thumbnail_generation_lambda/main.tf at main · CodePossibility/thumbnail_generation_lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
terraform {
  required_providers {
    aws = {
        source = "hashicorp/aws"
        version = "4.36.1"
    }
    archive = {
      source  = "hashicorp/archive"
      version = "~> 2.2.0"
    }
  }
  required_version = "~> 1.0"
}

provider "aws" {
    region = var.aws_region
}

resource "aws_iam_policy" "thumbnail_s3_policy" {
    name = "thumbnail_s3_policy"
    policy = jsonencode({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::cp-original-image-bucket/*"
        }, {
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::cp-thumbnail-image-bucket/*"
        }]
    })
}

resource "aws_iam_role" "thumbnail_lambda_role" {
    name = "thumbnail_lambda_role"
    assume_role_policy = jsonencode({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }]
    })
}

resource "aws_iam_policy_attachment" "thumbnail_role_s3_policy_attachment" {
    name = "thumbnail_role_s3_policy_attachment"
    roles = [ aws_iam_role.thumbnail_lambda_role.name ]
    policy_arn = aws_iam_policy.thumbnail_s3_policy.arn
}

resource "aws_iam_policy_attachment" "thumbnail_role_lambda_policy_attachment" {
    name = "thumbnail_role_lambda_policy_attachment"
    roles = [ aws_iam_role.thumbnail_lambda_role.name ]
    policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

data "archive_file" "thumbnail_lambda_source_archive" {
  type = "zip"

  source_dir  = "${path.module}/src"
  output_path = "${path.module}/my-deployment.zip"
}

resource "aws_lambda_function" "thumbnail_lambda" {
    function_name = "thumbnail_generation_lambda"
    filename = "${path.module}/my-deployment.zip"

    runtime = "python3.9"
    handler = "app.lambda_handler"
    memory_size = 256

    source_code_hash = data.archive_file.thumbnail_lambda_source_archive.output_base64sha256

    role = aws_iam_role.thumbnail_lambda_role.arn

    layers = [
        "arn:aws:lambda:us-east-1:770693421928:layer:Klayers-p39-pillow:1"
    ]
}

resource "aws_s3_bucket" "thumbnail_original_image_bucket" {
  bucket = "cp-original-image-bucket"
}

resource "aws_s3_bucket" "thumbnail_image_bucket" {
  bucket = "cp-thumbnail-image-bucket"
}

resource "aws_lambda_permission" "thumbnail_allow_bucket" {
  statement_id = "AllowExecutionFromS3Bucket"
  action = "lambda:InvokeFunction"
  function_name = aws_lambda_function.thumbnail_lambda.arn
  principal = "s3.amazonaws.com"
  source_arn = aws_s3_bucket.thumbnail_original_image_bucket.arn
}

resource "aws_s3_bucket_notification" "thumbnail_notification" {
    bucket = aws_s3_bucket.thumbnail_original_image_bucket.id

    lambda_function {
        lambda_function_arn = aws_lambda_function.thumbnail_lambda.arn
        events = [ "s3:ObjectCreated:*" ]
    }

    depends_on = [
      aws_lambda_permission.thumbnail_allow_bucket
    ]
}

resource "aws_cloudwatch_log_group" "thumbnail_cloudwatch" {
  name = "/aws/lambda/${aws_lambda_function.thumbnail_lambda.function_name}"

  retention_in_days = 30
}