Skip to content

Commit 94d4184

Browse files
xshot9011xshot9011
authored
Feature add step function (#2)
* (add): basic structure * (add): iam policy for log * (update): add role for step function * (add): locals policies * (add): stepfunction * (fix): log group destination * (update): log variable and definition for sfn * (update): README.md * (add): outputs * (update): README.md * (fix): ref to undeclare var * (update): README.md * (fix): access log group * (add): example usage for stepfunction * (update): Document * (rename): current to this for data resource * (update): remove auto gen doc * (add): support kms for cloudwatcg log group * (add): simple usage * (update): README * (add): example integration with lambda
1 parent 3a6d4bb commit 94d4184

22 files changed

+1584
-0
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ crash.*.log
2424
# to change depending on the environment.
2525
#
2626
*.tfvars
27+
!terraform.*example*.tfvars
2728

2829
# Ignore override files as they are usually used to override resources locally and so
2930
# are not checked in

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Change Log
2+
3+
All notable changes to this module will be documented in this file.
4+
5+
## [1.0.0] - 2022-07-21
6+
7+
### Added
8+
9+
- init terraform-aws-step-functions module

‎README.md‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,147 @@
11
# terraform-aws-step-functions
2+
3+
## Usage
4+
5+
```terraform
6+
module "state_machine" {
7+
source = "git::ssh://git@github.com/oozou/terraform-aws-step-functions.git?ref=<version>"
8+
9+
prefix = "oozou"
10+
environment = "dev"
11+
name = "schedule"
12+
13+
# IAM
14+
is_create_role = true
15+
exists_role_arn = "" # Ignore if is_create_role is `true`
16+
additional_role_policy_arn = {}
17+
18+
# State machine settings
19+
type = "STANDARD" # Or EXPRESS is allowed
20+
## Recommendation use this; copy definition and insert here or using templatefile function
21+
## https://ap-southeast-1.console.aws.amazon.com/states/home?region=ap-southeast-1#/homepage
22+
definition = <<EOF
23+
{
24+
"Comment": "A description of my state machine",
25+
"StartAt": "LambdaInvoke",
26+
"States": {
27+
"LambdaInvoke": {
28+
"Type": "Task",
29+
"Resource": "arn:aws:states:::lambda:invoke",
30+
"OutputPath": "$.Payload",
31+
"Parameters": {
32+
"Payload.$": "$",
33+
"FunctionName": "${module.lambda.function_arn}"
34+
},
35+
"Next": "CheckStatusCode"
36+
},
37+
"CheckStatusCode": {
38+
"Type": "Choice",
39+
"InputPath": "$",
40+
"Choices": [
41+
{
42+
"Variable": "$.statusCode",
43+
"NumericEquals": 500,
44+
"Next": "Wait"
45+
}
46+
],
47+
"Default": "SuccessState"
48+
},
49+
"Wait": {
50+
"Type": "Wait",
51+
"OutputPath": "$.event",
52+
"Seconds": 10,
53+
"Next": "LambdaInvoke"
54+
},
55+
"SuccessState": {
56+
"Type": "Succeed"
57+
}
58+
}
59+
}
60+
EOF
61+
62+
# Auto generate policy related to this resource
63+
service_integrations = {
64+
lambda = {
65+
lambda = ["<arn_of_lambda_function>*"]
66+
}
67+
}
68+
69+
# Logging
70+
is_create_cloudwatch_log_group = true
71+
log_include_execution_data = null
72+
log_level = "ALL"
73+
cloudwatch_log_retention_in_days = 30
74+
75+
tags = { "Workspace" = "xxx-yyy-zzz" }
76+
}
77+
```
78+
79+
<!-- BEGIN_TF_DOCS -->
80+
## Requirements
81+
82+
| Name | Version |
83+
|---------------------------------------------------------------------------|----------|
84+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
85+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.00 |
86+
87+
## Providers
88+
89+
| Name | Version |
90+
|---------------------------------------------------|---------|
91+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.19.0 |
92+
93+
## Modules
94+
95+
No modules.
96+
97+
## Resources
98+
99+
| Name | Type |
100+
|----------------------------------------------------------------------------------------------------------------------------------------------------|-------------|
101+
| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
102+
| [aws_iam_policy.log_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
103+
| [aws_iam_policy.service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
104+
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
105+
| [aws_iam_role_policy_attachment.log_acces](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
106+
| [aws_iam_role_policy_attachment.service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
107+
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
108+
| [aws_sfn_state_machine.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sfn_state_machine) | resource |
109+
| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
110+
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
111+
| [aws_iam_policy_document.log_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
112+
| [aws_iam_policy_document.service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
113+
| [aws_region.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
114+
115+
## Inputs
116+
117+
| Name | Description | Type | Default | Required |
118+
|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|--------------|:--------:|
119+
| <a name="input_additional_role_policy_arn"></a> [additional\_role\_policy\_arn](#input\_additional\_role\_policy\_arn) | Map of policies ARNs to attach to the lambda | `map(string)` | `{}` | no |
120+
| <a name="input_attach_policies_for_integrations"></a> [attach\_policies\_for\_integrations](#input\_attach\_policies\_for\_integrations) | Whether to attach AWS Service policies to IAM role | `bool` | `true` | no |
121+
| <a name="input_cloudwatch_log_retention_in_days"></a> [cloudwatch\_log\_retention\_in\_days](#input\_cloudwatch\_log\_retention\_in\_days) | Retention day for cloudwatch log group | `number` | `90` | no |
122+
| <a name="input_definition"></a> [definition](#input\_definition) | The Amazon States Language definition of the Step Function | `string` | n/a | yes |
123+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment Variable used as a prefix | `string` | n/a | yes |
124+
| <a name="input_exists_role_arn"></a> [exists\_role\_arn](#input\_exists\_role\_arn) | The exist role arn for step functions | `string` | `""` | no |
125+
| <a name="input_is_create_cloudwatch_log_group"></a> [is\_create\_cloudwatch\_log\_group](#input\_is\_create\_cloudwatch\_log\_group) | Whether to create cloudwatch log group or not | `bool` | `true` | no |
126+
| <a name="input_is_create_role"></a> [is\_create\_role](#input\_is\_create\_role) | Whether to create step function roles or not | `bool` | `true` | no |
127+
| <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | The ARN for the KMS encryption key. Leave this default if account\_mode is hub. If account\_mode is spoke, please provide centrailize kms key arn (hub). | `string` | `""` | no |
128+
| <a name="input_log_include_execution_data"></a> [log\_include\_execution\_data](#input\_log\_include\_execution\_data) | (Optional) Determines whether execution data is included in your log. When set to false, data is excluded. | `bool` | `null` | no |
129+
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | (Optional) Defines which category of execution history events are logged. Valid values: ALL, ERROR, FATAL, OFF | `string` | `"OFF"` | no |
130+
| <a name="input_name"></a> [name](#input\_name) | Name of the ECS cluster to create | `string` | n/a | yes |
131+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix name of customer to be displayed in AWS console and resource | `string` | n/a | yes |
132+
| <a name="input_service_integrations"></a> [service\_integrations](#input\_service\_integrations) | Map of AWS service integrations to allow in IAM role policy | `any` | `{}` | no |
133+
| <a name="input_tags"></a> [tags](#input\_tags) | Custom tags which can be passed on to the AWS resources. They should be key value pairs having distinct keys | `map(any)` | `{}` | no |
134+
| <a name="input_trusted_entities"></a> [trusted\_entities](#input\_trusted\_entities) | Step Function additional trusted entities for assuming roles (trust relationship) | `list(string)` | `[]` | no |
135+
| <a name="input_type"></a> [type](#input\_type) | Determines whether a Standard or Express state machine is created. The default is STANDARD. Valid Values: STANDARD \| EXPRESS | `string` | `"STANDARD"` | no |
136+
137+
## Outputs
138+
139+
| Name | Description |
140+
|-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------|
141+
| <a name="output_role_arn"></a> [role\_arn](#output\_role\_arn) | The ARN of the IAM role created for the Step Function |
142+
| <a name="output_role_name"></a> [role\_name](#output\_role\_name) | The name of the IAM role created for the Step Function |
143+
| <a name="output_state_machine_arn"></a> [state\_machine\_arn](#output\_state\_machine\_arn) | The ARN of the Step Function |
144+
| <a name="output_state_machine_creation_date"></a> [state\_machine\_creation\_date](#output\_state\_machine\_creation\_date) | The date the Step Function was created |
145+
| <a name="output_state_machine_id"></a> [state\_machine\_id](#output\_state\_machine\_id) | The ARN of the Step Function |
146+
| <a name="output_state_machine_status"></a> [state\_machine\_status](#output\_state\_machine\_status) | The current status of the Step Function |
147+
<!-- END_TF_DOCS -->

‎examples/complete-lambda/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|---------------------------------------------------------------------------|----------|
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|---------------------------------------------------|---------|
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.23.0 |
14+
15+
## Modules
16+
17+
| Name | Source | Version |
18+
|-------------------------------------------------------------------------------|-----------------------------------------------|---------|
19+
| <a name="module_lambda"></a> [lambda](#module\_lambda) | git@github.com:oozou/terraform-aws-lambda.git | v1.1.0 |
20+
| <a name="module_state_machine"></a> [state\_machine](#module\_state\_machine) | ../../ | n/a |
21+
22+
## Resources
23+
24+
| Name | Type |
25+
|-------------------------------------------------------------------------------------------------------------------------------|-------------|
26+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
27+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
28+
29+
## Inputs
30+
31+
| Name | Description | Type | Default | Required |
32+
|-----------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|------------|---------|:--------:|
33+
| <a name="input_custom_tags"></a> [custom\_tags](#input\_custom\_tags) | Custom tags which can be passed on to the AWS resources. They should be key value pairs having distinct keys | `map(any)` | `{}` | no |
34+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment Variable used as a prefix | `string` | n/a | yes |
35+
| <a name="input_name"></a> [name](#input\_name) | Name of the ECS cluster and s3 also redis to create | `string` | n/a | yes |
36+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix name of customer to be displayed in AWS console and resource | `string` | n/a | yes |
37+
38+
## Outputs
39+
40+
No outputs.
41+
<!-- END_TF_DOCS -->

‎examples/complete-lambda/main.tf‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
module "lambda" {
2+
source = "git@github.com:oozou/terraform-aws-lambda.git?ref=v1.1.0"
3+
4+
prefix = var.prefix
5+
environment = var.environment
6+
name = var.name
7+
8+
is_edge = false
9+
10+
# Source code
11+
source_code_dir = "./src"
12+
file_globs = ["main.py"]
13+
compressed_local_file_dir = "./outputs"
14+
15+
# Lambda Env
16+
runtime = "python3.9"
17+
handler = "main.lambda_handler"
18+
19+
# IAM
20+
additional_lambda_role_policy_arns = {}
21+
22+
# Resource policy
23+
lambda_permission_configurations = {}
24+
25+
# Env
26+
ssm_params = {}
27+
28+
tags = var.custom_tags
29+
}
30+
31+
module "state_machine" {
32+
source = "../../"
33+
34+
prefix = var.prefix
35+
environment = var.environment
36+
name = var.name
37+
38+
is_create_role = true
39+
additional_role_policy_arn = {}
40+
41+
type = "STANDARD"
42+
definition = <<EOF
43+
{
44+
"Comment": "A description of my state machine",
45+
"StartAt": "LambdaInvoke",
46+
"States": {
47+
"LambdaInvoke": {
48+
"Type": "Task",
49+
"Resource": "arn:aws:states:::lambda:invoke",
50+
"OutputPath": "$.Payload",
51+
"Parameters": {
52+
"Payload.$": "$",
53+
"FunctionName": "${module.lambda.function_arn}"
54+
},
55+
"Next": "CheckStatusCode"
56+
},
57+
"CheckStatusCode": {
58+
"Type": "Choice",
59+
"InputPath": "$",
60+
"Choices": [
61+
{
62+
"Variable": "$.statusCode",
63+
"NumericEquals": 500,
64+
"Next": "Wait"
65+
}
66+
],
67+
"Default": "SuccessState"
68+
},
69+
"Wait": {
70+
"Type": "Wait",
71+
"OutputPath": "$.event",
72+
"Seconds": 10,
73+
"Next": "LambdaInvoke"
74+
},
75+
"SuccessState": {
76+
"Type": "Succeed"
77+
}
78+
}
79+
}
80+
EOF
81+
82+
service_integrations = {
83+
lambda = {
84+
lambda = ["${module.lambda.function_arn}*"]
85+
}
86+
}
87+
88+
is_create_cloudwatch_log_group = true
89+
log_include_execution_data = null
90+
log_level = "ALL"
91+
92+
tags = var.custom_tags
93+
}

‎examples/complete-lambda/outputs.tf‎

Whitespace-only changes.

‎examples/complete-lambda/outputs/example-devops-cms.zip‎

278 Bytes
Binary file not shown.

‎examples/complete-lambda/src/main.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
import json
2+
3+
def lambda_handler(event, context):
4+
print(f'Event: {event}')
5+
6+
result = {}
7+
result['statusCode'] = 200
8+
result['event'] = event
9+
10+
return json.loads(json.dumps(result, default=str))

‎examples/complete-lambda/terraform.example.tfvars‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
prefix = "example"
2+
environment = "devops"
3+
name = "cms"
4+
custom_tags = {
5+
"Remark" = "terraform-aws-step-functions-example"
6+
}

‎examples/complete-lambda/variables.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/* -------------------------------------------------------------------------- */
2+
/* Generics */
3+
/* -------------------------------------------------------------------------- */
4+
variable "prefix" {
5+
description = "The prefix name of customer to be displayed in AWS console and resource"
6+
type = string
7+
}
8+
9+
variable "environment" {
10+
description = "Environment Variable used as a prefix"
11+
type = string
12+
}
13+
14+
variable "name" {
15+
description = "Name of the ECS cluster and s3 also redis to create"
16+
type = string
17+
}
18+
19+
variable "custom_tags" {
20+
description = "Custom tags which can be passed on to the AWS resources. They should be key value pairs having distinct keys"
21+
type = map(any)
22+
default = {}
23+
}

0 commit comments

Comments
 (0)