Skip to content

Commit f9417e4

Browse files
author
kfc-manager
committed
enha: made rate limiting of routes optional (#5)
1 parent a8c5e68 commit f9417e4

File tree

4 files changed

+143
-18
lines changed

4 files changed

+143
-18
lines changed

‎README.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ This module provides an API Gateway with the option to define routes which invok
4040
| method | String of the HTTP method. Valid values: 'GET', 'POST', 'DELETE', 'PUT', 'PATCH', 'OPTIONS', 'HEAD', 'CONNECT', 'TRACE'. | `string` | n/a | yes |
4141
| function_arn | ARN of the Lambda function that will be invoked by the route. | `string` | n/a | yes |
4242
| invoke_arn | Invoke ARN of the Lambda function that will be invoked by the route. | `string` | n/a | yes |
43-
| burst_limit | Throttling burst limit for the route. | `number` | n/a | yes |
44-
| rate_limit | Throttling rate limit for the route. | `number` | n/a | yes |
43+
| burst_limit | Throttling burst limit for the route. | `number` | null | no |
44+
| rate_limit | Throttling rate limit for the route. | `number` | null | no |
4545

4646
### `log_config`
4747

@@ -87,8 +87,6 @@ module "api" {
8787
method = "DELETE"
8888
function_arn = "arn:aws:lambda:test"
8989
invoke_arn = "arn:aws:apigateway:test"
90-
burst_limit = 1000
91-
rate_limit = 0.01
9290
},
9391
{
9492
route = "/foo"

‎main.tf‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ resource "aws_acm_certificate_validation" "main" {
5252
resource "aws_cloudwatch_log_group" "main" {
5353
count = var.log_config != null ? 1 : 0
5454
name = "${var.identifier}-api-gw"
55-
retention_in_days = try(var.log_config["retention_in_days"], null)
55+
retention_in_days = var.log_config["retention_in_days"]
5656

5757
tags = var.tags
5858
}
@@ -81,9 +81,9 @@ resource "aws_apigatewayv2_api" "main" {
8181
dynamic "cors_configuration" {
8282
for_each = var.cors_config != null ? [1] : []
8383
content {
84-
allow_methods = try(var.cors_config["allow_methods"], null)
85-
allow_origins = try(var.cors_config["allow_origins"], null)
86-
allow_headers = try(var.cors_config["allow_headers"], null)
84+
allow_methods = var.cors_config["allow_methods"]
85+
allow_origins = var.cors_config["allow_origins"]
86+
allow_headers = var.cors_config["allow_headers"]
8787
}
8888
}
8989

@@ -93,25 +93,33 @@ resource "aws_apigatewayv2_api" "main" {
9393
resource "aws_apigatewayv2_integration" "main" {
9494
count = length(var.routes)
9595
api_id = aws_apigatewayv2_api.main.id
96-
integration_uri = try(var.routes[count.index]["invoke_arn"], null)
96+
integration_uri = var.routes[count.index]["invoke_arn"]
9797
integration_type = "AWS_PROXY"
9898
integration_method = "POST"
9999
}
100100

101101
resource "aws_apigatewayv2_route" "main" {
102102
count = length(var.routes)
103103
api_id = aws_apigatewayv2_api.main.id
104-
route_key = "${try(var.routes[count.index]["method"], null)} ${try(var.routes[count.index]["route"], null)}"
104+
route_key = "${var.routes[count.index]["method"]} ${var.routes[count.index]["route"]}"
105105
target = "integrations/${aws_apigatewayv2_integration.main[count.index].id}"
106106
}
107107

108108
resource "aws_lambda_permission" "main" {
109109
count = length(var.routes)
110110
statement_id = "AllowExecutionFromAPIGateway"
111111
action = "lambda:InvokeFunction"
112-
function_name = try(var.routes[count.index]["function_arn"], null)
112+
function_name = var.routes[count.index]["function_arn"]
113113
principal = "apigateway.amazonaws.com"
114-
source_arn = "${aws_apigatewayv2_api.main.execution_arn}/*/*${try(var.routes[count.index]["route"], null)}"
114+
source_arn = "${aws_apigatewayv2_api.main.execution_arn}/*/*${var.routes[count.index]["route"]}"
115+
}
116+
117+
locals {
118+
rate_limited_routes = [for v in var.routes : {
119+
route_key = "${v["method"]} ${v["route"]}"
120+
burst_limit = v["burst_limit"]
121+
rate_limit = v["rate_limit"]
122+
} if v["burst_limit"] != null && v["rate_limit"] != null]
115123
}
116124

117125
resource "aws_apigatewayv2_stage" "main" {
@@ -120,12 +128,12 @@ resource "aws_apigatewayv2_stage" "main" {
120128
auto_deploy = true
121129

122130
dynamic "route_settings" {
123-
for_each = var.routes
131+
for_each = local.rate_limited_routes
124132

125133
content {
126-
route_key = "${try(route_settings.value["method"], null)} ${try(route_settings.value["route"], null)}"
127-
throttling_burst_limit = try(route_settings.value["burst_limit"], null)
128-
throttling_rate_limit = try(route_settings.value["rate_limit"], null)
134+
route_key = route_settings.value["route_key"]
135+
throttling_burst_limit = route_settings.value["burst_limit"]
136+
throttling_rate_limit = route_settings.value["rate_limit"]
129137
}
130138
}
131139

‎tests/api-gw.tftest.hcl‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,3 +244,116 @@ run "valid_log_config" {
244244
}
245245
}
246246
}
247+
248+
run "only_burst_limit" {
249+
command = plan
250+
251+
variables {
252+
identifier = "abc"
253+
domain = "test.com"
254+
zone_id = "test-zone"
255+
routes = [
256+
{
257+
route = "/test"
258+
method = "GET"
259+
function_arn = "arn:aws:lambda:test"
260+
invoke_arn = "arn:aws:apigateway:test"
261+
burst_limit = 1000
262+
rate_limit = 0.01
263+
},
264+
{
265+
route = "/test"
266+
method = "DELETE"
267+
function_arn = "arn:aws:lambda:test"
268+
invoke_arn = "arn:aws:apigateway:test"
269+
burst_limit = 1000
270+
},
271+
{
272+
route = "/test"
273+
method = "POST"
274+
function_arn = "arn:aws:lambda:test"
275+
invoke_arn = "arn:aws:apigateway:test"
276+
burst_limit = 1000
277+
rate_limit = 0.01
278+
}
279+
]
280+
}
281+
282+
expect_failures = [var.routes]
283+
}
284+
285+
run "only_rate_limit" {
286+
command = plan
287+
288+
variables {
289+
identifier = "abc"
290+
domain = "test.com"
291+
zone_id = "test-zone"
292+
routes = [
293+
{
294+
route = "/test"
295+
method = "GET"
296+
function_arn = "arn:aws:lambda:test"
297+
invoke_arn = "arn:aws:apigateway:test"
298+
burst_limit = 1000
299+
rate_limit = 0.01
300+
},
301+
{
302+
route = "/test"
303+
method = "DELETE"
304+
function_arn = "arn:aws:lambda:test"
305+
invoke_arn = "arn:aws:apigateway:test"
306+
rate_limit = 0.01
307+
},
308+
{
309+
route = "/test"
310+
method = "POST"
311+
function_arn = "arn:aws:lambda:test"
312+
invoke_arn = "arn:aws:apigateway:test"
313+
burst_limit = 1000
314+
rate_limit = 0.01
315+
}
316+
]
317+
}
318+
319+
expect_failures = [var.routes]
320+
}
321+
322+
run "some_rate_limited_routes" {
323+
command = plan
324+
325+
variables {
326+
identifier = "abc"
327+
domain = "test.com"
328+
zone_id = "test-zone"
329+
routes = [
330+
{
331+
route = "/test"
332+
method = "GET"
333+
function_arn = "arn:aws:lambda:test"
334+
invoke_arn = "arn:aws:apigateway:test"
335+
burst_limit = 1000
336+
rate_limit = 0.01
337+
},
338+
{
339+
route = "/test"
340+
method = "DELETE"
341+
function_arn = "arn:aws:lambda:test"
342+
invoke_arn = "arn:aws:apigateway:test"
343+
},
344+
{
345+
route = "/test"
346+
method = "POST"
347+
function_arn = "arn:aws:lambda:test"
348+
invoke_arn = "arn:aws:apigateway:test"
349+
burst_limit = 1000
350+
rate_limit = 0.01
351+
}
352+
]
353+
}
354+
355+
assert {
356+
condition = length(local.rate_limited_routes) == 2
357+
error_message = "Unexpected amount of rate limited routes was created"
358+
}
359+
}

‎variables.tf‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,8 @@ variable "routes" {
7878
method = string
7979
function_arn = string
8080
invoke_arn = string
81-
burst_limit = number
82-
rate_limit = number
81+
burst_limit = optional(number, null)
82+
rate_limit = optional(number, null)
8383
}))
8484
default = []
8585
validation {
@@ -101,6 +101,12 @@ variable "routes" {
101101
condition = !contains([for v in var.routes : startswith(try(v["invoke_arn"], null), "arn:aws:apigateway:")], false)
102102
error_message = "Invoke ARN of routes must be valid"
103103
}
104+
validation {
105+
condition = !contains(
106+
[for v in var.routes : (v["rate_limit"] == null && v["burst_limit"] == null) || (
107+
v["rate_limit"] != null && v["burst_limit"] != null)], false)
108+
error_message = "Rate and burst limit of routes must be either both defined or both undefined"
109+
}
104110
}
105111

106112
variable "tags" {

0 commit comments

Comments
 (0)