" {
29+
description = "The name of the IAM role created for the State Machine"
30+
value = module.step_function.this_role_name
31+
}

‎examples/complete/variables.tf

Whitespace-only changes.

‎examples/complete/versions.tf

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
terraform {
2+
required_version = ">= 0.12.6"
3+
4+
required_providers {
5+
aws = ">= 2.67"
6+
random = ">= 2"
7+
}
8+
}

‎locals.tf

+709
Large diffs are not rendered by default.

‎main.tf

+217
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
locals {
2+
create_role = var.create && var.create_role && ! var.use_existing_role
3+
aws_region = local.create_role && var.aws_region_assume_role == "" ? data.aws_region.current[0].name : var.aws_region_assume_role
4+
5+
role_name = local.create_role ? coalesce(var.role_name, var.name) : null
6+
}
7+
8+
resource "aws_sfn_state_machine" "this" {
9+
count = var.create ? 1 : 0
10+
11+
name = var.name
12+
13+
role_arn = var.use_existing_role ? var.role_arn : aws_iam_role.this[0].arn
14+
definition = var.definition
15+
16+
tags = merge({ Name = var.name }, var.tags)
17+
}
18+
19+
###########
20+
# IAM Role
21+
###########
22+
23+
data "aws_region" "current" {
24+
count = local.create_role && var.aws_region_assume_role == "" ? 1 : 0
25+
}
26+
27+
data "aws_iam_policy_document" "assume_role" {
28+
count = local.create_role ? 1 : 0
29+
30+
statement {
31+
effect = "Allow"
32+
actions = ["sts:AssumeRole"]
33+
34+
principals {
35+
type = "Service"
36+
identifiers = distinct(concat(["states.${local.aws_region}.amazonaws.com"], var.trusted_entities))
37+
}
38+
}
39+
}
40+
41+
resource "aws_iam_role" "this" {
42+
count = local.create_role ? 1 : 0
43+
44+
name = local.role_name
45+
description = var.role_description
46+
path = var.role_path
47+
force_detach_policies = var.role_force_detach_policies
48+
permissions_boundary = var.role_permissions_boundary
49+
assume_role_policy = data.aws_iam_policy_document.assume_role[0].json
50+
51+
tags = merge(var.tags, var.role_tags)
52+
}
53+
54+
##############################
55+
# Predefined service policies
56+
##############################
57+
58+
data "aws_iam_policy_document" "service" {
59+
for_each = local.create_role && var.attach_policies_for_integrations ? var.service_integrations : tomap({})
60+
61+
dynamic "statement" {
62+
for_each = each.value
63+
64+
content {
65+
effect = lookup(local.aws_service_policies[each.key][statement.key], "effect", "Allow")
66+
sid = replace("${each.key}${title(statement.key)}", "/[^0-9A-Za-z]*/", "")
67+
actions = local.aws_service_policies[each.key][statement.key]["actions"]
68+
resources = statement.value == true ? local.aws_service_policies[each.key][statement.key]["default_resources"] : tolist(statement.value)
69+
70+
dynamic "condition" {
71+
for_each = lookup(local.aws_service_policies[each.key][statement.key], "condition", [])
72+
content {
73+
test = condition.value.test
74+
variable = condition.value.variable
75+
values = condition.value.values
76+
}
77+
}
78+
}
79+
}
80+
}
81+
82+
resource "aws_iam_policy" "service" {
83+
for_each = local.create_role && var.attach_policy_statements ? var.service_integrations : tomap({})
84+
85+
name = "${local.role_name}-${each.key}"
86+
policy = data.aws_iam_policy_document.service[each.key].json
87+
}
88+
89+
resource "aws_iam_policy_attachment" "service" {
90+
for_each = local.create_role && var.attach_policy_statements ? var.service_integrations : tomap({})
91+
92+
name = "${local.role_name}-${each.key}"
93+
roles = [aws_iam_role.this[0].name]
94+
policy_arn = aws_iam_policy.service[each.key].arn
95+
}
96+
97+
98+
###########################
99+
# Additional policy (JSON)
100+
###########################
101+
102+
resource "aws_iam_policy" "additional_json" {
103+
count = local.create_role && var.attach_policy_json ? 1 : 0
104+
105+
name = local.role_name
106+
policy = var.policy_json
107+
}
108+
109+
resource "aws_iam_policy_attachment" "additional_json" {
110+
count = local.create_role && var.attach_policy_json ? 1 : 0
111+
112+
name = local.role_name
113+
roles = [aws_iam_role.this[0].name]
114+
policy_arn = aws_iam_policy.additional_json[0].arn
115+
}
116+
117+
#####################################
118+
# Additional policies (list of JSON)
119+
#####################################
120+
121+
resource "aws_iam_policy" "additional_jsons" {
122+
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0
123+
124+
name = "${local.role_name}-${count.index}"
125+
policy = var.policy_jsons[count.index]
126+
}
127+
128+
resource "aws_iam_policy_attachment" "additional_jsons" {
129+
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0
130+
131+
name = "${local.role_name}-${count.index}"
132+
roles = [aws_iam_role.this[0].name]
133+
policy_arn = aws_iam_policy.additional_jsons[count.index].arn
134+
}
135+
136+
###########################
137+
# ARN of additional policy
138+
###########################
139+
140+
resource "aws_iam_role_policy_attachment" "additional_one" {
141+
count = local.create_role && var.attach_policy ? 1 : 0
142+
143+
role = aws_iam_role.this[0].name
144+
policy_arn = var.policy
145+
}
146+
147+
######################################
148+
# List of ARNs of additional policies
149+
######################################
150+
151+
resource "aws_iam_role_policy_attachment" "additional_many" {
152+
count = local.create_role && var.attach_policies ? var.number_of_policies : 0
153+
154+
role = aws_iam_role.this[0].name
155+
policy_arn = var.policies[count.index]
156+
}
157+
158+
###############################
159+
# Additional policy statements
160+
###############################
161+
162+
data "aws_iam_policy_document" "additional_inline" {
163+
count = local.create_role && var.attach_policy_statements ? 1 : 0
164+
165+
dynamic "statement" {
166+
for_each = var.policy_statements
167+
168+
content {
169+
sid = lookup(statement.value, "sid", replace(statement.key, "/[^0-9A-Za-z]*/", ""))
170+
effect = lookup(statement.value, "effect", null)
171+
actions = lookup(statement.value, "actions", null)
172+
not_actions = lookup(statement.value, "not_actions", null)
173+
resources = lookup(statement.value, "resources", null)
174+
not_resources = lookup(statement.value, "not_resources", null)
175+
176+
dynamic "principals" {
177+
for_each = lookup(statement.value, "principals", [])
178+
content {
179+
type = principals.value.type
180+
identifiers = principals.value.identifiers
181+
}
182+
}
183+
184+
dynamic "not_principals" {
185+
for_each = lookup(statement.value, "not_principals", [])
186+
content {
187+
type = not_principals.value.type
188+
identifiers = not_principals.value.identifiers
189+
}
190+
}
191+
192+
dynamic "condition" {
193+
for_each = lookup(statement.value, "condition", [])
194+
content {
195+
test = condition.value.test
196+
variable = condition.value.variable
197+
values = condition.value.values
198+
}
199+
}
200+
}
201+
}
202+
}
203+
204+
resource "aws_iam_policy" "additional_inline" {
205+
count = local.create_role && var.attach_policy_statements ? 1 : 0
206+
207+
name = "${local.role_name}-inline"
208+
policy = data.aws_iam_policy_document.additional_inline[0].json
209+
}
210+
211+
resource "aws_iam_policy_attachment" "additional_inline" {
212+
count = local.create_role && var.attach_policy_statements ? 1 : 0
213+
214+
name = local.role_name
215+
roles = [aws_iam_role.this[0].name]
216+
policy_arn = aws_iam_policy.additional_inline[0].arn
217+
}

‎outputs.tf

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Step Function
2+
output "this_state_machine_id" {
3+
description = "The ARN of the Step Function"
4+
value = element(concat(aws_sfn_state_machine.this.*.id, [""]), 0)
5+
}
6+
7+
output "this_state_machine_arn" {
8+
description = "The ARN of the Step Function"
9+
value = element(concat(aws_sfn_state_machine.this.*.arn, [""]), 0)
10+
}
11+
12+
output "this_state_machine_creation_date" {
13+
description = "The date the Step Function was created"
14+
value = element(concat(aws_sfn_state_machine.this.*.creation_date, [""]), 0)
15+
}
16+
17+
output "this_state_machine_status" {
18+
description = "The current status of the Step Function"
19+
value = element(concat(aws_sfn_state_machine.this.*.status, [""]), 0)
20+
}
21+
22+
# IAM Role
23+
output "this_role_arn" {
24+
description = "The ARN of the IAM role created for the Step Function"
25+
value = element(concat(aws_iam_role.this.*.arn, [""]), 0)
26+
}
27+
28+
output "this_role_name" {
29+
description = "The name of the IAM role created for the Step Function"
30+
value = element(concat(aws_iam_role.this.*.name, [""]), 0)
31+
}

‎variables.tf

+190
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
variable "create" {
2+
description = "Whether to create Step Function resource"
3+
type = bool
4+
default = true
5+
}
6+
7+
variable "create_role" {
8+
description = "Whether to create IAM role for the Step Function"
9+
type = bool
10+
default = true
11+
}
12+
13+
variable "use_existing_role" {
14+
description = "Whether to use an existing IAM role for this Step Function"
15+
type = bool
16+
default = false
17+
}
18+
19+
################
20+
# Step Function
21+
################
22+
23+
variable "name" {
24+
description = "The name of the Step Function"
25+
type = string
26+
default = ""
27+
}
28+
29+
variable "definition" {
30+
description = "The Amazon States Language definition of the Step Function"
31+
type = string
32+
default = ""
33+
}
34+
35+
variable "role_arn" {
36+
description = "The Amazon Resource Name (ARN) of the IAM role to use for this Step Function"
37+
type = string
38+
default = ""
39+
}
40+
41+
variable "tags" {
42+
description = "Maps of tags to assign to the Step Function"
43+
type = map(string)
44+
default = {}
45+
}
46+
47+
###########
48+
# IAM Role
49+
###########
50+
51+
variable "aws_region_assume_role" {
52+
description = "Name of AWS regions where IAM role can be assumed by the Step Function"
53+
type = string
54+
default = ""
55+
}
56+
57+
variable "role_name" {
58+
description = "Name of IAM role to use for Step Function"
59+
type = string
60+
default = null
61+
}
62+
63+
variable "role_description" {
64+
description = "Description of IAM role to use for Step Function"
65+
type = string
66+
default = null
67+
}
68+
69+
variable "role_path" {
70+
description = "Path of IAM role to use for Step Function"
71+
type = string
72+
default = null
73+
}
74+
75+
variable "role_force_detach_policies" {
76+
description = "Specifies to force detaching any policies the IAM role has before destroying it."
77+
type = bool
78+
default = true
79+
}
80+
81+
variable "role_permissions_boundary" {
82+
description = "The ARN of the policy that is used to set the permissions boundary for the IAM role used by Step Function"
83+
type = string
84+
default = null
85+
}
86+
87+
variable "role_tags" {
88+
description = "A map of tags to assign to IAM role"
89+
type = map(string)
90+
default = {}
91+
}
92+
93+
#####################################################
94+
# Predefined IAM Policies for supported AWS Services
95+
# (Lambda, DynamoDB, ECS, EKS, EMR, SageMaker, ...)
96+
#####################################################
97+
98+
variable "attach_policies_for_integrations" {
99+
description = "Whether to attach AWS Service policies to IAM role"
100+
type = bool
101+
default = true
102+
}
103+
104+
variable "service_integrations" {
105+
description = "Map of AWS service integrations to allow in IAM role policy"
106+
type = any
107+
default = {}
108+
}
109+
110+
##########################
111+
# Various custom policies
112+
##########################
113+
114+
variable "attach_policy_json" {
115+
description = "Controls whether policy_json should be added to IAM role"
116+
type = bool
117+
default = false
118+
}
119+
120+
variable "attach_policy_jsons" {
121+
description = "Controls whether policy_jsons should be added to IAM role"
122+
type = bool
123+
default = false
124+
}
125+
126+
variable "attach_policy" {
127+
description = "Controls whether policy should be added to IAM role"
128+
type = bool
129+
default = false
130+
}
131+
132+
variable "attach_policies" {
133+
description = "Controls whether list of policies should be added to IAM role"
134+
type = bool
135+
default = false
136+
}
137+
138+
variable "number_of_policy_jsons" {
139+
description = "Number of policies JSON to attach to IAM role"
140+
type = number
141+
default = 0
142+
}
143+
144+
variable "number_of_policies" {
145+
description = "Number of policies to attach to IAM role"
146+
type = number
147+
default = 0
148+
}
149+
150+
variable "attach_policy_statements" {
151+
description = "Controls whether policy_statements should be added to IAM role"
152+
type = bool
153+
default = false
154+
}
155+
156+
variable "trusted_entities" {
157+
description = "Step Function additional trusted entities for assuming roles (trust relationship)"
158+
type = list(string)
159+
default = []
160+
}
161+
162+
variable "policy_json" {
163+
description = "An additional policy document as JSON to attach to IAM role"
164+
type = string
165+
default = null
166+
}
167+
168+
variable "policy_jsons" {
169+
description = "List of additional policy documents as JSON to attach to IAM role"
170+
type = list(string)
171+
default = []
172+
}
173+
174+
variable "policy" {
175+
description = "An additional policy document ARN to attach to IAM role"
176+
type = string
177+
default = null
178+
}
179+
180+
variable "policies" {
181+
description = "List of policy statements ARN to attach to IAM role"
182+
type = list(string)
183+
default = []
184+
}
185+
186+
variable "policy_statements" {
187+
description = "Map of dynamic policy statements to attach to IAM role"
188+
type = any
189+
default = {}
190+
}

‎versions.tf

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
terraform {
2+
required_version = ">= 0.12.6"
3+
4+
required_providers {
5+
aws = ">= 2.67"
6+
}
7+
}

0 commit comments

Comments
 (0)
Please sign in to comment.