Skip to content

Commit 61f7517

Browse files
derekdowlingderekdowling
authored
Merge pull request #1 from togethercomputer/derek/eng-26466-setup-ecr-lambda-tf-module
Add tf code for re-usable Lambda ECR infra combo
2 parents 6c60630 + 1d8943a commit 61f7517

10 files changed

+645
-2
lines changed

‎.github/workflows/approve-emergency.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Approve Emergency Pull Request
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, edited, synchronize, labeled]
6+
branches:
7+
- main
8+
9+
defaults:
10+
run:
11+
shell: bash
12+
working-directory: ./approve_emergency
13+
14+
jobs:
15+
approve_emergency:
16+
if: ${{ vars.ACTIONS_ENABLED == 'true' }}
17+
uses: togethercomputer/github-actions-test/.github/workflows/approve-emergency.yaml@main
18+
secrets: inherit

‎.github/workflows/auto-merge-init-pr.yaml

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: Auto-merge Initialization PR created via Terraform
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
7+
permissions:
8+
contents: write
9+
pull-requests: write
10+
issues: read
11+
12+
env:
13+
GITHUB_TOKEN: ${{ secrets.ROBOT_GITHUB_TOKEN }}
14+
TRIGGER_TITLE_PREFIX: "[INITIALIZE]"
15+
TRIGGER_BODY_MARKER: "<!-- INIT_PR_MARKER: DO_NOT_TOUCH -->"
16+
17+
jobs:
18+
init_repo:
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- name: Check if this is the INIT PR
23+
id: check_init_pr
24+
run: |
25+
TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
26+
BODY=$(jq -r '.pull_request.body' "$GITHUB_EVENT_PATH")
27+
28+
if [[ "$TITLE" == "${{ env.TRIGGER_TITLE_PREFIX }}"* && "$BODY" == *"${{ env.TRIGGER_BODY_MARKER }}"* ]]; then
29+
echo "INIT_PR=true" >> $GITHUB_ENV
30+
echo "INIT PR detected."
31+
else
32+
echo "INIT_PR=false" >> $GITHUB_ENV
33+
echo "Not the INIT PR, skipping approval and merge."
34+
fi
35+
36+
- name: Set repo variable to enable other actions to run
37+
if: env.INIT_PR == 'true'
38+
run: |
39+
gh variable set ACTIONS_ENABLED --body "true" --repo https://github.com/${{ github.repository }}
40+
41+
- name: Fetch PR Author
42+
if: env.INIT_PR == 'true'
43+
id: pr_author
44+
run: |
45+
set -x
46+
AUTHOR=$(jq -r '.pull_request.user.login' "$GITHUB_EVENT_PATH")
47+
echo "PR_AUTHOR=$AUTHOR" >> $GITHUB_ENV
48+
49+
- name: Check if Author is in togethercomputer/tech-ops
50+
if: env.INIT_PR == 'true'
51+
id: check_team
52+
run: |
53+
set -x
54+
ORG_NAME="togethercomputer"
55+
TEAM_SLUG="tech-ops"
56+
AUTHOR="$PR_AUTHOR"
57+
58+
MEMBERS=$(curl -s -H "Authorization: Bearer ${{ secrets.ROBOT_GITHUB_TOKEN }}" \
59+
-H "Accept: application/vnd.github+json" \
60+
"https://api.github.com/orgs/$ORG_NAME/teams/$TEAM_SLUG/members" | jq -r '.[].login')
61+
62+
if echo "$MEMBERS" | grep -q "^$AUTHOR$"; then
63+
echo "User is in togethercomputer/tech-ops"
64+
echo "APPROVE_PR=true" >> $GITHUB_ENV
65+
else
66+
echo "User is NOT in togethercomputer/tech-ops. Exiting."
67+
exit 1
68+
fi
69+
70+
- name: Approve PR
71+
if: env.APPROVE_PR == 'true'
72+
run: |
73+
gh pr review --approve https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}
74+
75+
- name: Merge PR
76+
if: env.APPROVE_PR == 'true'
77+
run: |
78+
gh pr merge --squash --admin https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}
79+
80+
- name: Remove This Workflow After init PR merged
81+
if: env.APPROVE_PR == 'true'
82+
run: |
83+
git config --global user.name "together-robot"
84+
git config --global user.email "together-robot@users.noreply.github.com"
85+
86+
# Clone the repo
87+
git clone https://x-access-token:${{ secrets.ROBOT_GITHUB_TOKEN }}@github.com/${{ github.repository }} repo
88+
cd repo
89+
90+
# Remove the workflow file
91+
rm -f .github/workflows/auto-merge-init-pr.yaml
92+
93+
# Commit and push the change
94+
git commit -am 'Cleanup: Remove initialization workflow after merging PR'
95+
git push origin main

‎.github/workflows/label-pr-size.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Label Pull Request with T-shirt Size
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, edited, synchronize]
6+
branches:
7+
- main
8+
9+
defaults:
10+
run:
11+
shell: bash
12+
working-directory: ./label-pr-size
13+
14+
jobs:
15+
label_pr_size:
16+
if: ${{ vars.ACTIONS_ENABLED == 'true' }}
17+
uses: togethercomputer/github-actions-test/.github/workflows/label-pr-size.yaml@main
18+
secrets: inherit

‎.github/workflows/linear-pr-checker.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Linear PR Checker
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, edited, synchronize]
6+
branches:
7+
- main
8+
9+
defaults:
10+
run:
11+
shell: bash
12+
working-directory: ./pr_checker
13+
14+
jobs:
15+
linear_pr_checker:
16+
if: ${{ vars.ACTIONS_ENABLED == 'true' }}
17+
uses: togethercomputer/tools/.github/workflows/pr_checker.yml@main
18+
secrets: inherit

‎.github/workflows/main-merge.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Main Merge
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
jobs:
9+
version-bump:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
with:
14+
fetch-depth: '0'
15+
- name: Bump version and push tag
16+
id: bump
17+
uses: anothrNick/github-tag-action@v1
18+
env:
19+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20+
WITH_V: true
21+

‎README.md

+72-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,72 @@
1-
# td-mod-ecr-image-lambda
2-
A terraform module for setting up a Lambda that runs an ECR Image
1+
<!-- BEGIN_TF_DOCS -->
2+
# Terraform Lambda ECR Module
3+
4+
This module creates an ECR repository and Lambda function with image configuration.
5+
It's designed to work with CI/CD pipelines for image updates.
6+
7+
## Requirements
8+
9+
| Name | Version |
10+
|------|---------|
11+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.7.0 |
12+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.64.0 |
13+
14+
## Providers
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.94.1 |
19+
20+
## Modules
21+
22+
No modules.
23+
24+
## Resources
25+
26+
| Name | Type |
27+
|------|------|
28+
| [aws_cloudwatch_log_group.lambda_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
29+
| [aws_ecr_lifecycle_policy.lambda_repo](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy) | resource |
30+
| [aws_ecr_repository.lambda_repo](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource |
31+
| [aws_ecr_repository_policy.lambda_repo](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy) | resource |
32+
| [aws_iam_policy.lambda_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
33+
| [aws_iam_role.lambda_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
34+
| [aws_iam_role_policy.lambda_ecr_pull](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
35+
| [aws_iam_role_policy_attachment.lambda_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
36+
| [aws_iam_role_policy_attachment.lambda_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
37+
| [aws_lambda_function.function](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
38+
39+
## Inputs
40+
41+
| Name | Description | Type | Default | Required |
42+
|------|-------------|------|---------|:--------:|
43+
| <a name="input_ecr_repository_name"></a> [ecr\_repository\_name](#input\_ecr\_repository\_name) | Name of the ECR repository | `string` | n/a | yes |
44+
| <a name="input_encryption_type"></a> [encryption\_type](#input\_encryption\_type) | The encryption type to use for the repository. Valid values are AES256 or KMS | `string` | `"AES256"` | no |
45+
| <a name="input_environment_variables"></a> [environment\_variables](#input\_environment\_variables) | Environment variables for the Lambda function | `map(string)` | `{}` | no |
46+
| <a name="input_function_name"></a> [function\_name](#input\_function\_name) | Name of the Lambda function | `string` | n/a | yes |
47+
| <a name="input_image_tag_mutability"></a> [image\_tag\_mutability](#input\_image\_tag\_mutability) | The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE | `string` | `"MUTABLE"` | no |
48+
| <a name="input_initial_image_uri"></a> [initial\_image\_uri](#input\_initial\_image\_uri) | Initial image URI to use for Lambda function | `string` | `""` | no |
49+
| <a name="input_log_retention_days"></a> [log\_retention\_days](#input\_log\_retention\_days) | Number of days to retain Lambda function logs | `number` | `14` | no |
50+
| <a name="input_memory_size"></a> [memory\_size](#input\_memory\_size) | Amount of memory in MB your Lambda Function can use at runtime | `number` | `128` | no |
51+
| <a name="input_non_release_image_retention_count"></a> [non\_release\_image\_retention\_count](#input\_non\_release\_image\_retention\_count) | The number of images to keep in the repository | `number` | `50` | no |
52+
| <a name="input_release_image_retention_count"></a> [release\_image\_retention\_count](#input\_release\_image\_retention\_count) | The number of images to keep in the repository with v-prefixed tags | `number` | `100` | no |
53+
| <a name="input_scan_on_push"></a> [scan\_on\_push](#input\_scan\_on\_push) | Indicates whether images are scanned after being pushed to the repository | `bool` | `true` | no |
54+
| <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | List of security group IDs associated with the Lambda function (VPC) | `list(string)` | `null` | no |
55+
| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | List of subnet IDs associated with the Lambda function (VPC) | `list(string)` | `null` | no |
56+
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
57+
| <a name="input_timeout"></a> [timeout](#input\_timeout) | The amount of time your Lambda Function has to run in seconds | `number` | `30` | no |
58+
59+
## Outputs
60+
61+
| Name | Description |
62+
|------|-------------|
63+
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | The ARN of the CloudWatch log group |
64+
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | The name of the CloudWatch log group |
65+
| <a name="output_ecr_repository_arn"></a> [ecr\_repository\_arn](#output\_ecr\_repository\_arn) | The ARN of the ECR repository |
66+
| <a name="output_ecr_repository_url"></a> [ecr\_repository\_url](#output\_ecr\_repository\_url) | The URL of the ECR repository |
67+
| <a name="output_lambda_function_arn"></a> [lambda\_function\_arn](#output\_lambda\_function\_arn) | The ARN of the Lambda function |
68+
| <a name="output_lambda_function_invoke_arn"></a> [lambda\_function\_invoke\_arn](#output\_lambda\_function\_invoke\_arn) | The invoke ARN of the Lambda function |
69+
| <a name="output_lambda_function_name"></a> [lambda\_function\_name](#output\_lambda\_function\_name) | The name of the Lambda function |
70+
| <a name="output_lambda_function_role_arn"></a> [lambda\_function\_role\_arn](#output\_lambda\_function\_role\_arn) | The ARN of the IAM role created for the Lambda function |
71+
| <a name="output_lambda_function_role_name"></a> [lambda\_function\_role\_name](#output\_lambda\_function\_role\_name) | The name of the IAM role created for the Lambda function |
72+
<!-- END_TF_DOCS -->

0 commit comments

Comments
 (0)