Page Menu
Home
Phorge
Search
Configure Global Search
Log In
Files
F32400983
D9878.1765340604.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Flag For Later
Award Token
Size
7 KB
Referenced Files
None
Subscribers
None
D9878.1765340604.diff
View Options
diff --git a/services/search-index-lambda/.gitignore b/services/search-index-lambda/.gitignore
new file mode 100644
diff --git a/services/terraform/dev/main.tf b/services/terraform/dev/main.tf
--- a/services/terraform/dev/main.tf
+++ b/services/terraform/dev/main.tf
@@ -45,7 +45,7 @@
module "shared" {
source = "../modules/shared"
is_dev = true
-
+
vpc_id = null
cidr_block = null
subnet_ids = []
diff --git a/services/terraform/modules/shared/dynamodb.tf b/services/terraform/modules/shared/dynamodb.tf
--- a/services/terraform/modules/shared/dynamodb.tf
+++ b/services/terraform/modules/shared/dynamodb.tf
@@ -83,7 +83,7 @@
name = "tunnelbroker-undelivered-messages"
hash_key = "deviceID"
range_key = "messageID"
- billing_mode = "PAY_PER_REQUEST"
+ billing_mode = "PAY_PER_REQUEST"
attribute {
name = "deviceID"
@@ -103,7 +103,6 @@
stream_enabled = true
stream_view_type = "NEW_AND_OLD_IMAGES"
-
attribute {
name = "userID"
type = "S"
diff --git a/services/terraform/modules/shared/opensearch.tf b/services/terraform/modules/shared/opensearch.tf
--- a/services/terraform/modules/shared/opensearch.tf
+++ b/services/terraform/modules/shared/opensearch.tf
@@ -3,7 +3,7 @@
}
resource "aws_security_group" "identity-search" {
- count = var.is_dev ? 0 : 1
+ count = var.is_dev ? 0 : 1
name = "${var.vpc_id}-opensearch-service-${var.domain}"
description = "Managed by Terraform"
vpc_id = var.is_dev ? null : var.vpc_id
@@ -29,7 +29,7 @@
engine_version = "OpenSearch_1.0"
cluster_config {
- instance_type = "t3.medium.search"
+ instance_type = "t3.medium.search"
}
vpc_options {
diff --git a/services/terraform/modules/shared/outputs.tf b/services/terraform/modules/shared/outputs.tf
--- a/services/terraform/modules/shared/outputs.tf
+++ b/services/terraform/modules/shared/outputs.tf
@@ -4,6 +4,7 @@
aws_dynamodb_table.backup-service-backup,
aws_dynamodb_table.reports-service-reports,
aws_dynamodb_table.tunnelbroker-undelivered-messages,
+ aws_dynamodb_table.identity-users,
]
}
diff --git a/services/terraform/modules/shared/search_index_lambda.tf b/services/terraform/modules/shared/search_index_lambda.tf
new file mode 100644
--- /dev/null
+++ b/services/terraform/modules/shared/search_index_lambda.tf
@@ -0,0 +1,62 @@
+variable "search_index_lambda_iam_role_arn" {
+ default = "arn:aws:iam::000000000000:role/lambda-role"
+}
+
+
+variable "lambda_zip_dir" {
+ type = string
+ default = "../../search-index-lambda/target/lambda/search-index-lambda"
+}
+
+resource "aws_lambda_function" "search_index_lambda" {
+ function_name = "search-index-lambda-function"
+ filename = "${var.lambda_zip_dir}/bootstrap.zip"
+ source_code_hash = filebase64sha256("${var.lambda_zip_dir}/bootstrap.zip")
+ handler = "bootstrap"
+ role = var.search_index_lambda_iam_role_arn
+ runtime = "provided.al2"
+ architectures = ["arm64"]
+ timeout = 300
+
+ vpc_config {
+ subnet_ids = var.subnet_ids
+ security_group_ids = [aws_security_group.search_index_lambda.id]
+ }
+
+ environment {
+ variables = {
+ RUST_BACKTRACE = "1"
+ OPENSEARCH_ENDPOINT = aws_opensearch_domain.identity-search.endpoint
+ }
+ }
+
+ tracing_config {
+ mode = "Active"
+ }
+}
+
+resource "aws_lambda_event_source_mapping" "trigger" {
+ count = var.is_dev ? 0 : 1
+ event_source_arn = aws_dynamodb_table.identity-users.stream_arn
+ function_name = aws_lambda_function.search_index_lambda.arn
+ starting_position = "LATEST"
+}
+
+resource "aws_security_group" "search_index_lambda" {
+ name = "search_index_lambda_sg"
+ vpc_id = var.vpc_id
+
+ egress {
+ from_port = 443
+ to_port = 443
+ protocol = "tcp"
+ cidr_blocks = ["0.0.0.0/0"]
+ }
+}
+
+
+resource "aws_lambda_function_event_invoke_config" "example" {
+ function_name = aws_lambda_function.search_index_lambda.function_name
+ maximum_event_age_in_seconds = 60
+ maximum_retry_attempts = 2
+}
diff --git a/services/terraform/remote/aws_iam.tf b/services/terraform/remote/aws_iam.tf
--- a/services/terraform/remote/aws_iam.tf
+++ b/services/terraform/remote/aws_iam.tf
@@ -195,13 +195,88 @@
]
}
+
+data "aws_iam_policy_document" "assume_identity_search_role" {
+ statement {
+ effect = "Allow"
+
+ principals {
+ type = "Service"
+ identifiers = ["lambda.amazonaws.com"]
+ }
+
+ actions = ["sts:AssumeRole"]
+ }
+}
+
+resource "aws_iam_role" "search_index_lambda" {
+ name = "search_index_lambda"
+ assume_role_policy = data.aws_iam_policy_document.assume_identity_search_role.json
+
+ managed_policy_arns = [
+ aws_iam_policy.manage_cloudwatch_logs.arn,
+ aws_iam_policy.read_identity_users_stream.arn,
+ ]
+}
+
+data "aws_iam_policy_document" "read_identity_users_stream" {
+ statement {
+ effect = "Allow"
+
+ actions = [
+ "dynamodb:GetRecords",
+ "dynamodb:GetShardIterator",
+ "dynamodb:DescribeStream",
+ "dynamodb:ListStreams",
+ ]
+ resources = [
+ module.shared.dynamodb_tables["identity-users"].arn,
+ module.shared.dynamodb_tables["identity-users"].stream_arn,
+ "${module.shared.dynamodb_tables["identity-users"].arn}/stream/*",
+ ]
+ }
+}
+
+resource "aws_iam_policy" "read_identity_users_stream" {
+ name = "read-identity-users-stream"
+ path = "/"
+ description = "IAM policy for managing identity-users stream"
+ policy = data.aws_iam_policy_document.read_identity_users_stream.json
+}
+
+data "aws_iam_policy_document" "manage_cloudwatch_logs" {
+ statement {
+ effect = "Allow"
+
+ actions = [
+ "logs:CreateLogGroup",
+ "logs:CreateLogStream",
+ "logs:PutLogEvents",
+ ]
+
+ resources = ["arn:aws:logs:*:*:*"]
+ }
+}
+
+resource "aws_iam_policy" "manage_cloudwatch_logs" {
+ name = "manage-cloudwatch-logs"
+ path = "/"
+ description = "IAM policy for managing cloudwatch logs"
+ policy = data.aws_iam_policy_document.manage_cloudwatch_logs.json
+}
+
+resource "aws_iam_role_policy_attachment" "AWSLambdaVPCAccessExecutionRole" {
+ role = aws_iam_role.search_index_lambda.name
+ policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
data "aws_iam_policy_document" "opensearch_domain_access" {
statement {
effect = "Allow"
principals {
type = "*"
- identifiers = []
+ identifiers = ["${aws_iam_role.search_index_lambda.arn}"]
}
actions = [
@@ -220,3 +295,4 @@
domain_name = module.shared.opensearch_domain_identity.domain_name
access_policies = data.aws_iam_policy_document.opensearch_domain_access.json
}
+
diff --git a/services/terraform/remote/main.tf b/services/terraform/remote/main.tf
--- a/services/terraform/remote/main.tf
+++ b/services/terraform/remote/main.tf
@@ -52,8 +52,9 @@
source = "../modules/shared"
bucket_name_suffix = local.s3_bucket_name_suffix
- vpc_id = aws_vpc.default.id
- cidr_block = aws_vpc.default.cidr_block
+ vpc_id = aws_vpc.default.id
+ search_index_lambda_iam_role_arn = aws_iam_role.search_index_lambda.arn
+ cidr_block = aws_vpc.default.cidr_block
subnet_ids = [
aws_subnet.public_a.id,
]
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Wed, Dec 10, 4:23 AM (19 h, 56 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
5860960
Default Alt Text
D9878.1765340604.diff (7 KB)
Attached To
Mode
D9878: [terraform] [4/n] search_index_lambda terraform configuration options
Attached
Detach File
Event Timeline
Log In to Comment