- Terraform module api-gateway-v2 to create new modules using this as baseline -
++ With our comprehensive DevOps toolkit - streamline operations, automate workflows, enhance collaboration and, most importantly, deploy with confidence. +
+
@@ -22,6 +20,9 @@
+
+
+
+
+ 
+
@@ -41,23 +45,84 @@
[| no | -| integration\_description | Description of the integration. | `string` | `"Lambda example"` | no | -| integration\_method | Integration's HTTP method. Must be specified if integration\_type is not MOCK. | `string` | `"POST"` | no | -| integration\_type | Integration type of an integration. Valid values: AWS (supported only for WebSocket APIs), AWS\_PROXY, HTTP (supported only for WebSocket APIs), HTTP\_PROXY, MOCK (supported only for WebSocket APIs). | `string` | `"AWS_PROXY"` | no | -| integration\_uri | URI of the Lambda function for a Lambda proxy integration, when integration\_type is AWS\_PROXY. For an HTTP integration, specify a fully-qualified URL. | `string` | `""` | no | -| integrations | Map of API gateway routes with integrations | `map(any)` | `{}` | no | -| label\_order | Label order, e.g. `name`,`application`. | `list(any)` | `[]` | no | -| managedby | ManagedBy, eg 'CloudDrove' | `string` | `"hello@clouddrove.com"` | no | -| mutual\_tls\_authentication | An Amazon S3 URL that specifies the truststore for mutual TLS authentication as well as version, keyed at uri and version | `map(string)` | `{}` | no | -| name | Name (e.g. `app` or `cluster`). | `string` | `"api"` | no | -| passthrough\_behavior | Pass-through behavior for incoming requests based on the Content-Type header in the request, and the available mapping templates specified as the request\_templates attribute. | `string` | `"WHEN_NO_MATCH"` | no | -| protocol\_type | The API protocol. Valid values: HTTP, WEBSOCKET | `string` | `"HTTP"` | no | -| repository | Terraform current module repo | `string` | `""` | no | -| route\_key | Part of quick create. Specifies any route key. Applicable for HTTP APIs. | `string` | `null` | no | -| route\_selection\_expression | The route selection expression for the API. | `string` | `"$request.method $request.path"` | no | -| route\_settings | Settings for default route | `map(string)` | `{}` | no | -| security\_group\_ids | A list of security group IDs to associate with. | `list(string)` | `[]` | no | -| subnet\_ids | A list of VPC Subnet IDs to launch in. | `list(string)` | `[]` | no | -| tags | Additional tags (e.g. map(`BusinessUnit`,`XYZ`). | `map(any)` | `{}` | no | -| target | Part of quick create. Quick create produces an API with an integration, a default catch-all route, and a default stage which is configured to automatically deploy changes. For HTTP integrations, specify a fully qualified URL. For Lambda integrations, specify a function ARN. The type of the integration will be HTTP\_PROXY or AWS\_PROXY, respectively. Applicable for HTTP APIs. | `string` | `null` | no | -| vpc\_links | Map of VPC Links details to create | `map(any)` | `{}` | no | -| zone\_id | The ID of the hosted zone to contain this record. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| api\_arn | The API identifier. | -| api\_endpoint | The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com. | -| api\_id | The API identifier. | -| invoke\_url | URL to invoke the API pointing to the stage | - - - - -## Testing -In this module testing is performed with [terratest](https://github.com/gruntwork-io/terratest) and it creates a small piece of infrastructure, matches the output like ARN, ID and Tags name etc and destroy infrastructure in your AWS account. This testing is written in GO, so you need a [GO environment](https://golang.org/doc/install) in your system. - -You need to run the following command in the testing folder: -```hcl - go test -run Test -``` ## Feedback -If you come accross a bug or have any feedback, please log it in our [issue tracker](https://github.com/clouddrove/terraform-aws-api-gateway/issues), or feel free to drop us an email at [hello@clouddrove.com](mailto:hello@clouddrove.com). +Spot a bug or have thoughts to share with us? Let's squash it together! Log it in our [issue tracker](https://github.com/clouddrove/terraform-aws-api-gateway/issues), feel free to drop us an email at [hello@clouddrove.com](mailto:hello@clouddrove.com). + +Show some love with a β on [our GitHub](https://github.com/clouddrove/terraform-aws-api-gateway)! if our work has brightened your day! β your feedback fuels our journey! + + +## :rocket: Our Accomplishment + +We have [*100+ Terraform modules*][terraform_modules] π. You could consider them finished, but, with enthusiasts like yourself, we are able to ever improve them, so we call our status - improvement in progress. + +- [Terraform Module Registry:](https://registry.terraform.io/namespaces/clouddrove) Discover our Terraform modules here. + +- [Terraform Modules for AWS/Azure Modules:](https://github.com/clouddrove/toc) Explore our comprehensive Table of Contents for easy navigation through our documentation for modules pertaining to AWS, Azure & GCP. + +- [Terraform Modules for Digital Ocean:](https://github.com/terraform-do-modules/toc) Check out our specialized Terraform modules for Digital Ocean. + + + + +## Join Our Slack Community + +Join our vibrant open-source slack community and embark on an ever-evolving journey with CloudDrove; helping you in moving upwards in your career path. +Join our vibrant Open Source Slack Community and embark on a learning journey with CloudDrove. Grow with us in the world of DevOps and set your career on a path of consistency. + +ππ¬What you'll get after joining this Slack community: + +- π Encouragement to upgrade your best version. +- π Learning companionship with our DevOps squad. +- π± Relentless growth with daily updates on new advancements in technologies. + +Join our tech elites [Join Now][slack] π + + +## Explore Our Blogs -If you have found it worth your time, go ahead and give us a β on [our GitHub](https://github.com/clouddrove/terraform-aws-api-gateway)! + Click [here][blog] :books: :star2: -## About us +## Tap into our capabilities +We provide a platform for organizations to engage with experienced top-tier DevOps & Cloud services. Tap into our pool of certified engineers and architects to elevate your DevOps and Cloud Solutions. -At [CloudDrove][website], we offer expert guidance, implementation support and services to help organisations accelerate their journey to the cloud. Our services include docker and container orchestration, cloud migration and adoption, infrastructure automation, application modernisation and remediation, and performance engineering. +At [CloudDrove][website], has extensive experience in designing, building & migrating environments, securing, consulting, monitoring, optimizing, automating, and maintaining complex and large modern systems. With remarkable client footprints in American & European corridors, our certified architects & engineers are ready to serve you as per your requirements & schedule. Write to us at [business@clouddrove.com](mailto:business@clouddrove.com).
"$request.header.Authorization"
]
We are The Cloud Experts!
We β€οΈ Open Source and you can check out our other modules to get help with your new Cloud ideas.
+We β€οΈ Open Source and you can check out our other modules to get help with your new Cloud ideas.
[website]: https://clouddrove.com + [blog]: https://blog.clouddrove.com + [slack]: https://www.launchpass.com/devops-talks [github]: https://github.com/clouddrove [linkedin]: https://cpco.io/linkedin [twitter]: https://twitter.com/clouddrove/ diff --git a/README.yaml b/README.yaml index d589e53..ac0396c 100644 --- a/README.yaml +++ b/README.yaml @@ -24,13 +24,28 @@ badges: - name: "Licence" image: "https://img.shields.io/badge/License-APACHE-blue.svg" url: "LICENSE.md" + - name: "Changelog" + image: "https://img.shields.io/badge/Changelog-blue" + url: "CHANGELOG.md" +prerequesties: + - name: Terraform + url: https://learn.hashicorp.com/terraform/getting-started/install.html + version: ">= 1.6.1" + +providers: + - name: aws + url: https://aws.amazon.com/ + version: ">= 5.20.0" + +module_dependencies: + - name: Labels Module + url: https://github.com/clouddrove/terraform-aws-labels + description: Provides resource tagging. + # description of this project description: |- Terraform module api-gateway-v2 to create new modules using this as baseline -# extra content -include: - - "terraform.md" # How to use this project # How to use this project diff --git a/_examples/vpc_link_api/lambda-test.zip b/_examples/vpc_link_api/lambda-test.zip deleted file mode 100644 index 8589034..0000000 Binary files a/_examples/vpc_link_api/lambda-test.zip and /dev/null differ diff --git a/_examples/vpc_link_api/lambda_packages/index.py b/_examples/vpc_link_api/lambda_packages/index.py deleted file mode 100644 index 6e5bd09..0000000 --- a/_examples/vpc_link_api/lambda_packages/index.py +++ /dev/null @@ -1,14 +0,0 @@ -import os -import json - -def lambda_handler(event, context): - json_region = os.environ['AWS_REGION'] - return { - "statusCode": 200, - "headers": { - "Content-Type": "application/json" - }, - "body": json.dumps({ - "Region ": json_region - }) - } diff --git a/docs/io.md b/docs/io.md new file mode 100644 index 0000000..2f23165 --- /dev/null +++ b/docs/io.md @@ -0,0 +1,130 @@ +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| access\_log\_settings | Settings for logging access in this stage. | `map(string)` | `{}` | no | +| api\_deployment\_description | flag to manage description of api deployment | `string` | `"test"` | no | +| api\_description | the description of the API. | `string` | `"Manages an Amazon API Gateway Version 2 API."` | no | +| api\_key\_selection\_expression | An API key selection expression. Valid values: $context.authorizer.usageIdentifierKey, $request.header.x-api-key. | `string` | `"$request.header.x-api-key"` | no | +| api\_resources | flag to control of resources path | `map(map(string))` | `{}` | no | +| api\_version | A version identifier for the API | `string` | `null` | no | +| apigatewayv2\_api\_mapping\_enabled | Flag to control the mapping creation. | `bool` | `true` | no | +| authorization | Required The type of authorization used for the method (NONE, CUSTOM, AWS\_IAM, COGNITO\_USER\_POOLS) | `string` | `"NONE"` | no | +| authorizer\_iam\_role | Custome IAMRole for Authorizer Credentials. | `string` | `""` | no | +| authorizer\_result\_ttl\_in\_seconds | TTL of cached authorizer results in seconds. Defaults to 300. | `number` | `300` | no | +| authorizer\_type | The authorizer type. Valid values: JWT, REQUEST. For WebSocket APIs, specify REQUEST for a Lambda function using incoming request parameters. For HTTP APIs, specify JWT to use JSON Web Tokens. | `string` | `"JWT"` | no | +| authorizers | Map of API gateway authorizers | `map(any)` | `{}` | no | +| auto\_deploy | Set this to true to enable stage Auto Deployment | `bool` | `false` | no | +| body | An OpenAPI specification that defines the set of routes and integrations to create as part of the HTTP APIs. Supported only for HTTP APIs. | `string` | `null` | no | +| cache\_cluster\_enabled | Whether a cache cluster is enabled for the stage | `bool` | `false` | no | +| cache\_cluster\_size | Size of the cache cluster for the stage, if enabled. Allowed values include 0.5, 1.6, 6.1, 13.5, 28.4, 58.2, 118 and 237. | `string` | `"0.5"` | no | +| cache\_key\_parameters | List of cache key parameters for the integration. | `list(any)` | `[]` | no | +| cache\_namespace | Integration's cache namespace. | `string` | `""` | no | +| canary\_settings | (optional) describe your variable | `map(any)` | `{}` | no | +| client\_certificate\_id | Identifier of a client certificate for the stage. | `string` | `""` | no | +| connection\_id | ID of the VpcLink used for the integration. Required if connection\_type is VPC\_LINK | `string` | `""` | no | +| connection\_rest\_api\_type | Valid values are INTERNET (default for connections through the public routable internet), and VPC\_LINK (for private connections between API Gateway and a network load balancer in a VPC). | `string` | `"INTERNET"` | no | +| connection\_type | Type of the network connection to the integration endpoint. Valid values: INTERNET, VPC\_LINK. Default is INTERNET. | `string` | `"INTERNET"` | no | +| content\_handling | Supported values are CONVERT\_TO\_BINARY and CONVERT\_TO\_TEXT. If this property is not defined, the request payload will be passed through from the method request to integration request without modification, provided that the passthroughBehaviors is configured to support payload pass-through. | `string` | `"CONVERT_TO_TEXT"` | no | +| cors\_configuration | The cross-origin resource sharing (CORS) configuration. Applicable for HTTP APIs. | `any` | `{}` | no | +| create\_api\_domain\_name\_enabled | Flag to control the domain creation. | `bool` | `true` | no | +| create\_default\_stage\_enabled | Flag to control the stage creation. | `bool` | `true` | no | +| create\_http\_api | Flag to control creation of HTTP api. | `bool` | `false` | no | +| create\_kms\_key | Set this to `false` to provide existing kms key arn in `kms_key_arn` variable. | `bool` | `true` | no | +| create\_rest\_api | Flag to control the rest api creation. | `bool` | `false` | no | +| create\_rest\_api\_deployment | Flag to control the mapping creation. | `bool` | `true` | no | +| create\_rest\_api\_gateway\_authorizer | Flag to control the rest api gateway authorizer creation. | `bool` | `true` | no | +| create\_rest\_api\_gateway\_integration | Flag to control the rest api gateway integration creation. | `bool` | `true` | no | +| create\_rest\_api\_gateway\_integration\_response | Flag to control the rest api gateway integration response creation. | `bool` | `true` | no | +| create\_rest\_api\_gateway\_method | Flag to control the rest api gateway method creation. | `bool` | `true` | no | +| create\_rest\_api\_gateway\_method\_response | Flag to control the rest api gateway stage creation. | `bool` | `true` | no | +| create\_rest\_api\_gateway\_resource | flag to control the rest api gateway resources creation | `bool` | `true` | no | +| create\_rest\_api\_gateway\_stage | Flag to control the rest api gateway stage creation. | `bool` | `true` | no | +| create\_routes\_and\_integrations\_enabled | Whether to create routes and integrations resources | `bool` | `true` | no | +| create\_vpc\_endpoint | VPC endpoint is required to access api gateway url from outside the vpc. Set this to `false` to prevent vpc endpoint creation. | `bool` | `true` | no | +| create\_vpc\_link\_enabled | Whether to create VPC links | `bool` | `true` | no | +| credentials | To specify an IAM Role for Amazon API Gateway to assume, use the role's ARN. To require that the caller's identity be passed through from the request, specify the string | `string` | `""` | no | +| credentials\_arn | Part of quick create. Specifies any credentials required for the integration. Applicable for HTTP APIs. | `string` | `null` | no | +| default\_route\_settings | Default route settings for the stage. | `map(string)` | `{}` | no | +| default\_stage\_access\_log\_destination\_arn | ARN of the CloudWatch Logs log group to receive access logs. | `string` | `null` | no | +| default\_stage\_access\_log\_format | Single line format of the access logs of data. Refer to log settings for HTTP or Websocket. | `string` | `null` | no | +| description\_gateway\_stage | (optional) describe your variable | `string` | `"demo-test"` | no | +| documentation\_version | Version of the associated API documentation | `string` | `""` | no | +| domain\_name | The domain name to use for API gateway | `string` | `null` | no | +| domain\_name\_certificate\_arn | The ARN of an AWS-managed certificate that will be used by the endpoint for the domain name | `string` | `""` | no | +| domain\_name\_ownership\_verification\_certificate\_arn | ARN of the AWS-issued certificate used to validate custom domain ownership (when certificate\_arn is issued via an ACM Private CA or mutual\_tls\_authentication is configured with an ACM-imported certificate.) | `string` | `null` | no | +| enable\_access\_logs | flag to manage of cloudwatch log group creation | `bool` | `true` | no | +| enable\_key\_rotation | Specifies whether key rotation is enabled. Defaults to false. | `bool` | `null` | no | +| enabled | Set this to `false` to prevent resource creation by this terraform module. | `bool` | `true` | no | +| environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `"test"` | no | +| gateway\_authorizer | flag to control the gateway authorizer name. | `string` | `"demo"` | no | +| gateway\_integration\_type | flag tp control the gatway integration type. | `string` | `"AWS_PROXY"` | no | +| http\_method | HTTP method (GET, POST, PUT, DELETE, HEAD, OPTION, ANY) when calling the associated resource. | `string` | `"ANY"` | no | +| identity\_source | Source of the identity in an incoming request. Defaults to method.request.header.Authorization. For REQUEST type, this may be a comma-separated list of values, including headers, query string parameters and stage variable | `string` | `"method.request.header.Authorization"` | no | +| identity\_sources | The identity sources for which authorization is requested. | `list(string)` |[| no | +| integration\_description | Description of the integration. | `string` | `"Lambda example"` | no | +| integration\_http\_method | flag to control the gateway intergration http method. | `string` | `"POST"` | no | +| integration\_method | Integration's HTTP method. Must be specified if integration\_type is not MOCK. | `string` | `"POST"` | no | +| integration\_response\_parameters | Map of response parameters that can be read from the backend response. For example: response\_parameters = { method.response.header.X-Some-Header = integration.response.header.X-Some-Other-Header }. | `map(string)` | `{}` | no | +| integration\_type | Integration type of an integration. Valid values: AWS (supported only for WebSocket APIs), AWS\_PROXY, HTTP (supported only for WebSocket APIs), HTTP\_PROXY, MOCK (supported only for WebSocket APIs). | `string` | `"AWS_PROXY"` | no | +| integration\_uri | URI of the Lambda function for a Lambda proxy integration, when integration\_type is AWS\_PROXY. For an HTTP integration, specify a fully-qualified URL. | `string` | `""` | no | +| integrations | Map of API gateway routes with integrations | `map(any)` | `{}` | no | +| kms\_key\_arn | Pass existing KMS key arn. Only applicable when `create_kms_key` is set to false. | `string` | `""` | no | +| label\_order | Label order, e.g. `name`,`application`. | `list(any)` |
"$request.header.Authorization"
]
[| no | +| log\_format | Formatting and values recorded in the logs. For more information on configuring the log format rules visit the AWS documentation | `string` | `" {\n\t\"requestTime\": \"$context.requestTime\",\n\t\"requestId\": \"$context.requestId\",\n\t\"httpMethod\": \"$context.httpMethod\",\n\t\"path\": \"$context.path\",\n\t\"resourcePath\": \"$context.resourcePath\",\n\t\"status\": $context.status,\n\t\"responseLatency\": $context.responseLatency,\n \"xrayTraceId\": \"$context.xrayTraceId\",\n \"integrationRequestId\": \"$context.integration.requestId\",\n\t\"functionResponseStatus\": \"$context.integration.status\",\n \"integrationLatency\": \"$context.integration.latency\",\n\t\"integrationServiceStatus\": \"$context.integration.integrationStatus\",\n \"authorizeResultStatus\": \"$context.authorize.status\",\n\t\"authorizerServiceStatus\": \"$context.authorizer.status\",\n\t\"authorizerLatency\": \"$context.authorizer.latency\",\n\t\"authorizerRequestId\": \"$context.authorizer.requestId\",\n \"ip\": \"$context.identity.sourceIp\",\n\t\"userAgent\": \"$context.identity.userAgent\",\n\t\"principalId\": \"$context.authorizer.principalId\",\n\t\"cognitoUser\": \"$context.identity.cognitoIdentityId\",\n \"user\": \"$context.identity.user\"\n}\n"` | no | +| log\_group\_class | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS. | `string` | `"STANDARD"` | no | +| managedby | ManagedBy, eg 'CloudDrove' | `string` | `"hello@clouddrove.com"` | no | +| multi\_region | ndicates whether the KMS key is a multi-Region (true) or regional (false) key. Defaults to false. | `bool` | `false` | no | +| mutual\_tls\_authentication | An Amazon S3 URL that specifies the truststore for mutual TLS authentication as well as version, keyed at uri and version | `map(string)` | `{}` | no | +| name | Name (e.g. `app` or `api`). | `string` | `""` | no | +| passthrough\_behavior | Pass-through behavior for incoming requests based on the Content-Type header in the request, and the available mapping templates specified as the request\_templates attribute. | `string` | `"WHEN_NO_MATCH"` | no | +| private\_dns\_enabled | AWS services and AWS Marketplace partner services only) Whether or not to associate a private hosted zone with the specified VPC. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. | `bool` | `false` | no | +| protocol\_type | The API protocol. Valid values: HTTP, WEBSOCKET | `string` | `"HTTP"` | no | +| provider\_arns | required for type COGNITO\_USER\_POOLS) List of the Amazon Cognito user pool ARNs. Each element is of this format: arn:aws:cognito-idp:{region}:{account\_id}:userpool/{user\_pool\_id}. | `set(string)` | `[]` | no | +| repository | Terraform current module repo | `string` | `""` | no | +| request\_parameters | Map of request query string parameters and headers that should be passed to the backend responder | `map(string)` | `null` | no | +| request\_templates | Map of the integration's request templates. | `map(string)` | `null` | no | +| response\_models | A map of the API models used for the response's content type | `map(string)` |
"name",
"environment"
]
{
"application/json": "Empty"
} | no |
+| response\_parameters | Map of response parameters that can be sent to the caller. For example: response\_parameters { method.response.header.X-Some-Header = true } would define that the header X-Some-Header can be provided on the response | `map(bool)` | `{}` | no |
+| rest\_api\_assume\_role\_policy | Custome Trust Relationship Policy for Authorizer IAMRole. | `string` | `""` | no |
+| rest\_api\_base\_path | Path segment that must be prepended to the path when accessing the API via this mapping. If omitted, the API is exposed at the root of the given domain. | `string` | `""` | no |
+| rest\_api\_description | The description of the REST API | `string` | `"test"` | no |
+| rest\_api\_endpoint\_type | (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: EDGE, REGIONAL or PRIVATE. If unspecified, defaults to EDGE. | `string` | `null` | no |
+| rest\_api\_resource\_policy | (Optional) custom resource policy for private rest api. | `string` | `""` | no |
+| rest\_api\_stage\_name | The name of the stage | `string` | `""` | no |
+| rest\_variables | Map to set on the stage managed by the stage\_name argument. | `map(string)` | `{}` | no |
+| retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653, and 0. If you select 0, the events in the log group are always retained and never expire. | `number` | `null` | no |
+| route\_key | Part of quick create. Specifies any route key. Applicable for HTTP APIs. | `string` | `null` | no |
+| route\_selection\_expression | The route selection expression for the API. | `string` | `"$request.method $request.path"` | no |
+| route\_settings | Settings for default route | `map(string)` | `{}` | no |
+| security\_group\_ids | A list of security group IDs to associate with. | `list(string)` | `[]` | no |
+| service\_name | The service name. For AWS services the service name is usually in the form com.amazonaws.[| no | +| vpc\_endpoint\_type | The VPC endpoint type, Gateway, GatewayLoadBalancer, or Interface. Defaults to Gateway. | `string` | `"Gateway"` | no | +| vpc\_id | The ID of the VPC in which the endpoint will be used. | `string` | `""` | no | +| vpc\_links | Map of VPC Links details to create | `map(any)` | `{}` | no | +| xray\_tracing\_enabled | A flag to indicate whether to enable X-Ray tracing. | `bool` | `true` | no | +| zone\_id | The ID of the hosted zone to contain this record. | `string` | `""` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| api\_arn | The HTTP API ARN. | +| api\_endpoint | The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com. | +| api\_id | The HTTP Api ID. | +| invoke\_url | URL to invoke the API pointing to the stage | +| rest\_api\_arn | The Rest Api Arn. | +| rest\_api\_execution\_arn | Execution arn of rest api gateway. | +| rest\_api\_id | The ID of the REST API | +| rest\_api\_invoke\_url | The URL to invoke the API pointing to the stage | + diff --git a/examples/complete/http-api-gateway/example.tf b/examples/complete/http-api-gateway/example.tf new file mode 100644 index 0000000..94026e0 --- /dev/null +++ b/examples/complete/http-api-gateway/example.tf @@ -0,0 +1,112 @@ +####---------------------------------------------------------------------------------- +## PROVIDER +####---------------------------------------------------------------------------------- +provider "aws" { + region = local.region +} + +####---------------------------------------------------------------------------------- +## LOCALS +####---------------------------------------------------------------------------------- + +locals { + name = "api" + environment = "test" + region = "us-east-1" + domain_name = "clouddrove.ca" + hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" +} +####---------------------------------------------------------------------------------- +## ACM +####---------------------------------------------------------------------------------- +module "acm" { + source = "clouddrove/acm/aws" + version = "1.4.1" + + name = local.name + environment = local.environment + enable_aws_certificate = true + domain_name = local.domain_name + subject_alternative_names = ["*.${local.domain_name}"] + validation_method = "DNS" + enable_dns_validation = false +} + +####---------------------------------------------------------------------------------- +## LAMBDA +####---------------------------------------------------------------------------------- +module "lambda" { + source = "clouddrove/lambda/aws" + version = "1.3.1" + + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "../lambda_packages/index.zip" + handler = "index.lambda_handler" + runtime = "python3.8" + iam_actions = [ + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:PutLogEvents" + ] + names = [ + "python_layer" + ] + compatible_runtimes = [ + ["python3.8"] + ] + statement_ids = [ + "AllowExecutionFromApiGateway" + ] + actions = [ + "lambda:InvokeFunction" + ] + principals = [ + "apigateway.amazonaws.com" + ] + variables = { + foo = "bar" + } +} + +####---------------------------------------------------------------------------------- +## API GATEWAY +####---------------------------------------------------------------------------------- +module "api_gateway" { + source = "../../../" + + name = local.name + environment = local.environment + domain_name = "api.${local.domain_name}" + domain_name_certificate_arn = module.acm.arn + integration_uri = module.lambda.invoke_arn + zone_id = local.hosted_zone_id + auto_deploy = true + stage_name = "$default" + create_vpc_link_enabled = false + create_http_api = true + cors_configuration = { + allow_credentials = true + allow_methods = ["GET", "OPTIONS", "POST"] + max_age = 5 + } + integrations = { + "ANY /" = { + lambda_arn = module.lambda.arn + payload_format_version = "2.0" + timeout_milliseconds = 30000 + } + "GET /some-route-with-authorizer" = { + lambda_arn = module.lambda.arn + payload_format_version = "1.0" + authorizer_key = "cognito" + } + "POST /start-step-function" = { + lambda_arn = module.lambda.arn + payload_format_version = "1.0" + authorizer_key = "cognito" + } + } +} \ No newline at end of file diff --git a/_examples/complete/outputs.tf b/examples/complete/http-api-gateway/outputs.tf similarity index 58% rename from _examples/complete/outputs.tf rename to examples/complete/http-api-gateway/outputs.tf index 6fb1fbb..7025048 100644 --- a/_examples/complete/outputs.tf +++ b/examples/complete/http-api-gateway/outputs.tf @@ -1,19 +1,19 @@ output "api_id" { - value = join("", module.api_gateway.*.api_id) + value = module.api_gateway.api_id description = "The API identifier." } output "api_arn" { - value = join("", module.api_gateway.*.api_arn) + value = module.api_gateway.api_arn description = "The API arn." } output "api_endpoint" { - value = join("", module.api_gateway.*.api_endpoint) + value = module.api_gateway.api_endpoint description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com." } output "invoke_url" { - value = join("", module.api_gateway.*.invoke_url) + value = module.api_gateway.invoke_url description = "URL to invoke the API pointing to the stage" -} \ No newline at end of file +} diff --git a/examples/complete/http-api-gateway/version.tf b/examples/complete/http-api-gateway/version.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/complete/http-api-gateway/version.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/examples/complete/lambda_packages/index.py b/examples/complete/lambda_packages/index.py new file mode 100644 index 0000000..a0f3277 --- /dev/null +++ b/examples/complete/lambda_packages/index.py @@ -0,0 +1,7 @@ +import json +def lambda_handler(event, context): + print('Lambda function with Python!|') + return { + 'statusCode': 200, + 'body': json.dumps('Hello from Lambda!') + } diff --git a/examples/complete/lambda_packages/index.zip b/examples/complete/lambda_packages/index.zip new file mode 100644 index 0000000..f7f278d Binary files /dev/null and b/examples/complete/lambda_packages/index.zip differ diff --git a/examples/complete/private-rest-api-gateway/example.tf b/examples/complete/private-rest-api-gateway/example.tf new file mode 100644 index 0000000..d07b532 --- /dev/null +++ b/examples/complete/private-rest-api-gateway/example.tf @@ -0,0 +1,225 @@ +####---------------------------------------------------------------------------------- +## PROVIDER +####---------------------------------------------------------------------------------- + +provider "aws" { + region = local.region +} +####---------------------------------------------------------------------------------- +## LOCALS +####---------------------------------------------------------------------------------- + +locals { + name = "api" + environment = "test" + region = "us-east-1" + domain_name = "clouddrove.ca" + hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" +} +####---------------------------------------------------------------------------------- +## ACM +####---------------------------------------------------------------------------------- + +module "acm" { + source = "clouddrove/acm/aws" + version = "1.4.1" + + name = local.name + environment = local.environment + enable_aws_certificate = true + domain_name = local.domain_name + subject_alternative_names = ["*.${local.domain_name}"] + validation_method = "DNS" + enable_dns_validation = false +} + +####---------------------------------------------------------------------------------- +## LAMBDA +####---------------------------------------------------------------------------------- + +module "lambda" { + source = "clouddrove/lambda/aws" + version = "1.3.1" + + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "../lambda_packages/index.zip" + handler = "index.lambda_handler" + runtime = "python3.8" + iam_actions = [ + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:PutLogEvents" + ] + names = [ + "python_layer" + ] + compatible_runtimes = [ + ["python3.8"] + ] + statement_ids = [ + "AllowExecutionFromApiGateway" + ] + actions = [ + "lambda:InvokeFunction" + ] + principals = [ + "apigateway.amazonaws.com" + ] + variables = { + foo = "bar" + } +} + + +####---------------------------------------------------------------------------------- +## VPC +####---------------------------------------------------------------------------------- + +module "vpc" { + source = "clouddrove/vpc/aws" + version = "2.0.0" + + name = "${local.name}-rest-api-private" + environment = local.environment + enable = true + cidr_block = "10.0.0.0/16" + +} + +####---------------------------------------------------------------------------------- +## SUBNETS +####---------------------------------------------------------------------------------- +#tfsec:ignore:aws-ec2-no-excessive-port-access +#tfsec:ignore:aws-ec2-no-public-ingress-acl +module "subnets" { + source = "clouddrove/subnet/aws" + version = "2.0.1" + + name = "${local.name}-rest-api-private" + environment = local.environment + + nat_gateway_enabled = true + single_nat_gateway = true + availability_zones = ["${local.region}a", "${local.region}b", "${local.region}c"] + vpc_id = module.vpc.vpc_id + type = "public-private" + igw_id = module.vpc.igw_id + cidr_block = module.vpc.vpc_cidr_block + ipv6_cidr_block = module.vpc.ipv6_cidr_block + enable_ipv6 = true + private_inbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = module.vpc.vpc_cidr_block + } + ] + private_outbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = module.vpc.vpc_cidr_block + } + ] + public_inbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = "0.0.0.0/0" + } + ] + public_outbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = "0.0.0.0/0" + } + ] + +} + +####---------------------------------------------------------------------------------- +## SECURITY GROUP +####---------------------------------------------------------------------------------- + +module "security_group" { + source = "clouddrove/security-group/aws" + version = "2.0.0" + + name = "${local.name}-rest-api-private" + environment = local.environment + + vpc_id = module.vpc.vpc_id + new_sg_ingress_rules_with_cidr_blocks = [ + { + rule_count = 1 + from_port = 0 + protocol = "-1" + to_port = 0 + cidr_blocks = [module.vpc.vpc_cidr_block] + description = "Allow all traffic from ${local.environment} VPC." + } + ] + new_sg_egress_rules_with_cidr_blocks = [ + { + rule_count = 1 + from_port = 0 + protocol = "-1" + to_port = 0 + cidr_blocks = [module.vpc.vpc_cidr_block] + description = "Allow all outbound traffic." + } + ] +} + + +####---------------------------------------------------------------------------------- +## REST API PRIVATE +####---------------------------------------------------------------------------------- + +module "rest_api_private" { + source = "../../../" + + name = "${local.name}-rest-api-private" + environment = local.environment + enabled = true + create_rest_api = true + rest_api_endpoint_type = "PRIVATE" + rest_api_description = "Private REST API for ${module.lambda.name} lambda function" + integration_uri = module.lambda.invoke_arn + rest_api_stage_name = "default" + auto_deploy = true + rest_api_base_path = "test" + domain_name = "api.${local.domain_name}" + zone_id = local.hosted_zone_id + + # -- VPC Endpoint configuration + vpc_id = module.vpc.vpc_id + subnet_ids = module.subnets.private_subnet_id + security_group_ids = [module.security_group.security_group_id] + service_name = "com.amazonaws.${local.region}.execute-api" + vpc_endpoint_type = "Interface" + private_dns_enabled = true + domain_name_certificate_arn = module.acm.arn + + #---access log---- + enable_access_logs = true + retention_in_days = 7 +} + + diff --git a/examples/complete/private-rest-api-gateway/outputs.tf b/examples/complete/private-rest-api-gateway/outputs.tf new file mode 100644 index 0000000..289a67a --- /dev/null +++ b/examples/complete/private-rest-api-gateway/outputs.tf @@ -0,0 +1,21 @@ +##------------------------------------------------------------- +# REST API PRIVATE +##------------------------------------------------------------- + +output "private_rest_api_id" { + value = module.rest_api_private.rest_api_id + description = " The ID of the REST API" + +} + +output "private_rest_api_arn" { + value = module.rest_api_private.rest_api_arn + description = "The Rest api arn" + +} + +output "private_rest_api_invoke_url" { + value = module.rest_api_private.rest_api_invoke_url + description = "The URL to invoke the API pointing to the stage" + +} \ No newline at end of file diff --git a/examples/complete/private-rest-api-gateway/versions.tf b/examples/complete/private-rest-api-gateway/versions.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/complete/private-rest-api-gateway/versions.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/examples/complete/rest-api-gateway/example.tf b/examples/complete/rest-api-gateway/example.tf new file mode 100644 index 0000000..89ba1ab --- /dev/null +++ b/examples/complete/rest-api-gateway/example.tf @@ -0,0 +1,115 @@ +####---------------------------------------------------------------------------------- +## PROVIDER +####---------------------------------------------------------------------------------- +provider "aws" { + region = local.region +} + +####---------------------------------------------------------------------------------- +## LOCALS +####---------------------------------------------------------------------------------- + +locals { + name = "api" + environment = "test" + region = "us-east-1" + domain_name = "clouddrove.ca" + hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" +} +####---------------------------------------------------------------------------------- +## ACM +####---------------------------------------------------------------------------------- +module "acm" { + source = "clouddrove/acm/aws" + version = "1.4.1" + + name = local.name + environment = local.environment + enable_aws_certificate = true + domain_name = local.domain_name + subject_alternative_names = ["*.${local.domain_name}"] + validation_method = "DNS" + enable_dns_validation = false +} + +####---------------------------------------------------------------------------------- +## LAMBDA +####---------------------------------------------------------------------------------- +module "lambda" { + source = "clouddrove/lambda/aws" + version = "1.3.1" + + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "../lambda_packages/index.zip" + handler = "index.lambda_handler" + runtime = "python3.8" + iam_actions = [ + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:PutLogEvents" + ] + names = [ + "python_layer" + ] + compatible_runtimes = [ + ["python3.8"] + ] + statement_ids = [ + "AllowExecutionFromApiGateway" + ] + actions = [ + "lambda:InvokeFunction" + ] + principals = [ + "apigateway.amazonaws.com" + ] + variables = { + foo = "bar" + } +} + + +####---------------------------------------------------------------------------------- +## REST API +####---------------------------------------------------------------------------------- + +module "rest_api" { + source = "../../../" + + name = "${local.name}-rest-api" + environment = local.environment + create_rest_api = true + domain_name_certificate_arn = module.acm.arn + domain_name = "api.${local.domain_name}" + zone_id = local.hosted_zone_id + rest_api_description = "REST API for ${module.lambda.name} lambda function" + rest_api_endpoint_type = "REGIONAL" + integration_uri = module.lambda.invoke_arn + rest_api_stage_name = "default" + api_resources = { + users = { + path_part = "users" + http_method = "ANY" + uri = module.lambda.invoke_arn + + }, + cards = { + path_part = "cards" + http_method = "ANY" + uri = module.lambda.invoke_arn + } + } + + #---access log---- + enable_access_logs = true + retention_in_days = 7 +} + + + + + + diff --git a/examples/complete/rest-api-gateway/outputs.tf b/examples/complete/rest-api-gateway/outputs.tf new file mode 100644 index 0000000..a0b81f7 --- /dev/null +++ b/examples/complete/rest-api-gateway/outputs.tf @@ -0,0 +1,22 @@ +##------------------------------------------------------------- +# REST API +##------------------------------------------------------------- + +output "rest_api_id" { + value = module.rest_api.rest_api_id + description = " The ID of the REST API" + +} + +output "rest_api_arn" { + value = module.rest_api.rest_api_arn + description = "The Rest api arn" +} + +output "rest_api_invoke_url" { + value = module.rest_api.rest_api_invoke_url + description = "The URL to invoke the API pointing to the stage" + +} + + diff --git a/examples/complete/rest-api-gateway/versions.tf b/examples/complete/rest-api-gateway/versions.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/complete/rest-api-gateway/versions.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/_examples/complete/example.tf b/examples/http-api-gateway/example.tf similarity index 56% rename from _examples/complete/example.tf rename to examples/http-api-gateway/example.tf index 3a1c876..6a7f3d8 100644 --- a/_examples/complete/example.tf +++ b/examples/http-api-gateway/example.tf @@ -1,44 +1,51 @@ ####---------------------------------------------------------------------------------- -## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. +## PROVIDER ####---------------------------------------------------------------------------------- provider "aws" { - region = "eu-west-1" + region = local.region } ####---------------------------------------------------------------------------------- -## This terraform module is designed to generate consistent label names and tags for resources. +## LOCALS +####---------------------------------------------------------------------------------- + +locals { + name = "api" + environment = "test" + region = "us-east-1" + domain_name = "clouddrove.ca" + hosted_zone_id = "Z0xxxxxxxxxxxxxxEP" +} +####---------------------------------------------------------------------------------- +## ACM ####---------------------------------------------------------------------------------- module "acm" { source = "clouddrove/acm/aws" - version = "1.3.0" - - name = "certificate" - environment = "test" - label_order = ["name", "environment"] + version = "1.4.1" + name = local.name + environment = local.environment enable_aws_certificate = true - domain_name = "clouddrove.ca" - subject_alternative_names = ["*.clouddrove.ca"] + domain_name = local.domain_name + subject_alternative_names = ["*.${local.domain_name}"] validation_method = "DNS" enable_dns_validation = false } ####---------------------------------------------------------------------------------- -## This terraform module is designed to generate consistent label names and tags for resources. +## LAMBDA ####---------------------------------------------------------------------------------- module "lambda" { source = "clouddrove/lambda/aws" - version = "1.3.0" + version = "1.3.1" - name = "lambda" - environment = "test" - label_order = ["name", "environment"] - - enabled = true - timeout = 60 - filename = "./lambda_packages" - handler = "index.lambda_handler" - runtime = "python3.8" + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "../lambda_packages/index.zip" + handler = "index.lambda_handler" + runtime = "python3.8" iam_actions = [ "logs:CreateLogStream", "logs:CreateLogGroup", @@ -47,40 +54,39 @@ module "lambda" { names = [ "python_layer" ] - layer_filenames = ["./lambda-test.zip"] compatible_runtimes = [ ["python3.8"] ] statement_ids = [ - "AllowExecutionFromCloudWatch" + "AllowExecutionFromApiGateway" ] actions = [ "lambda:InvokeFunction" ] principals = [ - "events.amazonaws.com" + "apigateway.amazonaws.com" ] - source_arns = [module.api_gateway.api_arn] variables = { foo = "bar" } } ####---------------------------------------------------------------------------------- -## This terraform module is designed to generate consistent label names and tags for resources. +## API GATEWAY ####---------------------------------------------------------------------------------- module "api_gateway" { - source = "./../../" - - name = "api" - environment = "test" - label_order = ["environment", "name"] + source = "../../." - domain_name = "clouddrove.ca" + name = local.name + environment = local.environment + domain_name = "api.${local.domain_name}" domain_name_certificate_arn = module.acm.arn - integration_uri = module.lambda.arn - zone_id = "1234059QJ345674343" + integration_uri = module.lambda.invoke_arn + zone_id = local.hosted_zone_id + auto_deploy = true + stage_name = "$default" create_vpc_link_enabled = false + create_http_api = true cors_configuration = { allow_credentials = true allow_methods = ["GET", "OPTIONS", "POST"] @@ -90,16 +96,16 @@ module "api_gateway" { "ANY /" = { lambda_arn = module.lambda.arn payload_format_version = "2.0" - timeout_milliseconds = 12000 + timeout_milliseconds = 30000 } "GET /some-route-with-authorizer" = { lambda_arn = module.lambda.arn - payload_format_version = "2.0" + payload_format_version = "1.0" authorizer_key = "cognito" } "POST /start-step-function" = { lambda_arn = module.lambda.arn - payload_format_version = "2.0" + payload_format_version = "1.0" authorizer_key = "cognito" } } diff --git a/_examples/vpc_link_api/outputs.tf b/examples/http-api-gateway/outputs.tf similarity index 58% rename from _examples/vpc_link_api/outputs.tf rename to examples/http-api-gateway/outputs.tf index 6fb1fbb..7025048 100644 --- a/_examples/vpc_link_api/outputs.tf +++ b/examples/http-api-gateway/outputs.tf @@ -1,19 +1,19 @@ output "api_id" { - value = join("", module.api_gateway.*.api_id) + value = module.api_gateway.api_id description = "The API identifier." } output "api_arn" { - value = join("", module.api_gateway.*.api_arn) + value = module.api_gateway.api_arn description = "The API arn." } output "api_endpoint" { - value = join("", module.api_gateway.*.api_endpoint) + value = module.api_gateway.api_endpoint description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com." } output "invoke_url" { - value = join("", module.api_gateway.*.invoke_url) + value = module.api_gateway.invoke_url description = "URL to invoke the API pointing to the stage" -} \ No newline at end of file +} diff --git a/examples/http-api-gateway/version.tf b/examples/http-api-gateway/version.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/http-api-gateway/version.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/examples/lambda_packages/index.py b/examples/lambda_packages/index.py new file mode 100644 index 0000000..a0f3277 --- /dev/null +++ b/examples/lambda_packages/index.py @@ -0,0 +1,7 @@ +import json +def lambda_handler(event, context): + print('Lambda function with Python!|') + return { + 'statusCode': 200, + 'body': json.dumps('Hello from Lambda!') + } diff --git a/examples/lambda_packages/index.zip b/examples/lambda_packages/index.zip new file mode 100644 index 0000000..f7f278d Binary files /dev/null and b/examples/lambda_packages/index.zip differ diff --git a/examples/private-rest-api-gateway/example.tf b/examples/private-rest-api-gateway/example.tf new file mode 100644 index 0000000..1eb70b9 --- /dev/null +++ b/examples/private-rest-api-gateway/example.tf @@ -0,0 +1,225 @@ +####---------------------------------------------------------------------------------- +## PROVIDER +####---------------------------------------------------------------------------------- + +provider "aws" { + region = local.region +} +####---------------------------------------------------------------------------------- +## LOCALS +####---------------------------------------------------------------------------------- + +locals { + name = "api" + environment = "test" + region = "us-east-1" + domain_name = "clouddrove.ca" + hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" +} +####---------------------------------------------------------------------------------- +## ACM +####---------------------------------------------------------------------------------- + +module "acm" { + source = "clouddrove/acm/aws" + version = "1.4.1" + + name = local.name + environment = local.environment + enable_aws_certificate = true + domain_name = local.domain_name + subject_alternative_names = ["*.${local.domain_name}"] + validation_method = "DNS" + enable_dns_validation = false +} + +####---------------------------------------------------------------------------------- +## LAMBDA +####---------------------------------------------------------------------------------- + +module "lambda" { + source = "clouddrove/lambda/aws" + version = "1.3.1" + + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "../lambda_packages/index.zip" + handler = "index.lambda_handler" + runtime = "python3.8" + iam_actions = [ + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:PutLogEvents" + ] + names = [ + "python_layer" + ] + compatible_runtimes = [ + ["python3.8"] + ] + statement_ids = [ + "AllowExecutionFromApiGateway" + ] + actions = [ + "lambda:InvokeFunction" + ] + principals = [ + "apigateway.amazonaws.com" + ] + variables = { + foo = "bar" + } +} + + +####---------------------------------------------------------------------------------- +## VPC +####---------------------------------------------------------------------------------- + +module "vpc" { + source = "clouddrove/vpc/aws" + version = "2.0.0" + + name = "${local.name}-rest-api-private" + environment = local.environment + enable = true + cidr_block = "10.0.0.0/16" + +} + +####---------------------------------------------------------------------------------- +## SUBNETS +####---------------------------------------------------------------------------------- +#tfsec:ignore:aws-ec2-no-excessive-port-access +#tfsec:ignore:aws-ec2-no-public-ingress-acl +module "subnets" { + source = "clouddrove/subnet/aws" + version = "2.0.1" + + name = "${local.name}-rest-api-private" + environment = local.environment + + nat_gateway_enabled = true + single_nat_gateway = true + availability_zones = ["${local.region}a", "${local.region}b", "${local.region}c"] + vpc_id = module.vpc.vpc_id + type = "public-private" + igw_id = module.vpc.igw_id + cidr_block = module.vpc.vpc_cidr_block + ipv6_cidr_block = module.vpc.ipv6_cidr_block + enable_ipv6 = true + private_inbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = module.vpc.vpc_cidr_block + } + ] + private_outbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = module.vpc.vpc_cidr_block + } + ] + public_inbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = "0.0.0.0/0" + } + ] + public_outbound_acl_rules = [ + { + rule_number = 100 + rule_action = "allow" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_block = "0.0.0.0/0" + } + ] + +} + +####---------------------------------------------------------------------------------- +## SECURITY GROUP +####---------------------------------------------------------------------------------- + +module "security_group" { + source = "clouddrove/security-group/aws" + version = "2.0.0" + + name = "${local.name}-rest-api-private" + environment = local.environment + + vpc_id = module.vpc.vpc_id + new_sg_ingress_rules_with_cidr_blocks = [ + { + rule_count = 1 + from_port = 0 + protocol = "-1" + to_port = 0 + cidr_blocks = [module.vpc.vpc_cidr_block] + description = "Allow all traffic from ${local.environment} VPC." + } + ] + new_sg_egress_rules_with_cidr_blocks = [ + { + rule_count = 1 + from_port = 0 + protocol = "-1" + to_port = 0 + cidr_blocks = [module.vpc.vpc_cidr_block] + description = "Allow all outbound traffic." + } + ] +} + + +####---------------------------------------------------------------------------------- +## REST API PRIVATE +####---------------------------------------------------------------------------------- + +module "rest_api_private" { + source = "../../." + + name = "${local.name}-rest-api-private" + environment = local.environment + enabled = true + create_rest_api = true + rest_api_endpoint_type = "PRIVATE" + rest_api_description = "Private REST API for ${module.lambda.name} lambda function" + integration_uri = module.lambda.invoke_arn + rest_api_stage_name = "default" + auto_deploy = true + rest_api_base_path = "test" + domain_name = "api.${local.domain_name}" + zone_id = local.hosted_zone_id + + # -- VPC Endpoint configuration + vpc_id = module.vpc.vpc_id + subnet_ids = module.subnets.private_subnet_id + security_group_ids = [module.security_group.security_group_id] + service_name = "com.amazonaws.${local.region}.execute-api" + vpc_endpoint_type = "Interface" + private_dns_enabled = true + domain_name_certificate_arn = module.acm.arn + + #---access log---- + enable_access_logs = true + retention_in_days = 7 +} + + diff --git a/examples/private-rest-api-gateway/outputs.tf b/examples/private-rest-api-gateway/outputs.tf new file mode 100644 index 0000000..289a67a --- /dev/null +++ b/examples/private-rest-api-gateway/outputs.tf @@ -0,0 +1,21 @@ +##------------------------------------------------------------- +# REST API PRIVATE +##------------------------------------------------------------- + +output "private_rest_api_id" { + value = module.rest_api_private.rest_api_id + description = " The ID of the REST API" + +} + +output "private_rest_api_arn" { + value = module.rest_api_private.rest_api_arn + description = "The Rest api arn" + +} + +output "private_rest_api_invoke_url" { + value = module.rest_api_private.rest_api_invoke_url + description = "The URL to invoke the API pointing to the stage" + +} \ No newline at end of file diff --git a/examples/private-rest-api-gateway/versions.tf b/examples/private-rest-api-gateway/versions.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/private-rest-api-gateway/versions.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/examples/rest-api-gateway/example.tf b/examples/rest-api-gateway/example.tf new file mode 100644 index 0000000..d63d7be --- /dev/null +++ b/examples/rest-api-gateway/example.tf @@ -0,0 +1,115 @@ +####---------------------------------------------------------------------------------- +## PROVIDER +####---------------------------------------------------------------------------------- +provider "aws" { + region = local.region +} + +####---------------------------------------------------------------------------------- +## LOCALS +####---------------------------------------------------------------------------------- + +locals { + name = "api" + environment = "test" + region = "us-east-1" + domain_name = "clouddrove.ca" + hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" +} +####---------------------------------------------------------------------------------- +## ACM +####---------------------------------------------------------------------------------- +module "acm" { + source = "clouddrove/acm/aws" + version = "1.4.1" + + name = local.name + environment = local.environment + enable_aws_certificate = true + domain_name = local.domain_name + subject_alternative_names = ["*.${local.domain_name}"] + validation_method = "DNS" + enable_dns_validation = false +} + +####---------------------------------------------------------------------------------- +## LAMBDA +####---------------------------------------------------------------------------------- +module "lambda" { + source = "clouddrove/lambda/aws" + version = "1.3.1" + + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "../lambda_packages/index.zip" + handler = "index.lambda_handler" + runtime = "python3.8" + iam_actions = [ + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:PutLogEvents" + ] + names = [ + "python_layer" + ] + compatible_runtimes = [ + ["python3.8"] + ] + statement_ids = [ + "AllowExecutionFromApiGateway" + ] + actions = [ + "lambda:InvokeFunction" + ] + principals = [ + "apigateway.amazonaws.com" + ] + variables = { + foo = "bar" + } +} + + +####---------------------------------------------------------------------------------- +## REST API +####---------------------------------------------------------------------------------- + +module "rest_api" { + source = "../../." + + name = "${local.name}-rest-api" + environment = local.environment + create_rest_api = true + domain_name_certificate_arn = module.acm.arn + domain_name = "api.${local.domain_name}" + zone_id = local.hosted_zone_id + rest_api_description = "REST API for ${module.lambda.name} lambda function" + rest_api_endpoint_type = "REGIONAL" + integration_uri = module.lambda.invoke_arn + rest_api_stage_name = "default" + api_resources = { + users = { + path_part = "users" + http_method = "ANY" + uri = module.lambda.invoke_arn + + }, + cards = { + path_part = "cards" + http_method = "ANY" + uri = module.lambda.invoke_arn + } + } + + #---access log---- + enable_access_logs = true + retention_in_days = 7 +} + + + + + + diff --git a/examples/rest-api-gateway/outputs.tf b/examples/rest-api-gateway/outputs.tf new file mode 100644 index 0000000..a0b81f7 --- /dev/null +++ b/examples/rest-api-gateway/outputs.tf @@ -0,0 +1,22 @@ +##------------------------------------------------------------- +# REST API +##------------------------------------------------------------- + +output "rest_api_id" { + value = module.rest_api.rest_api_id + description = " The ID of the REST API" + +} + +output "rest_api_arn" { + value = module.rest_api.rest_api_arn + description = "The Rest api arn" +} + +output "rest_api_invoke_url" { + value = module.rest_api.rest_api_invoke_url + description = "The URL to invoke the API pointing to the stage" + +} + + diff --git a/examples/rest-api-gateway/versions.tf b/examples/rest-api-gateway/versions.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/rest-api-gateway/versions.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/_examples/vpc_link_api/example.tf b/examples/vpc_link_api/example.tf similarity index 58% rename from _examples/vpc_link_api/example.tf rename to examples/vpc_link_api/example.tf index c9c3ea2..f2884a4 100644 --- a/_examples/vpc_link_api/example.tf +++ b/examples/vpc_link_api/example.tf @@ -4,18 +4,23 @@ provider "aws" { region = "eu-west-1" } + +locals { + vpc_cidr_block = module.vpc.vpc_cidr_block + additional_cidr_block = "172.16.0.0/16" + name = "api" + environment = "test" +} ####---------------------------------------------------------------------------------- ## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center. ####---------------------------------------------------------------------------------- module "vpc" { source = "clouddrove/vpc/aws" - version = "1.3.1" - - name = "vpc" - environment = "test" - label_order = ["name", "environment"] + version = "2.0.0" - cidr_block = "172.16.0.0/16" + name = local.name + environment = local.environment + cidr_block = "172.16.0.0/16" } ####---------------------------------------------------------------------------------- @@ -24,12 +29,10 @@ module "vpc" { #tfsec:ignore:aws-ec2-no-public-ip-subnet module "public_subnets" { source = "clouddrove/subnet/aws" - version = "1.3.0" - - name = "public-subnet" - environment = "test" - label_order = ["name", "environment"] + version = "2.0.1" + name = local.name + environment = local.environment availability_zones = ["eu-west-1b", "eu-west-1c"] vpc_id = module.vpc.vpc_id cidr_block = module.vpc.vpc_cidr_block @@ -41,17 +44,92 @@ module "public_subnets" { ##---------------------------------------------------------------------------------- ## Below module will create SECURITY-GROUP and its components. ##---------------------------------------------------------------------------------- -#tfsec:ignore:aws-ec2-no-public-ingress-sgr -module "security_group" { + +# ################################################################################ +# Security Groups module call +################################################################################ + +module "ssh" { + source = "clouddrove/security-group/aws" + version = "2.0.0" + + name = local.name + environment = local.environment + vpc_id = module.vpc.vpc_id + new_sg_ingress_rules_with_cidr_blocks = [{ + rule_count = 1 + from_port = 22 + protocol = "tcp" + to_port = 22 + cidr_blocks = [local.vpc_cidr_block, local.additional_cidr_block] + description = "Allow ssh traffic." + }] + + ## EGRESS Rules + new_sg_egress_rules_with_cidr_blocks = [{ + rule_count = 1 + from_port = 22 + protocol = "tcp" + to_port = 22 + cidr_blocks = [local.vpc_cidr_block, local.additional_cidr_block] + description = "Allow ssh outbound traffic." + }] +} + +#tfsec:ignore:aws-ec2-no-public-egress-sgr +module "http_https" { source = "clouddrove/security-group/aws" version = "2.0.0" - name = "security-group" - environment = "test" - label_order = ["environment", "name"] - vpc_id = module.vpc.vpc_id - allowed_ip = ["0.0.0.0/0"] - allowed_ports = [3306] + name = local.name + environment = local.environment + vpc_id = module.vpc.vpc_id + ## INGRESS Rules + new_sg_ingress_rules_with_cidr_blocks = [{ + rule_count = 1 + from_port = 22 + protocol = "tcp" + to_port = 22 + cidr_blocks = [local.vpc_cidr_block] + description = "Allow ssh traffic." + }, + { + rule_count = 2 + from_port = 80 + protocol = "tcp" + to_port = 80 + cidr_blocks = [local.vpc_cidr_block] + description = "Allow http traffic." + }, + { + rule_count = 3 + from_port = 443 + protocol = "tcp" + to_port = 443 + cidr_blocks = [local.vpc_cidr_block] + description = "Allow https traffic." + }, + { + rule_count = 3 + from_port = 3306 + protocol = "tcp" + to_port = 3306 + cidr_blocks = [local.vpc_cidr_block] + description = "Allow https traffic." + } + ] + + ## EGRESS Rules + new_sg_egress_rules_with_cidr_blocks = [{ + rule_count = 1 + from_port = 0 + protocol = "-1" + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + description = "Allow all traffic." + } + ] } ####---------------------------------------------------------------------------------- @@ -59,12 +137,10 @@ module "security_group" { ####---------------------------------------------------------------------------------- module "acm" { source = "clouddrove/acm/aws" - version = "1.3.0" - - name = "certificate" - environment = "test" - label_order = ["name", "environment"] + version = "1.4.1" + name = local.name + environment = local.environment enable_aws_certificate = true domain_name = "clouddrove.ca" subject_alternative_names = ["*.clouddrove.ca"] @@ -77,17 +153,15 @@ module "acm" { ####---------------------------------------------------------------------------------- module "lambda" { source = "clouddrove/lambda/aws" - version = "1.3.0" - - name = "lambda" - environment = "test" - label_order = ["name", "environment"] + version = "1.3.1" - enabled = true - timeout = 60 - filename = "./lambda_packages" - handler = "index.lambda_handler" - runtime = "python3.8" + name = local.name + environment = local.environment + enable = true + timeout = 60 + filename = "./lambda_packages" + handler = "index.lambda_handler" + runtime = "python3.8" iam_actions = [ "logs:CreateLogStream", "logs:CreateLogGroup", @@ -121,17 +195,15 @@ module "lambda" { module "api_gateway" { source = "./../../" - name = "api" - environment = "test" - label_order = ["environment", "name"] - + name = local.name + environment = local.environment domain_name = "clouddrove.ca" create_vpc_link_enabled = true zone_id = "1`23456059QJZ25345678" integration_uri = module.lambda.arn domain_name_certificate_arn = module.acm.arn subnet_ids = tolist(module.public_subnets.public_subnet_id) - security_group_ids = [module.security_group.security_group_ids] + security_group_ids = [module.ssh.security_group_id, module.http_https.security_group_id] cors_configuration = { allow_credentials = true allow_methods = ["GET", "OPTIONS", "POST"] diff --git a/_examples/complete/lambda-test.zip b/examples/vpc_link_api/lambda-test.zip similarity index 100% rename from _examples/complete/lambda-test.zip rename to examples/vpc_link_api/lambda-test.zip diff --git a/_examples/complete/lambda_packages/index.py b/examples/vpc_link_api/lambda_packages/index.py similarity index 100% rename from _examples/complete/lambda_packages/index.py rename to examples/vpc_link_api/lambda_packages/index.py diff --git a/examples/vpc_link_api/outputs.tf b/examples/vpc_link_api/outputs.tf new file mode 100644 index 0000000..eef9623 --- /dev/null +++ b/examples/vpc_link_api/outputs.tf @@ -0,0 +1,19 @@ +output "api_id" { + value = join("", module.api_gateway[*].api_id) + description = "The API identifier." +} + +output "api_arn" { + value = join("", module.api_gateway[*].api_arn) + description = "The API arn." +} + +output "api_endpoint" { + value = join("", module.api_gateway[*].api_endpoint) + description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com." +} + +output "invoke_url" { + value = join("", module.api_gateway[*].invoke_url) + description = "URL to invoke the API pointing to the stage" +} \ No newline at end of file diff --git a/examples/vpc_link_api/versions.tf b/examples/vpc_link_api/versions.tf new file mode 100644 index 0000000..3f60246 --- /dev/null +++ b/examples/vpc_link_api/versions.tf @@ -0,0 +1,11 @@ +# Terraform version +terraform { + required_version = ">= 1.6.1" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.20.0" + } + } +} \ No newline at end of file diff --git a/main.tf b/main.tf index 0ca3605..0561bcc 100644 --- a/main.tf +++ b/main.tf @@ -16,9 +16,9 @@ module "labels" { ## Below resource will Manages an Amazon API Gateway Version 2 API. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_api" "default" { - count = var.enabled && var.create_api_gateway_enabled ? 1 : 0 + count = var.enabled && var.create_http_api ? 1 : 0 - name = format("%s", module.labels.id) + name = module.labels.id description = var.api_description protocol_type = var.protocol_type version = var.api_version @@ -39,19 +39,14 @@ resource "aws_apigatewayv2_api" "default" { max_age = try(cors_configuration.value.max_age, null) } } - tags = merge( - module.labels.tags, - { - "Name" = format("%s", module.labels.id) - } - ) + tags = module.labels.tags } ##---------------------------------------------------------------------------------- ## Below resource will Manages an Amazon API Gateway Version 2 domain name. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_domain_name" "default" { - count = var.enabled && var.create_api_domain_name_enabled ? 1 : 0 + count = var.enabled && var.create_api_domain_name_enabled && (var.create_http_api || var.create_rest_api) ? 1 : 0 domain_name = var.domain_name domain_name_configuration { @@ -60,6 +55,7 @@ resource "aws_apigatewayv2_domain_name" "default" { endpoint_type = "REGIONAL" security_policy = "TLS_1_2" } + dynamic "mutual_tls_authentication" { for_each = var.mutual_tls_authentication content { @@ -67,26 +63,22 @@ resource "aws_apigatewayv2_domain_name" "default" { truststore_version = lookup(mutual_tls_authentication.value.truststore_version, null) } } - tags = merge( - module.labels.tags, - { - "Name" = format("%s-domain", module.labels.id) - } - ) + + tags = module.labels.tags } ##---------------------------------------------------------------------------------- ## Below Provides a Route53 record resource. ##---------------------------------------------------------------------------------- resource "aws_route53_record" "default" { - count = var.enabled ? 1 : 0 + count = var.enabled && (var.create_http_api || var.create_rest_api) && var.rest_api_endpoint_type != "PRIVATE" ? 1 : 0 - name = join("", aws_apigatewayv2_domain_name.default.*.domain_name) + name = join("", aws_apigatewayv2_domain_name.default[*].domain_name) type = "A" zone_id = var.zone_id alias { - name = join("", aws_apigatewayv2_domain_name.default.*.domain_name_configuration[0].*.target_domain_name) - zone_id = join("", aws_apigatewayv2_domain_name.default.*.domain_name_configuration[0].*.hosted_zone_id) + name = join("", aws_apigatewayv2_domain_name.default[*].domain_name_configuration[0].target_domain_name) + zone_id = join("", aws_apigatewayv2_domain_name.default[*].domain_name_configuration[0].hosted_zone_id) evaluate_target_health = false } } @@ -94,12 +86,14 @@ resource "aws_route53_record" "default" { ##---------------------------------------------------------------------------------- ## Below Manages an Amazon API Gateway Version 2 stage. ##---------------------------------------------------------------------------------- +#tfsec:ignore:aws-api-gateway-enable-access-logging resource "aws_apigatewayv2_stage" "default" { - count = var.enabled && var.create_default_stage_enabled ? 1 : 0 + count = var.enabled && var.create_default_stage_enabled && var.create_http_api ? 1 : 0 api_id = aws_apigatewayv2_api.default[0].id - name = format("%s-stage", module.labels.id) - auto_deploy = false + name = var.stage_name != null ? var.stage_name : format("%s-stage", module.labels.id) + auto_deploy = var.auto_deploy + dynamic "access_log_settings" { for_each = var.access_log_settings content { @@ -107,6 +101,7 @@ resource "aws_apigatewayv2_stage" "default" { format = var.default_stage_access_log_format } } + dynamic "default_route_settings" { for_each = var.default_route_settings @@ -119,6 +114,7 @@ resource "aws_apigatewayv2_stage" "default" { throttling_rate_limit = lookup(default_route_settings.value.throttling_rate_limit, null) } } + dynamic "route_settings" { for_each = var.route_settings content { @@ -130,30 +126,26 @@ resource "aws_apigatewayv2_stage" "default" { throttling_rate_limit = lookup(route_settings.value, "throttling_rate_limit", null) } } - tags = merge( - module.labels.tags, - { - "Name" = format("%s-stage", module.labels.id) - } - ) + + tags = module.labels.tags } ##---------------------------------------------------------------------------------- ## Below resource will Manages an Amazon API Gateway Version 2 API mapping. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_api_mapping" "default" { - count = var.enabled && var.apigatewayv2_api_mapping_enabled ? 1 : 0 + count = var.enabled && var.apigatewayv2_api_mapping_enabled && var.create_http_api ? 1 : 0 - api_id = join("", aws_apigatewayv2_api.default.*.id) - domain_name = join("", aws_apigatewayv2_domain_name.default.*.id) - stage = join("", aws_apigatewayv2_stage.default.*.id) + api_id = join("", aws_apigatewayv2_api.default[*].id) + domain_name = join("", aws_apigatewayv2_domain_name.default[*].id) + stage = join("", aws_apigatewayv2_stage.default[*].id) } ##---------------------------------------------------------------------------------- ## Below resource will Manages an Amazon API Gateway Version 2 route. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_route" "default" { - for_each = var.enabled && var.create_routes_and_integrations_enabled ? var.integrations : {} + for_each = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? var.integrations : {} api_id = aws_apigatewayv2_api.default[0].id route_key = each.key @@ -165,29 +157,31 @@ resource "aws_apigatewayv2_route" "default" { model_selection_expression = try(each.value.model_selection_expression, null) operation_name = try(each.value.operation_name, null) route_response_selection_expression = try(each.value.route_response_selection_expression, null) - target = "integrations/${join("", aws_apigatewayv2_integration.default.*.id)}" + target = "integrations/${(aws_apigatewayv2_integration.default[each.key].id)}" } ##---------------------------------------------------------------------------------- ## Below resource will Manages an Amazon API Gateway Version 2 integration. ##---------------------------------------------------------------------------------- + resource "aws_apigatewayv2_integration" "default" { - count = var.enabled && var.create_routes_and_integrations_enabled ? 1 : 0 + for_each = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? var.integrations : {} - api_id = join("", aws_apigatewayv2_api.default.*.id) - integration_type = var.integration_type - connection_type = var.connection_type - description = var.integration_description - integration_method = var.integration_method - integration_uri = var.integration_uri - passthrough_behavior = var.passthrough_behavior + api_id = join("", aws_apigatewayv2_api.default[*].id) + integration_type = var.integration_type + connection_type = var.connection_type + description = var.integration_description + integration_method = var.integration_method + integration_uri = var.integration_uri + passthrough_behavior = var.passthrough_behavior + payload_format_version = try(each.value.payload_format_version, null) } ##---------------------------------------------------------------------------------- ## Below resource will Manages an Amazon API Gateway Version 2 authorizer. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_authorizer" "default" { - for_each = var.enabled && var.create_routes_and_integrations_enabled ? var.authorizers : {} + for_each = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? var.authorizers : {} api_id = aws_apigatewayv2_api.default[0].id authorizer_type = lookup(each.value.authorizer_type, null) @@ -204,24 +198,20 @@ resource "aws_apigatewayv2_authorizer" "default" { ## Below resource will Manages an Amazon API Gateway Version 2 VPC Link. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_vpc_link" "default" { - for_each = var.enabled && var.create_vpc_link_enabled ? var.vpc_links : {} + for_each = var.enabled && var.create_vpc_link_enabled && var.create_http_api ? var.vpc_links : {} name = format("%s", module.labels.id) security_group_ids = var.security_group_ids subnet_ids = var.subnet_ids - tags = merge( - module.labels.tags, - { - "Name" = format("%s-vpc-link", module.labels.id) - } - ) + tags = module.labels.tags + } ##---------------------------------------------------------------------------------- ## Below resource will Manages an Amazon API Gateway Version 2 authorizer. ##---------------------------------------------------------------------------------- resource "aws_apigatewayv2_authorizer" "some_authorizer" { - count = var.enabled && var.create_routes_and_integrations_enabled ? 1 : 0 + count = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? 1 : 0 api_id = aws_apigatewayv2_api.default[0].id authorizer_type = var.authorizer_type @@ -238,4 +228,386 @@ resource "aws_apigatewayv2_authorizer" "some_authorizer" { ##---------------------------------------------------------------------------------- resource "aws_cognito_user_pool" "default" { name = module.labels.id -} \ No newline at end of file +} + +##---------------------------------------------------------------------------------- +## Below resource will Provides a REST API resource. +##---------------------------------------------------------------------------------- +resource "aws_api_gateway_rest_api" "rest_api" { + count = var.enabled && var.create_rest_api ? 1 : 0 + + name = module.labels.id + description = var.rest_api_description + tags = module.labels.tags + + endpoint_configuration { + types = [var.rest_api_endpoint_type] + vpc_endpoint_ids = var.rest_api_endpoint_type == "PRIVATE" ? (var.create_vpc_endpoint ? [aws_vpc_endpoint.rest_api_private[0].id] : var.vpc_endpoint_id) : null + } +} + +##-------------------------------------------------------------------------------- +# Resource Policy for [aws_api_gateway_rest_api.rest_api] +##-------------------------------------------------------------------------------- +resource "aws_api_gateway_rest_api_policy" "rest_api_resource_policy" { + count = var.enabled && var.create_rest_api && var.rest_api_endpoint_type == "PRIVATE" ? 1 : 0 + + rest_api_id = aws_api_gateway_rest_api.rest_api[0].id + policy = var.rest_api_resource_policy != "" ? var.rest_api_resource_policy : <
""
]