New assume role script

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Łukasz Tomaszkiewicz
+Copyright (c) 2020 Pragmatic Coders
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

alerts/common/main.tf

@@ -1,7 +1,7 @@
 variable "sns_topic_name" { default = "alerts" }
 
 resource "aws_sns_topic" "alerts" {
-  name = "alerts"
+  name = var.sns_topic_name
 }
 
 output "sns_topic_arn" {

alerts/opsgenie/main.tf

@@ -4,5 +4,5 @@ resource "aws_sns_topic_subscription" "opsgenie_alarm_notification_subscription"
   topic_arn              = var.sns_topic_arn
   protocol               = "https"
   endpoint_auto_confirms = true
-  endpoint               = "https://api.%{if var.eu_region}eu.%{endif}opsgenie.com/v1/json/cloudwatch?apiKey=${var.api_key}"
+  endpoint               = "https://api.%{if var.eu_region}eu.%{endif}opsgenie.com/v1/json/cloudwatch%{if var.cloudwatch_event}events%{endif}?apiKey=${var.api_key}"
 }

alerts/opsgenie/variables.tf

@@ -1,3 +1,4 @@
 variable "api_key" {}
 variable "eu_region" {default = false}
 variable "sns_topic_arn" {}
+variable "cloudwatch_event" { default = false }

alerts/slack/download.tf

@@ -2,6 +2,6 @@ data "external" "download" {
   program = [
     "/bin/sh",
     "-c",
-    "if [[ ! -f /tmp/terraform-artifacts/lambda-slack-alarm-notification.zip ]]; then wget -O /tmp/terraform-artifacts/lambda-slack-alarm-notification.zip https://github.com/tomaszkiewicz/slack-notification-lambda/releases/download/initial/lambda.zip > /dev/null; fi; echo '{}'",
+    "if [[ ! -f /tmp/terraform-artifacts/lambda-slack-alarm-notification.zip ]]; then wget -O /tmp/terraform-artifacts/lambda-slack-alarm-notification.zip https://github.com/pragmaticcoders/slack-notification-lambda/releases/download/initial/lambda.zip > /dev/null; fi; echo '{}'",
   ]
 }

api-gateway-v2/alerts/api_alerts.tf

@@ -0,0 +1,47 @@
+variable "notifications_sns_topic_arn" { default = "" }
+variable "api_name" { default = "" }
+variable "api_id" { default = "" }
+variable "threshold" {default = 10}
+variable "period" {default = 60}
+variable "evaluation_periods" {default = 1}
+variable "alarm_name" {default = ""}
+
+resource "aws_cloudwatch_metric_alarm" "api-4xx" {
+  alarm_name                = "api-gateway-4xx-response.${var.alarm_name}"
+  alarm_description         = "This alarm monitors api 4xx response"
+  comparison_operator       = "GreaterThanThreshold"
+  evaluation_periods        = var.evaluation_periods
+  metric_name               = var.api_id == "" ? "4XXError" : "4xx"
+  namespace                 = "AWS/ApiGateway"
+  period                    = var.period
+  statistic                 = "Sum"
+  threshold                 = var.threshold
+  treat_missing_data        = "ignore"
+  alarm_actions             = [var.notifications_sns_topic_arn]
+  ok_actions                = [var.notifications_sns_topic_arn]
+
+  dimensions = merge(
+    var.api_id != "" ? { ApiId = var.api_id } : {},
+    var.api_name != "" ? { ApiName = var.api_name } : {}
+  )
+}
+
+resource "aws_cloudwatch_metric_alarm" "api-5xx" {
+  alarm_name                = "api-gateway-5xx-response.${var.alarm_name}"
+  alarm_description         = "This alarm monitors api 5xx response"
+  comparison_operator       = "GreaterThanThreshold"
+  evaluation_periods        = var.evaluation_periods
+  metric_name               = var.api_id == "" ? "5XXError" : "5xx"
+  namespace                 = "AWS/ApiGateway"
+  period                    = var.period
+  statistic                 = "Sum"
+  threshold                 = var.threshold
+  treat_missing_data        = "ignore"
+  alarm_actions             = [var.notifications_sns_topic_arn]
+  ok_actions                = [var.notifications_sns_topic_arn]
+
+  dimensions = merge(
+    var.api_id != "" ? { ApiId = var.api_id } : {},
+    var.api_name != "" ? { ApiName = var.api_name } : {}
+  )
+}

api-gateway-v2/any-route/main.tf

@@ -0,0 +1,5 @@
+resource "aws_apigatewayv2_route" "public" {
+  api_id               = var.api_id
+  route_key            = "${var.method} ${var.path}"
+  target               = "integrations/${var.integration_id}"
+}

api-gateway-v2/any-route/variables.tf

@@ -0,0 +1,4 @@
+variable "path" {}
+variable "method" { default = "ANY" }
+variable "api_id" {}
+variable "integration_id" {}

api-gateway-v2/ecs-service-alb/domain.tf

@@ -0,0 +1,9 @@
+module "domain" {
+  source = "../domain"
+
+  api_id          = aws_apigatewayv2_api.main.id
+  domain_name     = var.domain_name
+  dns_zone_id     = var.dns_zone_id
+  certificate_arn = var.certificate_arn
+  stage           = aws_apigatewayv2_stage.main.name
+}

api-gateway-v2/ecs-service-alb/main.tf

@@ -0,0 +1,62 @@
+resource "aws_apigatewayv2_api" "main" {
+  name          = var.name
+  protocol_type = "HTTP"
+
+  dynamic "cors_configuration" {
+    for_each = var.enable_cors ? ["hack"] : []
+
+    content {
+      allow_headers     = var.cors_allow_headers
+      allow_methods     = var.cors_allow_methods
+      allow_origins     = var.cors_allow_origins
+      max_age           = var.cors_max_age
+      allow_credentials = var.cors_allow_credentials
+      expose_headers    = var.cors_expose_headers
+    }
+  }
+}
+
+
+
+resource "aws_apigatewayv2_integration" "default" {
+  api_id             = aws_apigatewayv2_api.main.id
+  integration_type   = "HTTP_PROXY"
+  integration_uri    = var.service_arn
+  integration_method = "ANY"
+  connection_type    = "VPC_LINK"
+  connection_id      = aws_apigatewayv2_vpc_link.service.id
+  request_parameters = var.integration_request_parameters
+
+  lifecycle {
+    ignore_changes = [
+      passthrough_behavior,
+    ]
+  }
+}
+
+resource "aws_apigatewayv2_route" "default" {
+  count          = var.create_default_route ? 1 : 0
+  api_id         = aws_apigatewayv2_api.main.id
+  route_key      = "$default"
+  operation_name = "DefaultRoute"
+  target         = "integrations/${aws_apigatewayv2_integration.default.id}"
+}
+
+resource "aws_apigatewayv2_stage" "main" {
+  api_id      = aws_apigatewayv2_api.main.id
+  name        = "live"
+  auto_deploy = true
+
+  lifecycle {
+    ignore_changes = [
+      access_log_settings,
+      deployment_id,
+    ]
+  }
+}
+
+resource "aws_cloudwatch_log_group" "gw_access" {
+  count             = var.enable_access_log ? 1 : 0
+  name              = "/api-gateway/${var.name}"
+  retention_in_days = var.logs_retention_days
+}

api-gateway-v2/ecs-service-alb/output.tf

@@ -0,0 +1,19 @@
+output "id" {
+  value = aws_apigatewayv2_api.main.id
+}
+
+output "api_id" {
+  value = aws_apigatewayv2_api.main.id
+}
+
+output "name" {
+  value = aws_apigatewayv2_api.main.name
+}
+
+output "default_integration_id" {
+  value = aws_apigatewayv2_integration.default.id
+}
+
+output "vpc_link_id" {
+  value = aws_apigatewayv2_vpc_link.service.id
+}

api-gateway-v2/ecs-service-alb/variables.tf

@@ -0,0 +1,72 @@
+variable "name" { default = "api-gateway-ecs-service" }
+# variable "route_selection_expression" { default = "$request.body.action" }
+variable "domain_name" {}
+variable "dns_zone_id" {}
+variable "certificate_arn" {}
+variable "service_arn" {}
+variable "subnet_ids" {
+  type = list
+}
+variable "security_group_ids" {
+  type = list
+}
+variable "create_default_route" { default = true }
+
+variable "enable_cors" { default = false }
+
+variable "cors_allow_headers" {
+  description = "The set of allowed HTTP headers"
+  type        = list(string)
+
+  default = [
+    "Authorization",
+    "Content-Type",
+    "X-Amz-Date",
+    "X-Amz-Security-Token",
+    "X-Api-Key",
+  ]
+}
+
+variable "cors_allow_methods" {
+  description = "The set of allowed HTTP methods"
+  type        = list(string)
+
+  default = [
+    "OPTIONS",
+    "HEAD",
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+  ]
+}
+
+variable "cors_allow_origins" {
+  description = "The set of allowed origins"
+  type        = list(string)
+  default     = ["*"]
+}
+
+variable "cors_max_age" {
+  description = "The number of seconds that the browser should cache preflight request results"
+  type        = string
+  default     = "7200"
+}
+
+variable "cors_allow_credentials" {
+  description = "Whether credentials are included in the CORS request"
+  default     = false
+}
+
+variable "cors_expose_headers" {
+  description = "The set of exposed HTTP headers"
+  type        = list(string)
+  default     = []
+}
+variable "enable_access_log" { default = false }
+variable "access_log_format" { default = "{ \"requestId\":\"$context.requestId\", \"ip\": \"$context.identity.sourceIp\", \"httpMethod\":\"$context.httpMethod\",\"status\":\"$context.status\",\"path\": \"$context.path\" }" }
+variable "logs_retention_days" { default = 7 }
+
+variable "integration_request_parameters" { default = {} }
+

api-gateway-v2/ecs-service-alb/vpc_link.tf

@@ -0,0 +1,5 @@
+resource "aws_apigatewayv2_vpc_link" "service" {
+  name               = "${var.name}-vpc-link"
+  security_group_ids = var.security_group_ids
+  subnet_ids         = var.subnet_ids
+}

api-gateway-v2/ecs-service/main.tf

@@ -23,6 +23,7 @@ resource "aws_apigatewayv2_integration" "default" {
   integration_method = "ANY"
   connection_type    = "VPC_LINK"
   connection_id      = aws_apigatewayv2_vpc_link.service.id
+  request_parameters = var.integration_request_parameters
 
   lifecycle {
     ignore_changes = [
@@ -44,10 +45,24 @@ resource "aws_apigatewayv2_stage" "main" {
   name        = "live"
   auto_deploy = true
 
+  dynamic "access_log_settings" {
+    for_each = var.enable_access_log ? ["access_log_enabled"] : []
+
+    content {
+      destination_arn = aws_cloudwatch_log_group.gw_access[0].arn
+      format = var.access_log_format
+    }
+  }
+
   lifecycle {
     ignore_changes = [
-      access_log_settings,
       deployment_id,
     ]
   }
 }
+
+resource "aws_cloudwatch_log_group" "gw_access" {
+  count             = var.enable_access_log ? 1 : 0
+  name              = "/api-gateway/${var.name}"
+  retention_in_days = var.logs_retention_days
+}

api-gateway-v2/ecs-service/output.tf

@@ -6,6 +6,10 @@ output "api_id" {
   value = aws_apigatewayv2_api.main.id
 }
 
+output "name" {
+  value = aws_apigatewayv2_api.main.name
+}
+
 output "default_integration_id" {
   value = aws_apigatewayv2_integration.default.id
 }

api-gateway-v2/ecs-service/variables.tf

@@ -64,3 +64,9 @@ variable "cors_expose_headers" {
   type        = list(string)
   default     = []
 }
+
+variable "enable_access_log" { default = false }
+variable "access_log_format" { default = "{ \"requestId\":\"$context.requestId\", \"ip\": \"$context.identity.sourceIp\", \"httpMethod\":\"$context.httpMethod\",\"status\":\"$context.status\",\"path\": \"$context.path\" }" }
+variable "logs_retention_days" { default = 7 }
+
+variable "integration_request_parameters" { default = {} }

api-gateway-v2/jwt-auth-route-with-options/main.tf

@@ -0,0 +1,15 @@
+resource "aws_apigatewayv2_route" "auth_on" {
+  for_each             = toset(var.method)
+  api_id               = var.api_id
+  route_key            = "${each.key} ${var.path}"
+  target               = "integrations/${var.integration_id}"
+  authorization_scopes = var.authorization_scopes
+  authorizer_id        = var.authorizer_id
+  authorization_type   = "JWT"
+}
+
+resource "aws_apigatewayv2_route" "auth_off" {
+  api_id               = var.api_id
+  route_key            = "OPTIONS ${var.path}"
+  target               = "integrations/${var.integration_id}"
+}

api-gateway-v2/jwt-auth-route-with-options/variables.tf

@@ -0,0 +1,16 @@
+variable "path" {}
+variable "method"{
+  type = list
+  default = [
+  "GET","POST","DELETE","HEAD","PATCH","PUT"
+  ]
+}
+variable "api_id" {}
+variable "integration_id" {}
+variable "authorizer_id" {}
+variable "authorization_scopes" {
+  type = list
+  default = [
+    "aws.cognito.signin.user.admin",
+  ]
+}

api-gateway-v2/websocket/main.tf

@@ -55,6 +55,11 @@ resource "aws_apigatewayv2_stage" "main" {
   deployment_id = aws_apigatewayv2_deployment.main.id
   name          = "live"
 
+  default_route_settings {
+    throttling_burst_limit   = var.throttling_burst_limit
+    throttling_rate_limit    = var.throttling_rate_limit
+  }
+
   lifecycle {
     ignore_changes = [
       access_log_settings,

api-gateway-v2/websocket/variables.tf

@@ -6,3 +6,5 @@ variable "disconnect_lambda_invoke_arn" {}
 variable "domain_name" {}
 variable "dns_zone_id" {}
 variable "certificate_arn" {}
+variable "throttling_burst_limit" {}
+variable "throttling_rate_limit" {}