Skip to content

Commit 42e5ae3

Browse files
Aatishsharma77h1manshu98
Aatishsharma77
and
h1manshu98
authored
Feat/rest api (#59)
* feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * feat: terrafrom script for rest-api and rest-api private * fix- if you are fixing changes other than terraform code {such as tfsec, tfchecks, readme issues and all * fix: update region in all _examples * fix: update service name in _examples * feat: update payload version in http api gateway * feat: update payload version in http api gateway * feat: add cloudwatch log group and kms in rest api gateway * feat: add cloudwatch log group and kms in rest api gateway * feat: add cloudwatch log group and kms key * remove unused variables and fix create condtion on resources * fix defsec warnings for nacl --------- Co-authored-by: Himanshu Ahirwar <himanshu.ahirwar@clouddrove.com>
1 parent 4e07cb4 commit 42e5ae3

File tree

17 files changed

+1322
-92
lines changed

17 files changed

+1322
-92
lines changed

‎_examples/complete/example.tf renamed to ‎_examples/complete/http-api-gateway/example.tf

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,23 @@
11
####----------------------------------------------------------------------------------
2-
## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
2+
## PROVIDER
33
####----------------------------------------------------------------------------------
44
provider "aws" {
5-
region = "eu-west-1"
5+
region = local.region
66
}
77

8+
####----------------------------------------------------------------------------------
9+
## LOCALS
10+
####----------------------------------------------------------------------------------
11+
812
locals {
9-
name = "api"
10-
environment = "test"
13+
name = "api"
14+
environment = "test"
15+
region = "us-east-1"
16+
domain_name = "clouddrove.ca"
17+
hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP"
1118
}
1219
####----------------------------------------------------------------------------------
13-
## This terraform module is designed to generate consistent label names and tags for resources.
20+
## ACM
1421
####----------------------------------------------------------------------------------
1522
module "acm" {
1623
source = "clouddrove/acm/aws"
@@ -19,24 +26,24 @@ module "acm" {
1926
name = local.name
2027
environment = local.environment
2128
enable_aws_certificate = true
22-
domain_name = "clouddrove.ca"
23-
subject_alternative_names = ["*.clouddrove.ca"]
29+
domain_name = local.domain_name
30+
subject_alternative_names = ["*.${local.domain_name}"]
2431
validation_method = "DNS"
2532
enable_dns_validation = false
2633
}
2734

2835
####----------------------------------------------------------------------------------
29-
## This terraform module is designed to generate consistent label names and tags for resources.
36+
## LAMBDA
3037
####----------------------------------------------------------------------------------
3138
module "lambda" {
3239
source = "clouddrove/lambda/aws"
3340
version = "1.3.1"
3441

3542
name = local.name
3643
environment = local.environment
37-
enabled = true
44+
enable = true
3845
timeout = 60
39-
filename = "./lambda_packages"
46+
filename = "../lambda_packages/index.zip"
4047
handler = "index.lambda_handler"
4148
runtime = "python3.8"
4249
iam_actions = [
@@ -47,38 +54,39 @@ module "lambda" {
4754
names = [
4855
"python_layer"
4956
]
50-
layer_filenames = ["./lambda-test.zip"]
5157
compatible_runtimes = [
5258
["python3.8"]
5359
]
5460
statement_ids = [
55-
"AllowExecutionFromCloudWatch"
61+
"AllowExecutionFromApiGateway"
5662
]
5763
actions = [
5864
"lambda:InvokeFunction"
5965
]
6066
principals = [
61-
"events.amazonaws.com"
67+
"apigateway.amazonaws.com"
6268
]
63-
source_arns = [module.api_gateway.api_arn]
6469
variables = {
6570
foo = "bar"
6671
}
6772
}
6873

6974
####----------------------------------------------------------------------------------
70-
## This terraform module is designed to generate consistent label names and tags for resources.
75+
## API GATEWAY
7176
####----------------------------------------------------------------------------------
7277
module "api_gateway" {
73-
source = "./../../"
78+
source = "../../../"
7479

7580
name = local.name
7681
environment = local.environment
77-
domain_name = "clouddrove.ca"
82+
domain_name = "api.${local.domain_name}"
7883
domain_name_certificate_arn = module.acm.arn
79-
integration_uri = module.lambda.arn
80-
zone_id = "1234059QJ345674343"
84+
integration_uri = module.lambda.invoke_arn
85+
zone_id = local.hosted_zone_id
86+
auto_deploy = true
87+
stage_name = "$default"
8188
create_vpc_link_enabled = false
89+
create_http_api = true
8290
cors_configuration = {
8391
allow_credentials = true
8492
allow_methods = ["GET", "OPTIONS", "POST"]
@@ -88,16 +96,16 @@ module "api_gateway" {
8896
"ANY /" = {
8997
lambda_arn = module.lambda.arn
9098
payload_format_version = "2.0"
91-
timeout_milliseconds = 12000
99+
timeout_milliseconds = 30000
92100
}
93101
"GET /some-route-with-authorizer" = {
94102
lambda_arn = module.lambda.arn
95-
payload_format_version = "2.0"
103+
payload_format_version = "1.0"
96104
authorizer_key = "cognito"
97105
}
98106
"POST /start-step-function" = {
99107
lambda_arn = module.lambda.arn
100-
payload_format_version = "2.0"
108+
payload_format_version = "1.0"
101109
authorizer_key = "cognito"
102110
}
103111
}

‎_examples/complete/outputs.tf renamed to ‎_examples/complete/http-api-gateway/outputs.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
output "api_id" {
2-
value = join("", module.api_gateway[*].api_id)
2+
value = module.api_gateway.api_id
33
description = "The API identifier."
44
}
55

66
output "api_arn" {
7-
value = join("", module.api_gateway[*].api_arn)
7+
value = module.api_gateway.api_arn
88
description = "The API arn."
99
}
1010

1111
output "api_endpoint" {
12-
value = join("", module.api_gateway[*].api_endpoint)
12+
value = module.api_gateway.api_endpoint
1313
description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com."
1414
}
1515

1616
output "invoke_url" {
17-
value = join("", module.api_gateway[*].invoke_url)
17+
value = module.api_gateway.invoke_url
1818
description = "URL to invoke the API pointing to the stage"
19-
}
19+
}

‎_examples/complete/versions.tf renamed to ‎_examples/complete/http-api-gateway/version.tf

File renamed without changes.

‎_examples/complete/lambda-test.zip

-330 Bytes
Binary file not shown.

‎_examples/complete/lambda_packages/index.py

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,7 @@
1-
import os
21
import json
3-
42
def lambda_handler(event, context):
5-
json_region = os.environ['AWS_REGION']
6-
return {
7-
"statusCode": 200,
8-
"headers": {
9-
"Content-Type": "application/json"
10-
},
11-
"body": json.dumps({
12-
"Region ": json_region
13-
})
14-
}
3+
print('Lambda function with Python!|')
4+
return {
5+
'statusCode': 200,
6+
'body': json.dumps('Hello from Lambda!')
7+
}

‎_examples/complete/lambda_packages/index.zip

335 Bytes
Binary file not shown.

‎_examples/complete/private-rest-api-gateway/example.tf

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
####----------------------------------------------------------------------------------
2+
## PROVIDER
3+
####----------------------------------------------------------------------------------
4+
5+
provider "aws" {
6+
region = local.region
7+
}
8+
####----------------------------------------------------------------------------------
9+
## LOCALS
10+
####----------------------------------------------------------------------------------
11+
12+
locals {
13+
name = "api"
14+
environment = "test"
15+
region = "us-east-1"
16+
domain_name = "clouddrove.ca"
17+
hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP"
18+
}
19+
####----------------------------------------------------------------------------------
20+
## ACM
21+
####----------------------------------------------------------------------------------
22+
23+
module "acm" {
24+
source = "clouddrove/acm/aws"
25+
version = "1.4.1"
26+
27+
name = local.name
28+
environment = local.environment
29+
enable_aws_certificate = true
30+
domain_name = local.domain_name
31+
subject_alternative_names = ["*.${local.domain_name}"]
32+
validation_method = "DNS"
33+
enable_dns_validation = false
34+
}
35+
36+
####----------------------------------------------------------------------------------
37+
## LAMBDA
38+
####----------------------------------------------------------------------------------
39+
40+
module "lambda" {
41+
source = "clouddrove/lambda/aws"
42+
version = "1.3.1"
43+
44+
name = local.name
45+
environment = local.environment
46+
enable = true
47+
timeout = 60
48+
filename = "../lambda_packages/index.zip"
49+
handler = "index.lambda_handler"
50+
runtime = "python3.8"
51+
iam_actions = [
52+
"logs:CreateLogStream",
53+
"logs:CreateLogGroup",
54+
"logs:PutLogEvents"
55+
]
56+
names = [
57+
"python_layer"
58+
]
59+
compatible_runtimes = [
60+
["python3.8"]
61+
]
62+
statement_ids = [
63+
"AllowExecutionFromApiGateway"
64+
]
65+
actions = [
66+
"lambda:InvokeFunction"
67+
]
68+
principals = [
69+
"apigateway.amazonaws.com"
70+
]
71+
variables = {
72+
foo = "bar"
73+
}
74+
}
75+
76+
77+
####----------------------------------------------------------------------------------
78+
## VPC
79+
####----------------------------------------------------------------------------------
80+
81+
module "vpc" {
82+
source = "clouddrove/vpc/aws"
83+
version = "2.0.0"
84+
85+
name = "${local.name}-rest-api-private"
86+
environment = local.environment
87+
enable = true
88+
cidr_block = "10.0.0.0/16"
89+
90+
}
91+
92+
####----------------------------------------------------------------------------------
93+
## SUBNETS
94+
####----------------------------------------------------------------------------------
95+
#tfsec:ignore:aws-ec2-no-excessive-port-access
96+
#tfsec:ignore:aws-ec2-no-public-ingress-acl
97+
module "subnets" {
98+
source = "clouddrove/subnet/aws"
99+
version = "2.0.1"
100+
101+
name = "${local.name}-rest-api-private"
102+
environment = local.environment
103+
104+
nat_gateway_enabled = true
105+
single_nat_gateway = true
106+
availability_zones = ["${local.region}a", "${local.region}b", "${local.region}c"]
107+
vpc_id = module.vpc.vpc_id
108+
type = "public-private"
109+
igw_id = module.vpc.igw_id
110+
cidr_block = module.vpc.vpc_cidr_block
111+
ipv6_cidr_block = module.vpc.ipv6_cidr_block
112+
enable_ipv6 = true
113+
private_inbound_acl_rules = [
114+
{
115+
rule_number = 100
116+
rule_action = "allow"
117+
from_port = 0
118+
to_port = 0
119+
protocol = "-1"
120+
cidr_block = module.vpc.vpc_cidr_block
121+
}
122+
]
123+
private_outbound_acl_rules = [
124+
{
125+
rule_number = 100
126+
rule_action = "allow"
127+
from_port = 0
128+
to_port = 0
129+
protocol = "-1"
130+
cidr_block = module.vpc.vpc_cidr_block
131+
}
132+
]
133+
public_inbound_acl_rules = [
134+
{
135+
rule_number = 100
136+
rule_action = "allow"
137+
from_port = 0
138+
to_port = 0
139+
protocol = "-1"
140+
cidr_block = "0.0.0.0/0"
141+
}
142+
]
143+
public_outbound_acl_rules = [
144+
{
145+
rule_number = 100
146+
rule_action = "allow"
147+
from_port = 0
148+
to_port = 0
149+
protocol = "-1"
150+
cidr_block = "0.0.0.0/0"
151+
}
152+
]
153+
154+
}
155+
156+
####----------------------------------------------------------------------------------
157+
## SECURITY GROUP
158+
####----------------------------------------------------------------------------------
159+
160+
module "security_group" {
161+
source = "clouddrove/security-group/aws"
162+
version = "2.0.0"
163+
164+
name = "${local.name}-rest-api-private"
165+
environment = local.environment
166+
167+
vpc_id = module.vpc.vpc_id
168+
new_sg_ingress_rules_with_cidr_blocks = [
169+
{
170+
rule_count = 1
171+
from_port = 0
172+
protocol = "-1"
173+
to_port = 0
174+
cidr_blocks = [module.vpc.vpc_cidr_block]
175+
description = "Allow all traffic from ${local.environment} VPC."
176+
}
177+
]
178+
new_sg_egress_rules_with_cidr_blocks = [
179+
{
180+
rule_count = 1
181+
from_port = 0
182+
protocol = "-1"
183+
to_port = 0
184+
cidr_blocks = [module.vpc.vpc_cidr_block]
185+
description = "Allow all outbound traffic."
186+
}
187+
]
188+
}
189+
190+
191+
####----------------------------------------------------------------------------------
192+
## REST API PRIVATE
193+
####----------------------------------------------------------------------------------
194+
195+
module "rest_api_private" {
196+
source = "../../../"
197+
198+
name = "${local.name}-rest-api-private"
199+
environment = local.environment
200+
enabled = true
201+
create_rest_api = true
202+
rest_api_endpoint_type = "PRIVATE"
203+
rest_api_description = "Private REST API for ${module.lambda.name} lambda function"
204+
integration_uri = module.lambda.invoke_arn
205+
rest_api_stage_name = "default"
206+
auto_deploy = true
207+
rest_api_base_path = "test"
208+
domain_name = "api.${local.domain_name}"
209+
zone_id = local.hosted_zone_id
210+
211+
# -- VPC Endpoint configuration
212+
vpc_id = module.vpc.vpc_id
213+
subnet_ids = module.subnets.private_subnet_id
214+
security_group_ids = [module.security_group.security_group_id]
215+
service_name = "com.amazonaws.${local.region}.execute-api"
216+
vpc_endpoint_type = "Interface"
217+
private_dns_enabled = true
218+
domain_name_certificate_arn = module.acm.arn
219+
220+
#---access log----
221+
enable_access_logs = true
222+
retention_in_days = 7
223+
}
224+
225+

0 commit comments

Comments
 (0)