lambda.tf

data "archive_file" "lambda_zip" {
  type             = "zip"
  source_file      = "${path.module}/src/run_pipeline.py"
  output_file_mode = "0666"
  output_path      = "${path.module}/bin/run_pipeline.zip"
}

resource "aws_lambda_function" "processing_lambda" {
  filename         = data.archive_file.lambda_zip.output_path
  function_name    = local.processing_lambda_name
  handler          = "run_pipeline.lambda_handler"
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
  role             = aws_iam_role.processing_lambda_role.arn

  runtime = "python3.9"
  
  environment {
    variables = {
      s3_prefix = local.s3_prefix
      s3_suffix = local.s3_suffix
      pipeline_name = local.pipeline_name
      bitbucket_branch_name  = local.bitbucket_branch
      bitbucket_repo_owner = local.bitbucket_repo_owner
      bitbucket_repo_slug = local.bitbucket_repo_slug
    }
  }
}

resource "aws_iam_role" "processing_lambda_role" {
  name = local.processing_lambda_role_name
  path = "/service-role/"

  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "lambda.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy" "secrets_manager_access_policy" {
  policy = jsonencode(
  {
    Version : "2012-10-17",
    Statement : [
      {
        Effect   = "Allow",
        Action   = [
              "secretsmanager:GetSecretValue",
              "secretsmanager:DescribeSecret",
              "secretsmanager:ListSecretVersionIds",
              "secretsmanager:PutSecretValue",
              "secretsmanager:UpdateSecret",
              "secretsmanager:TagResource",
              "secretsmanager:UntagResource"
        ],
        Resource = [
          local.bitbucket_credential_arn
          ]
      }
    ]
  }
  )
  role   = aws_iam_role.processing_lambda_role.id
}

resource "aws_iam_role_policy" "cloudwatch_policy" {
  policy = jsonencode(
  {
    Version : "2012-10-17",
    Statement : [
      {
        Effect   = "Allow",
        Action   = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:AssociateKmsKey"
        ],
        Resource = "*"
      }
    ]
  }
  )
  role   = aws_iam_role.processing_lambda_role.id
}