aws-lambda-kms-encryption/lambda.tf at master · goci-io/aws-lambda-kms-encryption · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

module "encrypt_label" {
  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.15.0"
  context    = module.label.context
  attributes = ["encrypt"]
}

module "decrypt_label" {
  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.15.0"
  context    = module.label.context
  attributes = ["decrypt"]
}

resource "aws_cloudwatch_log_group" "encrypt_log_group" {
  name              = "/aws/lambda/${aws_lambda_function.encrypt.function_name}"
  retention_in_days = 5
}

resource "aws_cloudwatch_log_group" "decrypt_log_group" {
  name              = "/aws/lambda/${aws_lambda_function.decrypt.function_name}"
  retention_in_days = 5
}

data "archive_file" "encrypt" {
  output_path = format("%s/encrypt.zip", path.module)
  source_file = format("%s/src/encrypt.js", path.module)
  type        = "zip"
}

data "archive_file" "decrypt" {
  output_path = format("%s/decrypt.zip", path.module)
  source_file = format("%s/src/decrypt.js", path.module)
  type        = "zip"
}

resource "aws_lambda_function" "encrypt" {
  function_name    = module.encrypt_label.id
  tags             = module.encrypt_label.tags
  handler          = "encrypt.handler"
  runtime          = "nodejs12.x"
  timeout          = 10
  role             = aws_iam_role.lambda.arn
  depends_on       = [data.archive_file.encrypt]
  filename         = data.archive_file.encrypt.output_path
  source_code_hash = data.archive_file.encrypt.output_base64sha256
  description      = "Lambda to encrypt values using KMS key"

  environment {
    variables = {
      KMS_KEY_ARN = aws_kms_alias.default.arn
    }
  }
}

resource "aws_lambda_function" "decrypt" {
  function_name    = module.decrypt_label.id
  tags             = module.decrypt_label.tags
  handler          = "decrypt.handler"
  runtime          = "nodejs12.x"
  timeout          = 10
  role             = aws_iam_role.lambda.arn
  depends_on       = [data.archive_file.decrypt]
  filename         = data.archive_file.decrypt.output_path
  source_code_hash = data.archive_file.decrypt.output_base64sha256
  description      = "Lambda to decrypt values using KMS key"
}