From 045f8a5fc64f08a3fc1d701ad2d6b776623a4f4d Mon Sep 17 00:00:00 2001 From: Yuto Nakamura Date: Mon, 29 Aug 2022 17:37:33 +0900 Subject: [PATCH] feat: Add option to enable access log for API gateway --- README.md | 1 + main.tf | 19 ++++++++++--------- modules/webhook/README.md | 1 + modules/webhook/main.tf | 9 ++++++++- modules/webhook/variables.tf | 11 ++++++++++- variables.tf | 8 ++++++++ 6 files changed, 38 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 19cf7fa98e..fe6bef7f06 100644 --- a/README.md +++ b/README.md @@ -481,6 +481,7 @@ In case the setup does not work as intended follow the trace of events: | [userdata\_pre\_install](#input\_userdata\_pre\_install) | Script to be ran before the GitHub Actions runner is installed on the EC2 instances | `string` | `""` | no | | [userdata\_template](#input\_userdata\_template) | Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored. | `string` | `null` | no | | [vpc\_id](#input\_vpc\_id) | The VPC for security groups of the action runners. | `string` | n/a | yes | +| [webhook\_lambda\_apigateway\_access\_log\_settings](#input\_webhook\_lambda\_apigateway\_access\_log\_settings) | n/a | 
object({
    destination_arn = string
    format          = string
  })
| `null` | no | | [webhook\_lambda\_s3\_key](#input\_webhook\_lambda\_s3\_key) | S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas. | `any` | `null` | no | | [webhook\_lambda\_s3\_object\_version](#input\_webhook\_lambda\_s3\_object\_version) | S3 object version for webhook lambda function. Useful if S3 versioning is enabled on source bucket. | `any` | `null` | no | | [webhook\_lambda\_timeout](#input\_webhook\_lambda\_timeout) | Time out of the webhook lambda in seconds. | `number` | `10` | no | diff --git a/main.tf b/main.tf index 3a3525bd3b..e3a5277f0f 100644 --- a/main.tf +++ b/main.tf @@ -100,15 +100,16 @@ module "webhook" { sqs_build_queue_fifo = var.fifo_build_queue github_app_webhook_secret_arn = module.ssm.parameters.github_app_webhook_secret.arn - lambda_s3_bucket = var.lambda_s3_bucket - webhook_lambda_s3_key = var.webhook_lambda_s3_key - webhook_lambda_s3_object_version = var.webhook_lambda_s3_object_version - lambda_runtime = var.lambda_runtime - lambda_architecture = var.lambda_architecture - lambda_zip = var.webhook_lambda_zip - lambda_timeout = var.webhook_lambda_timeout - logging_retention_in_days = var.logging_retention_in_days - logging_kms_key_id = var.logging_kms_key_id + lambda_s3_bucket = var.lambda_s3_bucket + webhook_lambda_s3_key = var.webhook_lambda_s3_key + webhook_lambda_s3_object_version = var.webhook_lambda_s3_object_version + webhook_lambda_apigateway_access_log_settings = var.webhook_lambda_apigateway_access_log_settings + lambda_runtime = var.lambda_runtime + lambda_architecture = var.lambda_architecture + lambda_zip = var.webhook_lambda_zip + lambda_timeout = var.webhook_lambda_timeout + logging_retention_in_days = var.logging_retention_in_days + logging_kms_key_id = var.logging_kms_key_id # labels enable_workflow_job_labels_check = var.runner_enable_workflow_job_labels_check diff --git a/modules/webhook/README.md b/modules/webhook/README.md index 5b5436699f..b2b80413f0 100644 --- a/modules/webhook/README.md +++ b/modules/webhook/README.md @@ -95,6 +95,7 @@ No modules. | [sqs\_build\_queue](#input\_sqs\_build\_queue) | SQS queue to publish accepted build events. | 
object({
    id  = string
    arn = string
  })
| n/a | yes | | [sqs\_build\_queue\_fifo](#input\_sqs\_build\_queue\_fifo) | Enable a FIFO queue to remain the order of events received by the webhook. Suggest to set to true for repo level runners. | `bool` | `false` | no | | [tags](#input\_tags) | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)` | `{}` | no | +| [webhook\_lambda\_apigateway\_access\_log\_settings](#input\_webhook\_lambda\_apigateway\_access\_log\_settings) | Access log settings for webhook API gateway. | 
object({
    destination_arn = string
    format          = string
  })
| `null` | no | | [webhook\_lambda\_s3\_key](#input\_webhook\_lambda\_s3\_key) | S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas. | `any` | `null` | no | | [webhook\_lambda\_s3\_object\_version](#input\_webhook\_lambda\_s3\_object\_version) | S3 object version for webhook lambda function. Useful if S3 versioning is enabled on source bucket. | `any` | `null` | no | | [workflow\_job\_labels\_check\_all](#input\_workflow\_job\_labels\_check\_all) | If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ label matches it will trigger the webhook. `enable_workflow_job_labels_check` must be true for this to take effect. | `bool` | `true` | no | diff --git a/modules/webhook/main.tf b/modules/webhook/main.tf index b330913158..01e6387682 100644 --- a/modules/webhook/main.tf +++ b/modules/webhook/main.tf @@ -29,7 +29,14 @@ resource "aws_apigatewayv2_stage" "webhook" { api_id = aws_apigatewayv2_api.webhook.id name = "$default" auto_deploy = true - tags = var.tags + dynamic "access_log_settings" { + for_each = var.webhook_lambda_apigateway_access_log_settings[*] + content { + destination_arn = access_log_settings.value.destination_arn + format = access_log_settings.value.format + } + } + tags = var.tags } resource "aws_apigatewayv2_integration" "webhook" { diff --git a/modules/webhook/variables.tf b/modules/webhook/variables.tf index 3ab9164996..7824354323 100644 --- a/modules/webhook/variables.tf +++ b/modules/webhook/variables.tf @@ -89,6 +89,15 @@ variable "webhook_lambda_s3_object_version" { default = null } +variable "webhook_lambda_apigateway_access_log_settings" { + description = "Access log settings for webhook API gateway." + type = object({ + destination_arn = string + format = string + }) + default = null +} + variable "repository_white_list" { description = "List of repositories allowed to use the github app" type = list(string) @@ -177,4 +186,4 @@ variable "lambda_architecture" { condition = contains(["arm64", "x86_64"], var.lambda_architecture) error_message = "`lambda_architecture` value is not valid, valid values are: `arm64` and `x86_64`." } -} \ No newline at end of file +} diff --git a/variables.tf b/variables.tf index 7c45e06179..cc6b70aca7 100644 --- a/variables.tf +++ b/variables.tf @@ -302,6 +302,14 @@ variable "webhook_lambda_s3_object_version" { default = null } +variable "webhook_lambda_apigateway_access_log_settings" { + type = object({ + destination_arn = string + format = string + }) + default = null +} + variable "runners_lambda_s3_key" { description = "S3 key for runners lambda function. Required if using S3 bucket to specify lambdas." default = null