lambda.tf

resource "aws_lambda_permission" "allow_sns_invoke" {
  statement_id  = "AllowExecutionFromSNS"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.email_sender.function_name

  # Grant SNS service permission to invoke this Lambda
  principal = "sns.amazonaws.com"

  # Restrict invocation to only this specific SNS topic for security
  source_arn = aws_sns_topic.user_signup.arn
}

# package lambda directory as a ZIP for Lambda deployment
data "archive_file" "lambda_zip" {
  type        = "zip"
  source_dir  = "${path.module}/../serverless"
  output_path = "${path.module}/dist/email_sender.zip"
  excludes    = [".git", "dist", "scripts"]
}

resource "aws_lambda_function" "email_sender" {
  function_name = "email_sender"
  runtime       = "nodejs20.x"
  handler       = "src/sendEmail.handler"            # File name + exported function name
  role          = aws_iam_role.lambda_email_role.arn # IAM role with SES + CloudWatch permissions

  # Use the zip generated by the archive_file data source
  filename = data.archive_file.lambda_zip.output_path

  # Ensures Lambda is automatically updated when the ZIP content changes.
  # Terraform compares this hash to detect code updates.
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256

  # Environment variables available in process.env
  environment {
    variables = {
      MAILGUN_SECRET_ID = aws_secretsmanager_secret.mailgun.id
      FROM_EMAIL        = var.verifiedSenderEmail             # Verified sender email in SES
      VERIFY_URL_BASE   = var.verificationEndPoint            # Your web app verification endpoint
      MAILGUN_DOMAIN    = var.mailgun_domain                  # e.g. "mg.isaactai13.me"
      DYNAMODB_TABLE    = aws_dynamodb_table.sent_emails.name # DynamoDB table name for deduplication
    }
  }
}

# Secrets Manager secret for Mailgun email service credentials
resource "aws_secretsmanager_secret" "mailgun" {
  name                    = "${var.name_prefix}-mailgun"
  kms_key_id              = aws_kms_alias.secrets_key_alias.arn
  recovery_window_in_days = 0
}


# Actual value of the secret (Mailgun API key)
resource "aws_secretsmanager_secret_version" "mailgun" {
  secret_id = aws_secretsmanager_secret.mailgun.id

  # Store the API key as a JSON payload so Lambda can parse it
  secret_string = jsonencode({
    apiKey = var.mailgun_api_key
  })
}