lambda_permissions.tf

lambda_permissions.tf

################################################################################
# AWS Lambda IAM Policy document definitions
################################################################################

data "aws_iam_policy_document" "this" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:Get*",
      "s3:List*",
      "s3:Describe*",
      "s3:RestoreObject",
    ]

    resources = [
      "*",
    ]
  }

  # Required if Lambda is created inside VPC
  statement {
    effect = "Allow"

    actions = [
      "ec2:DescribeNetworkInterfaces",
      "ec2:CreateNetworkInterface",
      "ec2:DeleteNetworkInterface",
    ]

    resources = [
      "*",
    ]
  }

  # Required if lambda requires specific Secrets from AWS SSM
  statement {
    effect = "Allow"

    actions = [
      "ssm:GetParameter",
    ]

    resources = [
      "${aws_ssm_parameter.redshift_lambda_db_password.arn}",
    ]
  }

  # Required if using encrypted data
  statement {
    effect = "Allow"

    actions = [
      "kms:ListKeys",
      "kms:Encrypt",
      "kms:Decrypt",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "sns:Publish",
    ]

    resources = [
      "${aws_sns_topic.lambda_sns_dql.arn}",
    ]
  }
}