Merge pull request #1 from chrispsheehan/lambda-api-infra

chrispsheehan · web-flow · commit 703ebac994a7 · 2025-09-05T15:38:17.000+01:00
feat: lambda api infra
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -8,12 +8,12 @@ on:
         required: true
         type: string
     outputs:
-      web_bucket:
-        description: "Bucket containing static website files"
-        value: ${{ jobs.infra.outputs.web_bucket_name }}
       lambda_bucket:
         description: "Bucket containing lambda zips"
         value: ${{ jobs.infra.outputs.lambda_bucket_name }}
+      lambda_version:
+        description: "Valid lambda version"
+        value: ${{ inputs.version }}
 
 concurrency: # only run one instance of workflow at any one time
   group: ${{ github.workflow }}-${{inputs.environment}}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -28,7 +28,7 @@ permissions:
   contents: write
 
 env:
-  TF_VAR_deploy_version: ${{ inputs.lambda_version }}
+  TF_VAR_lambda_version: ${{ inputs.lambda_version }}
   AWS_OIDC_ROLE_ARN: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/aws-serverless-github-deploy-${{ inputs.environment }}-github-oidc-role
 
 jobs:
@@ -61,3 +61,18 @@ jobs:
         with:
           aws_oidc_role_arn: ${{ env.AWS_OIDC_ROLE_ARN }}
           just_action: check-version
+
+  api:
+    needs:
+      - oidc
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.infra_version }}
+
+      - name: Deploy API
+        uses: chrispsheehan/terragrunt-aws-oidc-action@0.4.0
+        with:
+          aws_oidc_role_arn: ${{ env.AWS_OIDC_ROLE_ARN }}
+          tg_directory: infra/live/${{ inputs.environment }}/aws/api
diff --git a/.github/workflows/destroy.yml b/.github/workflows/destroy.yml
@@ -19,11 +19,11 @@ permissions:
   contents: write
 
 env:
-  TF_VAR_deploy_version: this
+  TF_VAR_lambda_version: this
   AWS_OIDC_ROLE_ARN: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/aws-serverless-github-deploy-${{ inputs.environment }}-github-oidc-role
 
 jobs:
-  backend:
+  api:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -32,12 +32,12 @@ jobs:
         uses: chrispsheehan/terragrunt-aws-oidc-action@0.4.0
         with:
           aws_oidc_role_arn: ${{ env.AWS_OIDC_ROLE_ARN }}
-          tg_directory: infra/live/${{ inputs.environment }}/aws/jobs
+          tg_directory: infra/live/${{ inputs.environment }}/aws/api
           tg_action: destroy
 
   build:
     needs:
-      - backend
+      - api
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/dev_deploy.yml b/.github/workflows/dev_deploy.yml
@@ -14,18 +14,11 @@ jobs:
       environment: dev
       version: ${{ github.sha }}
 
-  get:
-    needs: build
-    uses: ./.github/workflows/get_build.yml
-    with:
-      environment: dev
-      version: ${{ github.sha }}
-
   dev:
     uses: ./.github/workflows/deploy.yml
-    needs: get
+    needs: build
     with:
       environment: dev
       infra_version: ${{ github.sha }}
-      lambda_bucket: ${{ needs.get.outputs.lambda_bucket }}
-      lambda_version: ${{ needs.get.outputs.lambda_version }}
+      lambda_bucket: ${{ needs.build.outputs.lambda_bucket }}
+      lambda_version: ${{ needs.build.outputs.lambda_version }}
diff --git a/README.md b/README.md
@@ -1 +1,17 @@
-# aws-serverless-github-deploy
+# aws-serverless-github-deploy
+
+## setup roles for ci
+
+```sh
+just tg ci aws/oidc apply
+just tg dev aws/oidc apply
+just tg prod aws/oidc apply
+```
+
+## local plan some infra
+
+Given a terragrunt file is found at `infra/live/dev/aws/api/terragrunt.hcl`
+
+```sh
+just tg dev aws/api plan
+```
diff --git a/infra/live/ci/aws/code_bucket/terragrunt.hcl b/infra/live/ci/aws/code_bucket/terragrunt.hcl
@@ -3,5 +3,5 @@ include {
 }
 
 terraform {
-  source = "../../../../modules/aws/code_bucket"
+  source = "../../../../modules//aws//code_bucket"
 }
diff --git a/infra/live/dev/aws/api/terragrunt.hcl b/infra/live/dev/aws/api/terragrunt.hcl
@@ -0,0 +1,7 @@
+include {
+  path = find_in_parent_folders("root.hcl")
+}
+
+terraform {
+  source = "../../../../modules//aws//api"
+}
diff --git a/infra/live/dev/aws/code_bucket/terragrunt.hcl b/infra/live/dev/aws/code_bucket/terragrunt.hcl
@@ -3,5 +3,5 @@ include {
 }
 
 terraform {
-  source = "../../../../modules/aws/code_bucket"
+  source = "../../../../modules//aws//code_bucket"
 }
diff --git a/infra/live/global_vars.hcl b/infra/live/global_vars.hcl
@@ -4,7 +4,8 @@ locals {
     "s3:*",
     "iam:*",
     "lambda:*",
-    "logs:*"
+    "logs:*",
+    "apigateway:*"
   ]
 }
 
diff --git a/infra/live/prod/aws/api/terragrunt.hcl b/infra/live/prod/aws/api/terragrunt.hcl
@@ -0,0 +1,7 @@
+include {
+  path = find_in_parent_folders("root.hcl")
+}
+
+terraform {
+  source = "../../../../modules//aws//api"
+}
diff --git a/infra/modules/aws/api/main.tf b/infra/modules/aws/api/main.tf
@@ -0,0 +1,48 @@
+module "lambda_api" {
+  source = "../lambda"
+
+  project_name  = var.project_name
+  environment   = var.environment
+  lambda_bucket = var.lambda_bucket
+
+  lambda_name    = "api"
+  lambda_version = var.lambda_version
+}
+
+resource "aws_apigatewayv2_api" "http_api" {
+  name          = "${module.lambda_api.name}-http"
+  protocol_type = "HTTP"
+}
+
+resource "aws_apigatewayv2_integration" "lambda_proxy" {
+  api_id                 = aws_apigatewayv2_api.http_api.id
+  integration_type       = "AWS_PROXY"
+  integration_uri        = module.lambda_api.arn
+  payload_format_version = "2.0"
+}
+
+resource "aws_apigatewayv2_route" "root" {
+  api_id    = aws_apigatewayv2_api.http_api.id
+  route_key = "ANY /"
+  target    = "integrations/${aws_apigatewayv2_integration.lambda_proxy.id}"
+}
+
+resource "aws_apigatewayv2_route" "proxy" {
+  api_id    = aws_apigatewayv2_api.http_api.id
+  route_key = "ANY /{proxy+}"
+  target    = "integrations/${aws_apigatewayv2_integration.lambda_proxy.id}"
+}
+
+resource "aws_apigatewayv2_stage" "default" {
+  api_id      = aws_apigatewayv2_api.http_api.id
+  name        = "$default"
+  auto_deploy = true
+}
+
+resource "aws_lambda_permission" "allow_invoke" {
+  statement_id  = "AllowAPIGatewayInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = module.lambda_api.arn
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${aws_apigatewayv2_api.http_api.execution_arn}/*/*" # all routes/stages
+}
diff --git a/infra/modules/aws/api/outputs.tf b/infra/modules/aws/api/outputs.tf
@@ -0,0 +1,3 @@
+output "invoke_url" {
+  value = aws_apigatewayv2_api.http_api.api_endpoint
+}
diff --git a/infra/modules/aws/api/variables.tf b/infra/modules/aws/api/variables.tf
@@ -0,0 +1,24 @@
+### start of static vars set in root.hcl ###
+variable "project_name" {
+  type        = string
+  description = "Project name used in naming resources"
+}
+
+variable "environment" {
+  type        = string
+  description = "Environment reference used in naming resources i.e. 'dev'"
+}
+
+variable "lambda_bucket" {
+  type        = string
+  description = "Lambda bucket where the code zip(s) are uploaded to"
+}
+### end of static vars set in root.hcl ###
+
+
+### start of dynamic vars required for resources ###
+variable "lambda_version" {
+  type        = string
+  description = "Lambda code version to be deployed. Used in locating zip file keys"
+}
+### end of dynamic vars required for resources ###
diff --git a/infra/modules/aws/lambda/data.tf b/infra/modules/aws/lambda/data.tf
@@ -0,0 +1,16 @@
+data "aws_s3_bucket" "lambda_code" {
+  bucket = var.lambda_bucket
+}
+
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["lambda.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
diff --git a/infra/modules/aws/lambda/locals.tf b/infra/modules/aws/lambda/locals.tf
@@ -0,0 +1,7 @@
+locals {
+  lambda_runtime = "python3.12"
+  lambda_handler = "lambda_handler.lambda_handler"
+
+  lambda_name         = "${var.environment}-${var.project_name}-${var.lambda_name}"
+  lambda_code_zip_key = "${var.lambda_version}/${var.lambda_name}.zip"
+}
diff --git a/infra/modules/aws/lambda/main.tf b/infra/modules/aws/lambda/main.tf
@@ -0,0 +1,14 @@
+resource "aws_iam_role" "iam_for_lambda" {
+  name               = "${local.lambda_name}-iam"
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+}
+
+resource "aws_lambda_function" "lambda" {
+  function_name = local.lambda_name
+  role          = aws_iam_role.iam_for_lambda.arn
+  handler       = local.lambda_handler
+  runtime       = local.lambda_runtime
+
+  s3_bucket = data.aws_s3_bucket.lambda_code.bucket
+  s3_key    = local.lambda_code_zip_key
+}
diff --git a/infra/modules/aws/lambda/outputs.tf b/infra/modules/aws/lambda/outputs.tf
@@ -0,0 +1,7 @@
+output "name" {
+  value = aws_lambda_function.lambda.function_name
+}
+
+output "arn" {
+  value = aws_lambda_function.lambda.arn
+}
diff --git a/infra/modules/aws/lambda/variables.tf b/infra/modules/aws/lambda/variables.tf
@@ -0,0 +1,29 @@
+### start of static vars set in root.hcl ###
+variable "project_name" {
+  type        = string
+  description = "Project name used in naming resources"
+}
+
+variable "environment" {
+  type        = string
+  description = "Environment reference used in naming resources i.e. 'dev'"
+}
+
+variable "lambda_bucket" {
+  type        = string
+  description = "Lambda bucket where the code zip(s) are uploaded to"
+}
+### end of static vars set in root.hcl ###
+
+
+### start of dynamic vars required for resources ###
+variable "lambda_name" {
+  type        = string
+  description = "Must match the name of the zip - formed in /backend directory i.e. /backend/api = 'api'"
+}
+
+variable "lambda_version" {
+  type        = string
+  description = "Lambda code version to be deployed. Used in locating zip file keys"
+}
+### end of dynamic vars required for resources ###
diff --git a/infra/root.hcl b/infra/root.hcl
@@ -26,9 +26,6 @@ locals {
   # separate s3 version bucket when dev, otherwise ci
   s3_bucket_base = local.environment == "dev" ? "${local.base_reference}-${local.environment}" : "${local.base_reference}-ci"
   lambda_bucket  = "${local.s3_bucket_base}-lambda"
-
-  lambda_name     = local.environment == "prod" ? local.project_name : "${local.environment}-${local.project_name}"
-  lambda_api_name = "${local.lambda_name}-api"
 }
 
 terraform {
@@ -99,6 +96,5 @@ inputs = merge(
     state_bucket     = local.state_bucket
     state_lock_table = local.state_lock_table
     lambda_bucket    = local.lambda_bucket
-    lambda_api_name  = local.lambda_api_name
   }
 )

Original file line number	Diff line number	Diff line change
`@@ -3,5 +3,5 @@ include {`
`3`	`3`	`}`
`4`	`4`
`5`	`5`	`terraform {`
`6`		`- source = "../../../../modules/aws/code_bucket"`
	`6`	`+ source = "../../../../modules//aws//code_bucket"`
`7`	`7`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,8 @@ locals {`
`4`	`4`	`"s3:*",`
`5`	`5`	`"iam:*",`
`6`	`6`	`"lambda:*",`
`7`		`- "logs:*"`
	`7`	`+ "logs:*",`
	`8`	`+ "apigateway:*"`
`8`	`9`	`]`
`9`	`10`	`}`
`10`	`11`