shuaibiyy/haproxy-config-generator

HAProxy Configuration Generator Using AWS Lambda, API Gateway and Terraform.

haproxy-config-generator's Issues

Programmatically give API Gateway permission to invoke Lambda

I know this was an example and from a while ago, but your terraform config helped me a great deal, so I thought I would contribute.

You can fix the bug you identified in your blog post where the API Gateway doesn't have access to invoke the Lambda function by specifying the InvokeFunction the permission in a policy, attaching that policy to a role and then using that role as the integration credentials.

Below is the snippet of terraform configuration. Note: there are references to snippets not included, but should be easy enough to incorporate into your config.

resource "aws_iam_role" "iam_for_apigw" {
    name                = "LambdaRole_TF"
    path                = "/service-role/"
    assume_role_policy  = <<EOF
{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "sts:AssumeRole",
                "Principal": {
                    "Service": "apigateway.amazonaws.com"
                },
                "Effect": "Allow",
                "Sid": ""
            }
        ]
}
EOF
}

resource "aws_iam_policy" "allow_invoke_lambda" {
    name        = "invokeLambda_TF"
    description = "Permits Invoking Lambda - deployed by Terraform"
    path        = "/service-role/"
    policy      = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "lambda:InvokeFunction"
            "Resource": "*"
        }    
    ]
}
EOF
}

resource "aws_iam_policy_attachment" "attach_lambdaInvoking" {
    name        = "invokingLambdaAttachment_TF"
    roles       = ["${aws_iam_role.iam_for_apigw.name}"]
    policy_arn  = "${aws_iam_policy.allow_invoke_lambda.arn}"
}

resource "aws_api_gateway_integration" "lambda_api_integration" {
    rest_api_id             = "${aws_api_gateway_rest_api.api.id}"
    resource_id             = "${aws_api_gateway_resource.resource.id}"
    http_method             = "${aws_api_gateway_method.method.http_method}"
    integration_http_method = "POST"
    type                    = "AWS_PROXY"
    uri                     = "arn:aws:apigateway:${var.myregion}:lambda:path/2015-03-31/functions/${aws_lambda_function.lambda.arn}/invocations"
    credentials             = "${aws_iam_role.iam_for_apigw.arn}"
    depends_on              = ["aws_api_gateway_method.POST_method"]
}