chore: allow lambda to log to cloudwatch

Author: chrispsheehan

infra/modules/aws/lambda/data.tf

@@ -39,8 +39,8 @@ data "aws_iam_policy_document" "codedeploy_lambda" {
       "lambda:ListVersionsByFunction",
     ]
     resources = [
-      aws_lambda_function.fn.arn,
-      "${aws_lambda_function.fn.arn}:*",
+      aws_lambda_function.lambda.arn,
+      "${aws_lambda_function.lambda.arn}:*",
     ]
   }
 
@@ -51,3 +51,21 @@ data "aws_iam_policy_document" "codedeploy_lambda" {
     resources = ["*"]
   }
 }
+
+data "aws_iam_policy_document" "lambda_iam_policy" {
+  statement {
+    sid = "AllowLambdaCloudwatchLogGroupPut"
+
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+
+    effect = "Allow"
+
+    resources = [
+      "${aws_cloudwatch_log_group.lambda_cloudwatch_group.arn}",
+      "${aws_cloudwatch_log_group.lambda_cloudwatch_group.arn}:*"
+    ]
+  }
+}

infra/modules/aws/lambda/main.tf

@@ -25,6 +25,11 @@ resource "aws_lambda_function" "lambda" {
   }
 }
 
+resource "aws_cloudwatch_log_group" "lambda_cloudwatch_group" {
+  name              = "/aws/lambda/${local.lambda_name}"
+  retention_in_days = var.log_retention_days
+}
+
 resource "aws_lambda_alias" "live" {
   name             = var.environment
   function_name    = aws_lambda_function.lambda.arn
@@ -62,4 +67,4 @@ resource "aws_codedeploy_deployment_group" "dg" {
     enabled = true
     events  = ["DEPLOYMENT_FAILURE", "DEPLOYMENT_STOP_ON_ALARM"]
   }
-}
+}

infra/modules/aws/lambda/outputs.tf

@@ -4,4 +4,8 @@ output "name" {
 
 output "arn" {
   value = aws_lambda_function.lambda.arn
-}
+}
+
+output "cloudwatch_log_group" {
+  value = aws_cloudwatch_log_group.lambda_cloudwatch_group.name
+}

infra/modules/aws/lambda/variables.tf

@@ -27,3 +27,10 @@ variable "lambda_version" {
   description = "Lambda code version to be deployed. Used in locating zip file keys"
 }
 ### end of dynamic vars required for resources ###
+
+
+variable "log_retention_days" {
+  type        = number
+  description = "Number of days to hold logs"
+  default = 1
+}