Support lambda invoke in sfn-state-machine module

tedilabs · Oct 1, 2023 · c5ea9c4 · c5ea9c4
1 parent bfaff61
commit c5ea9c4
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 0 deletions.
diff --git a/modules/sfn-state-machine/README.md b/modules/sfn-state-machine/README.md
@@ -33,6 +33,7 @@ This module creates following resources.
 | [aws_sfn_state_machine.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sfn_state_machine) | resource |
 | [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_role.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |
 | [aws_sfn_state_machine_versions.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/sfn_state_machine_versions) | data source |

diff --git a/modules/sfn-state-machine/iam.tf b/modules/sfn-state-machine/iam.tf
@@ -54,6 +54,9 @@ module "role" {
     var.tracing.enabled ? {
       "xray" = data.aws_iam_policy_document.xray[0].json,
     } : {},
+    local.lambda_integration_detected ? {
+      "lambda" = data.aws_iam_policy_document.lambda[0].json,
+    } : {},
     var.iam_role.inline_policies,
   )
 
@@ -66,6 +69,11 @@ module "role" {
   )
 }
 
+
+###################################################
+# IAM Policy for CloudWatch Logging
+###################################################
+
 data "aws_iam_policy_document" "cloudwatch" {
   count = (!local.custom_iam_role_enabled && var.logging.enabled) ? 1 : 0
 
@@ -101,6 +109,11 @@ data "aws_iam_policy_document" "cloudwatch" {
   }
 }
 
+
+###################################################
+# IAM Policy for X-Ray Tracing
+###################################################
+
 data "aws_iam_policy_document" "xray" {
   count = (!local.custom_iam_role_enabled && var.tracing.enabled) ? 1 : 0
 
@@ -119,3 +132,30 @@ data "aws_iam_policy_document" "xray" {
     ]
   }
 }
+
+
+###################################################
+# IAM Policy for Invoking Lambda Functions
+###################################################
+
+locals {
+  lambda_integration_functions = distinct(flatten(regexall(
+    "\"(arn:aws:lambda:[a-z0-9-]+:[0-9]+:function:[a-zA-Z0-9-_./]+)\"",
+    var.definition
+  )))
+  lambda_integration_detected = length(local.lambda_integration_functions) > 0
+}
+
+data "aws_iam_policy_document" "lambda" {
+  count = (!local.custom_iam_role_enabled && local.lambda_integration_detected) ? 1 : 0
+
+  statement {
+    sid = "InvokeLambdaFunctions"
+
+    effect = "Allow"
+    actions = [
+      "lambda:InvokeFunction",
+    ]
+    resources = local.lambda_integration_functions
+  }
+}