Skip to content
This repository was archived by the owner on Jun 8, 2022. It is now read-only.

Commit 064c560

Browse files
bashton-ajenkinsbashton-ajenkins
committed
Create Cloudwatch log group
Creates the Cloudwatch log group and allows setting it's options for tags, retention, and KMS Key ID for encryption.
1 parent f9ff6ee commit 064c560

File tree

5 files changed

+91
-10
lines changed

5 files changed

+91
-10
lines changed

‎README.md

Lines changed: 48 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ This Terraform module creates and uploads an AWS Lambda function and hides the u
2323
| 1.x.x | 0.12.x |
2424
| 0.x.x | 0.11.x |
2525

26+
2627
## Usage
2728

2829
```js
@@ -65,20 +66,60 @@ module "lambda" {
6566
}
6667
}
6768
```
69+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
70+
## Providers
6871

69-
## Inputs
72+
| Name | Version |
73+
|------|---------|
74+
| aws | n/a |
75+
| external | n/a |
76+
| null | n/a |
7077

71-
Inputs for this module are the same as the [aws_lambda_function](https://www.terraform.io/docs/providers/aws/r/lambda_function.html) resource with the following additional arguments:
78+
## Inputs
7279

7380
| Name | Description | Type | Default | Required |
74-
|------|-------------|------|---------|----------|
75-
| **source\_path** | The absolute path to a local file or directory containing your Lambda source code | `string` | | yes |
81+
|------|-------------|------|---------|:-----:|
82+
| dead\_letter\_config | n/a | <pre>object({<br> target_arn = string<br> })</pre> | n/a | yes |
83+
| description | n/a | `string` | n/a | yes |
84+
| environment | n/a | <pre>object({<br> variables = map(string)<br> })</pre> | n/a | yes |
85+
| function\_name | n/a | `string` | n/a | yes |
86+
| handler | n/a | `string` | n/a | yes |
87+
| kms\_key\_arn | n/a | `string` | n/a | yes |
88+
| layers | n/a | `list(string)` | n/a | yes |
89+
| log\_group\_kms\_key\_id | The ID of a KMS key to use for encrypting the logs for the log group used by the Lambda if create\_log\_group is enabled. | `string` | n/a | yes |
90+
| log\_group\_retention | The retention time of the Cloudwatch Log group that the Lambda logs to if create\_log\_group is enabled. | `string` | n/a | yes |
91+
| log\_group\_tags | The tags to assign to the log group for the Lambda if create\_log\_group is enabled. This needs to be a list of maps of strings. | `list(map(string))` | n/a | yes |
92+
| memory\_size | n/a | `number` | n/a | yes |
93+
| policy | An additional policy to attach to the Lambda function role | <pre>object({<br> json = string<br> })</pre> | n/a | yes |
94+
| reserved\_concurrent\_executions | n/a | `number` | n/a | yes |
95+
| runtime | n/a | `string` | n/a | yes |
96+
| source\_path | The absolute path to a local file or directory containing your Lambda source code | `string` | n/a | yes |
97+
| tags | n/a | `map(string)` | n/a | yes |
98+
| tracing\_config | n/a | <pre>object({<br> mode = string<br> })</pre> | n/a | yes |
99+
| vpc\_config | n/a | <pre>object({<br> security_group_ids = list(string)<br> subnet_ids = list(string)<br> })</pre> | n/a | yes |
76100
| build\_command | The command to run to create the Lambda package zip file | `string` | `"python build.py '$filename' '$runtime' '$source'"` | no |
77-
| build\_paths | The files or directories used by the build command, to trigger new Lambda package builds whenever build scripts change | `list(string)` | `["build.py"]` | no |
101+
| build\_paths | The files or directories used by the build command, to trigger new Lambda package builds whenever build scripts change | `list(string)` | <pre>[<br> "build.py"<br>]</pre> | no |
78102
| cloudwatch\_logs | Set this to false to disable logging your Lambda output to CloudWatch Logs | `bool` | `true` | no |
103+
| create\_log\_group | Whether or not to create the log group for the Lambda function. If the Lambda has been ran with logging enabled prior to this option being enabled Terraform will fail as the log group will already exist. In this case you will have to import the log group using a command like: terraform import module.lambda.aws\_cloudwatch\_log\_group.lambda /aws/lambda/lambda\_function\_name. Also note that if you disable this option or remove the module Terraform will want to remove the log group and it's associated logs. To keep the log group and its logs please ensure that you either remove module.lambda.aws\_cloudwatch\_log\_group.lambda from the state or move it to somewhere else in the state using either terraform state rm or terraform state mv. | `bool` | `false` | no |
79104
| lambda\_at\_edge | Set this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the function | `bool` | `false` | no |
80-
| policy | An additional policy to attach to the Lambda function role | `object({json=string})` | | no |
81-
| trusted\_entities | Additional trusted entities for the Lambda function. The lambda.amazonaws.com (and edgelambda.amazonaws.com if lambda\_at\_edge is true) is always set | `list(string)` | | no |
105+
| publish | n/a | `bool` | `false` | no |
106+
| timeout | n/a | `number` | `3` | no |
107+
| trusted\_entities | Lambda function additional trusted entities for assuming roles (trust relationship) | `list(string)` | `[]` | no |
108+
109+
## Outputs
110+
111+
| Name | Description |
112+
|------|-------------|
113+
| cloudwatch\_log\_group\_arn | The ARN of the log group created for this Lambda if logging is enabled. |
114+
| cloudwatch\_log\_group\_name | The name of the log group created for this Lambda if logging is enabled. |
115+
| function\_arn | The ARN of the Lambda function |
116+
| function\_invoke\_arn | The Invoke ARN of the Lambda function |
117+
| function\_name | The name of the Lambda function |
118+
| function\_qualified\_arn | The qualified ARN of the Lambda function |
119+
| role\_arn | The ARN of the IAM role created for the Lambda function |
120+
| role\_name | The name of the IAM role created for the Lambda function |
121+
122+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
82123

83124
The following arguments from the [aws_lambda_function](https://www.terraform.io/docs/providers/aws/r/lambda_function.html) resource are not supported:
84125

‎lambda.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ resource "aws_lambda_function" "lambda" {
1515
# Use a generated filename to determine when the source code has changed.
1616

1717
filename = data.external.built.result.filename
18-
depends_on = [null_resource.archive]
18+
depends_on = [null_resource.archive, aws_cloudwatch_log_group.lambda]
1919

2020
# Add dynamic blocks based on variables.
2121

‎logging.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "aws_cloudwatch_log_group" "lambda" {
2+
count = var.create_log_group == true ? 1 : 0
3+
name = "/aws/lambda/${var.function_name}"
4+
retention_in_days = var.log_group_retention
5+
kms_key_id = var.log_group_kms_key_id
6+
tags = var.log_group_tags
7+
}

‎outputs.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,13 @@ output "role_name" {
2727
description = "The name of the IAM role created for the Lambda function"
2828
value = aws_iam_role.lambda.name
2929
}
30+
31+
output "cloudwatch_log_group_arn" {
32+
description = "The ARN of the log group created for this Lambda if logging is enabled."
33+
value = aws_cloudwatch_log_group.lambda[0].arn
34+
}
35+
36+
output "cloudwatch_log_group_name" {
37+
description = "The name of the log group created for this Lambda if logging is enabled."
38+
value = aws_cloudwatch_log_group.lambda[0].name
39+
}

‎variables.tf

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,29 @@ variable "cloudwatch_logs" {
3737
default = true
3838
}
3939

40+
variable "create_log_group" {
41+
description = "Whether or not to create the log group for the Lambda function. If the Lambda has been ran with logging enabled prior to this option being enabled Terraform will fail as the log group will already exist. In this case you will have to import the log group using a command like: terraform import module.lambda.aws_cloudwatch_log_group.lambda /aws/lambda/lambda_function_name. Also note that if you disable this option or remove the module Terraform will want to remove the log group and it's associated logs. To keep the log group and its logs please ensure that you either remove module.lambda.aws_cloudwatch_log_group.lambda from the state or move it to somewhere else in the state using either terraform state rm or terraform state mv."
42+
type = bool
43+
default = false
44+
}
45+
variable "log_group_retention" {
46+
description = "The retention time of the Cloudwatch Log group that the Lambda logs to if create_log_group is enabled."
47+
type = string
48+
default = null
49+
}
50+
51+
variable "log_group_kms_key_id" {
52+
description = "The ID of a KMS key to use for encrypting the logs for the log group used by the Lambda if create_log_group is enabled."
53+
type = string
54+
default = null
55+
}
56+
57+
variable "log_group_tags" {
58+
description = "The tags to assign to the log group for the Lambda if create_log_group is enabled. This needs to be a list of maps of strings."
59+
type = list(map(string))
60+
default = null
61+
}
62+
4063
variable "lambda_at_edge" {
4164
description = "Set this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the function"
4265
type = bool
@@ -53,8 +76,8 @@ variable "policy" {
5376

5477
variable "trusted_entities" {
5578
description = "Lambda function additional trusted entities for assuming roles (trust relationship)"
56-
type = list(string)
57-
default = []
79+
type = list(string)
80+
default = []
5881
}
5982

6083
locals {

0 commit comments

Comments
 (0)