feat: Add Amazon MQ event source type support (#190)

Infra-Red · web-flow · commit 43a5134cbd10 · 2021-08-30T11:51:31.000+02:00
diff --git a/README.md b/README.md
@@ -571,16 +571,16 @@ Q4: What does this error mean - `"We currently do not support adding policies fo
 - [With VPC](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/with-vpc) - Create Lambda Function with VPC.
 - [With EFS](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/with-efs) - Create Lambda Function with Elastic File System attached (Terraform 0.13+ is recommended).
 - [Multiple regions](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/multiple-regions) - Create the same Lambda Function in multiple regions with non-conflicting IAM roles and policies.
-- [Event Source Mapping](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/event-source-mapping) - Create Lambda Function with event source mapping configuration (SQS, DynamoDB, and Kinesis).
+- [Event Source Mapping](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/event-source-mapping) - Create Lambda Function with event source mapping configuration (SQS, DynamoDB, Amazon MQ, and Kinesis).
 - [Triggers](https://github.com/terraform-aws-modules/terraform-aws-lambda/tree/master/examples/triggers) - Create Lambda Function with some triggers (eg, Cloudwatch Events, EventBridge).
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.35 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.43 |
 | <a name="requirement_external"></a> [external](#requirement\_external) | >= 1 |
 | <a name="requirement_local"></a> [local](#requirement\_local) | >= 1 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 2 |
@@ -589,7 +589,7 @@ Q4: What does this error mean - `"We currently do not support adding policies fo
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.35 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.43 |
 | <a name="provider_external"></a> [external](#provider\_external) | >= 1 |
 | <a name="provider_local"></a> [local](#provider\_local) | >= 1 |
 | <a name="provider_null"></a> [null](#provider\_null) | >= 2 |
diff --git a/examples/alias/README.md b/examples/alias/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.19 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/alias/versions.tf b/examples/alias/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 3.19"
diff --git a/examples/async/README.md b/examples/async/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.19 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/async/versions.tf b/examples/async/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 3.19"
diff --git a/examples/build-package/README.md b/examples/build-package/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.19 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/build-package/versions.tf b/examples/build-package/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 3.19"
diff --git a/examples/deploy/README.md b/examples/deploy/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.19 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/deploy/versions.tf b/examples/deploy/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 3.19"
diff --git a/examples/event-source-mapping/README.md b/examples/event-source-mapping/README.md
@@ -1,6 +1,6 @@
 # Event Source Mapping configuration
 
-Configuration in this directory creates Lambda Function with event source mapping configuration for SQS queue, Kinesis stream, and DynamoDB table.
+Configuration in this directory creates Lambda Function with event source mapping configuration for SQS queue, Kinesis stream, Amazon MQ, and DynamoDB table.
 
 ## Usage
 
diff --git a/examples/event-source-mapping/main.tf b/examples/event-source-mapping/main.tf
@@ -35,6 +35,20 @@ module "lambda_function" {
       event_source_arn  = aws_kinesis_stream.this.arn
       starting_position = "LATEST"
     }
+    mq = {
+      event_source_arn = aws_mq_broker.this.arn
+      queues           = ["my-queue"]
+      source_access_configuration = [
+        {
+          type = "BASIC_AUTH"
+          uri  = aws_secretsmanager_secret.this.arn
+        },
+        {
+          type = "VIRTUAL_HOST"
+          uri  = "/"
+        }
+      ]
+    }
   }
 
   allowed_triggers = {
@@ -50,17 +64,40 @@ module "lambda_function" {
       principal  = "kinesis.amazonaws.com"
       source_arn = aws_kinesis_stream.this.arn
     }
+    mq = {
+      principal  = "mq.amazonaws.com"
+      source_arn = aws_mq_broker.this.arn
+    }
   }
 
   create_current_version_allowed_triggers = false
 
-  # Allow failures to be sent to SQS queue
+  attach_network_policy = true
+
   attach_policy_statements = true
   policy_statements = {
+    # Allow failures to be sent to SQS queue
     sqs_failure = {
       effect    = "Allow",
       actions   = ["sqs:SendMessage"],
       resources = [aws_sqs_queue.failure.arn]
+    },
+    # Execution role permissions to read records from an Amazon MQ broker
+    # https://docs.aws.amazon.com/lambda/latest/dg/with-mq.html#events-mq-permissions
+    mq_event_source = {
+      effect    = "Allow",
+      actions   = ["ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs"],
+      resources = ["*"]
+    },
+    mq_describe_broker = {
+      effect    = "Allow",
+      actions   = ["mq:DescribeBroker"],
+      resources = [aws_mq_broker.this.arn]
+    },
+    secrets_manager_get_value = {
+      effect    = "Allow",
+      actions   = ["secretsmanager:GetSecretValue"],
+      resources = [aws_secretsmanager_secret.this.arn]
     }
   }
 
@@ -78,14 +115,26 @@ module "lambda_function" {
 # Extra resources
 ##################
 
+# Shared resources
 resource "random_pet" "this" {
   length = 2
 }
 
+resource "random_password" "this" {
+  length  = 40
+  special = false
+}
+
+# SQS
 resource "aws_sqs_queue" "this" {
   name = random_pet.this.id
 }
 
+resource "aws_sqs_queue" "failure" {
+  name = "${random_pet.this.id}-failure"
+}
+
+# DynamoDB
 resource "aws_dynamodb_table" "this" {
   name             = random_pet.this.id
   billing_mode     = "PAY_PER_REQUEST"
@@ -105,11 +154,43 @@ resource "aws_dynamodb_table" "this" {
   }
 }
 
+# Kinesis
 resource "aws_kinesis_stream" "this" {
   name        = random_pet.this.id
   shard_count = 1
 }
 
-resource "aws_sqs_queue" "failure" {
-  name = "${random_pet.this.id}-failure"
+# Amazon MQ
+data "aws_vpc" "default" {
+  default = true
+}
+
+data "aws_security_group" "default" {
+  vpc_id = data.aws_vpc.default.id
+  name   = "default"
+}
+
+resource "aws_mq_broker" "this" {
+  broker_name        = random_pet.this.id
+  engine_type        = "RabbitMQ"
+  engine_version     = "3.8.11"
+  host_instance_type = "mq.t3.micro"
+  security_groups    = [data.aws_security_group.default.id]
+
+  user {
+    username = random_pet.this.id
+    password = random_password.this.result
+  }
+}
+
+resource "aws_secretsmanager_secret" "this" {
+  name = "${random_pet.this.id}-mq-credentials"
+}
+
+resource "aws_secretsmanager_secret_version" "this" {
+  secret_id = aws_secretsmanager_secret.this.id
+  secret_string = jsonencode({
+    username = random_pet.this.id
+    password = random_password.this.result
+  })
 }
diff --git a/examples/event-source-mapping/versions.tf b/examples/event-source-mapping/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
-    aws    = ">= 3.27"
+    aws    = ">= 3.43"
     random = ">= 2"
   }
 }
diff --git a/examples/multiple-regions/README.md b/examples/multiple-regions/README.md
@@ -20,7 +20,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.19 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/multiple-regions/versions.tf b/examples/multiple-regions/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 3.19"
diff --git a/examples/simple/README.md b/examples/simple/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.19 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/simple/versions.tf b/examples/simple/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 3.19"
diff --git a/examples/triggers/README.md b/examples/triggers/README.md
@@ -20,7 +20,7 @@ Note that this example may create resources which cost money. Run `terraform des
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.67 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
diff --git a/examples/triggers/versions.tf b/examples/triggers/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws    = ">= 2.67"
diff --git a/main.tf b/main.tf
@@ -212,7 +212,7 @@ resource "aws_lambda_permission" "unqualified_alias_triggers" {
 }
 
 resource "aws_lambda_event_source_mapping" "this" {
-  for_each = var.create && var.create_function && !var.create_layer && var.create_unqualified_alias_allowed_triggers ? tomap(var.event_source_mapping) : tomap({})
+  for_each = var.create && var.create_function && !var.create_layer && var.create_unqualified_alias_allowed_triggers ? var.event_source_mapping : tomap({})
 
   function_name = aws_lambda_function.this[0].arn
 
@@ -228,6 +228,7 @@ resource "aws_lambda_event_source_mapping" "this" {
   maximum_record_age_in_seconds      = lookup(each.value, "maximum_record_age_in_seconds", null)
   bisect_batch_on_function_error     = lookup(each.value, "bisect_batch_on_function_error", null)
   topics                             = lookup(each.value, "topics", null)
+  queues                             = lookup(each.value, "queues", null)
 
   dynamic "destination_config" {
     for_each = lookup(each.value, "destination_arn_on_failure", null) != null ? [true] : []
@@ -237,4 +238,12 @@ resource "aws_lambda_event_source_mapping" "this" {
       }
     }
   }
+
+  dynamic "source_access_configuration" {
+    for_each = lookup(each.value, "source_access_configuration", [])
+    content {
+      type = source_access_configuration.value["type"]
+      uri  = source_access_configuration.value["uri"]
+    }
+  }
 }
diff --git a/modules/alias/README.md b/modules/alias/README.md
@@ -115,7 +115,7 @@ module "lambda" {
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.35 |
 
 ## Providers
diff --git a/modules/alias/versions.tf b/modules/alias/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws = ">= 3.35"
diff --git a/modules/deploy/README.md b/modules/deploy/README.md
@@ -99,7 +99,7 @@ module "lambda" {
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.31 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.35 |
 | <a name="requirement_local"></a> [local](#requirement\_local) | >= 1 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 2 |
diff --git a/modules/deploy/versions.tf b/modules/deploy/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
     aws   = ">= 3.35"
diff --git a/versions.tf b/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"
 
   required_providers {
-    aws      = ">= 3.35"
+    aws      = ">= 3.43"
     external = ">= 1"
     local    = ">= 1"
     null     = ">= 2"
