build: aws/lambda secret

brexhq · Oct 27, 2023 · 8c2f188 · 8c2f188
1 parent 4e5428b
commit 8c2f188
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/build/terraform/aws/lambda/_variables.tf b/build/terraform/aws/lambda/_variables.tf
@@ -23,7 +23,9 @@ variable "config" {
     timeout     = optional(number, 300)
     memory      = optional(number, 1024)
     env         = optional(map(any), null)
-    secret      = optional(bool, false)
+    secret = optional(object({
+      name = optional(string, null)
+    }), { name = null })
     vpc_config = optional(object({
       subnet_ids         = list(string)
       security_group_ids = list(string)

diff --git a/build/terraform/aws/lambda/main.tf b/build/terraform/aws/lambda/main.tf
@@ -74,8 +74,8 @@ resource "aws_appconfig_configuration_profile" "config" {
 
 # Optional secrets creation.
 resource "aws_secretsmanager_secret" "secret" {
-  count      = var.config.secret ? 1 : 0
-  name       = var.config.name
+  count      = var.config.secret.name != null ? 1 : 0
+  name       = var.config.secret.name
   kms_key_id = var.kms.id
   tags       = var.tags
 }
@@ -142,6 +142,23 @@ data "aws_iam_policy_document" "custom_policy_document" {
     ]
   }
 
+  // If the secret was created, then allow the Lambda function
+  // to read it.
+  dynamic "statement" {
+    for_each = var.config.secret.name != null ? [1] : []
+
+    content {
+      effect = "Allow"
+      actions = [
+        "secretsmanager:GetSecretValue",
+      ]
+
+      resources = [
+        aws_secretsmanager_secret.secret.arn,
+      ]
+    }
+  }
+
   // Add additional statements provided as a variable.
   dynamic "statement" {
     for_each = var.config.iam_statements