lambda.tf

#
# Lambda function that takes care of requesting the creation and renewal of
# LetsEncrypt certificates and stores them in an S3 bucket.
#
module "certbot_lambda_jenkins" {
  source = "github.com/binbashar/terraform-aws-lambda?ref=v1.2.0"

  function_name = "${var.name_prefix}-${var.name}"
  description   = "CertBot Lambda that creates and renews certificates for ${var.certificate_domains}"
  handler       = "main.lambda_handler"
  runtime       = "python3.6"
  timeout       = 300

  source_path = "${path.module}/src/"

  trusted_entities = ["events.amazonaws.com"]

  policy = {
    json = data.aws_iam_policy_document.bucket_permissions.json
  }

  environment = {
    variables = {
      EMAIL     = var.contact_email
      DOMAINS   = var.certificate_domains
      S3_BUCKET = aws_s3_bucket.certificates_store.id
      S3_PREFIX = var.name
    }
  }
}

#
# Lambda permissions on the bucket used to store certificates.
#
data "aws_iam_policy_document" "bucket_permissions" {
  statement {
    actions = [
      "s3:ListBucket"
    ]
    resources = [
      aws_s3_bucket.certificates_store.arn
    ]
  }

  statement {
    actions = [
      "s3:PutObject"
    ]
    resources = [
      aws_s3_bucket.certificates_store.arn,
      "${aws_s3_bucket.certificates_store.arn}/*"
    ]
  }

  statement {
    actions = [
      "route53:ListHostedZones",
      "route53:GetChange"
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "route53:ChangeResourceRecordSets"
    ]
    resources = [
      "arn:aws:route53:::hostedzone/${var.hosted_zone_id}"
    ]
  }
}