✔ ~/src/old_tf
11:36 $ terraform --version
Terraform v0.13.4
+ provider registry.terraform.io/hashicorp/aws v3.16.0
Your version of Terraform is out of date! The latest version
is 0.14.4. You can update by downloading from https://www.terraform.io/downloads.html
✔ ~/src/old_tf
11:36 $ cat main.tf
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "3.16.0"
}
}
}
resource "aws_iam_role" "iam_for_lambda" {
name = "iam_for_lambda"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}
resource "aws_lambda_function" "part_sync" {
function_name = "part-sync1"
role = aws_iam_role.iam_for_lambda.arn
handler = "index.snsChangeDataHandler"
runtime = "python3.8"
filename = "x.zip"
source_code_hash = filebase64sha256("x.zip")
}
11:35 $ terraform init
Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/aws versions matching "3.16.0"...
- Installing hashicorp/aws v3.16.0...
- Installed hashicorp/aws v3.16.0 (signed by HashiCorp)
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
✔ ~/src/old_tf
11:35 $ terraform apply
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# aws_iam_role.iam_for_lambda will be created
+ resource "aws_iam_role" "iam_for_lambda" {
+ arn = (known after apply)
+ assume_role_policy = jsonencode(
{
+ Statement = [
+ {
+ Action = "sts:AssumeRole"
+ Effect = "Allow"
+ Principal = {
+ Service = "lambda.amazonaws.com"
}
+ Sid = ""
},
]
+ Version = "2012-10-17"
}
)
+ create_date = (known after apply)
+ force_detach_policies = false
+ id = (known after apply)
+ max_session_duration = 3600
+ name = "iam_for_lambda"
+ path = "/"
+ unique_id = (known after apply)
}
# aws_lambda_function.part_sync will be created
+ resource "aws_lambda_function" "part_sync" {
+ arn = (known after apply)
+ filename = "x.zip"
+ function_name = "part-sync1"
+ handler = "index.snsChangeDataHandler"
+ id = (known after apply)
+ invoke_arn = (known after apply)
+ last_modified = (known after apply)
+ memory_size = 128
+ publish = false
+ qualified_arn = (known after apply)
+ reserved_concurrent_executions = -1
+ role = (known after apply)
+ runtime = "python3.8"
+ source_code_hash = "J/EMUoQgejMJXOzGMFkOOexm+oDGTyQEEVRZOv95HWQ="
+ source_code_size = (known after apply)
+ timeout = 3
+ version = (known after apply)
+ tracing_config {
+ mode = (known after apply)
}
}
Plan: 2 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
aws_iam_role.iam_for_lambda: Creating...
aws_iam_role.iam_for_lambda: Creation complete after 1s [id=iam_for_lambda]
aws_lambda_function.part_sync: Creating...
aws_lambda_function.part_sync: Still creating... [10s elapsed]
aws_lambda_function.part_sync: Creation complete after 17s [id=part-sync1]
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
with policy to my IAM user who has in
Adminalready. In IAMDenyoverrides the allow, so the policy will deny me that particular API call.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "lambda:GetCodeSigningConfig", "Resource": "*" } ] }