Move sqs policy for webhook to root module

Author: npalm

main.tf

@@ -37,6 +37,22 @@ module "webhook" {
   lambda_timeout = var.webhook_lambda_timeout
 }
 
+resource "aws_iam_policy" "webhook" {
+  name        = "${var.environment}-lambda-webhook-publish-sqs-policy"
+  description = "Lambda webhook sqs policy"
+
+  policy = templatefile("${path.module}/policies/lambda-publish-sqs-policy.json", {
+    sqs_resource_arn = aws_sqs_queue.queued_builds.arn
+  })
+}
+
+resource "aws_iam_policy_attachment" "webhook" {
+  name       = "${var.environment}-webhook-sqs"
+  roles      = [module.webhook.role.name]
+  policy_arn = aws_iam_policy.webhook.arn
+}
+
+
 module "runners" {
   source = "./modules/runners"
 

modules/runners/templates/user-data.sh

@@ -1,6 +1,8 @@
 #!/bin/bash -e
 exec > >(tee /var/log/user-data.log | logger -t user-data -s 2>/dev/console) 2>&1
 
+${pre_install}
+
 yum update -y
 
 # Install docker
@@ -10,8 +12,6 @@ usermod -a -G docker ec2-user
 
 yum install -y curl jq git
 
-${pre_install}
-
 # Install runner
 cd /home/ec2-user
 mkdir actions-runner && cd actions-runner

modules/webhook/main.tf

@@ -104,22 +104,3 @@ resource "aws_iam_policy_attachment" "webhook_logging" {
   roles      = [aws_iam_role.webhook_lambda.name]
   policy_arn = aws_iam_policy.webhook_logging.arn
 }
-
-resource "aws_iam_policy" "webhook" {
-  count = var.create_sqs_publish_policy ? 1 : 0
-
-  name        = "${var.environment}-lamda-webhook-sqs-publish-policy"
-  description = "Lambda webhook policy"
-
-  policy = templatefile("${path.module}/policies/lambda-webhook.json", {
-    sqs_resource_arn = var.sqs_build_queue.arn
-  })
-}
-
-resource "aws_iam_policy_attachment" "webhook" {
-  count = var.create_sqs_publish_policy ? 1 : 0
-
-  name       = "${var.environment}-webhook"
-  roles      = [aws_iam_role.webhook_lambda.name]
-  policy_arn = aws_iam_policy.webhook[0].arn
-}

modules/webhook/outputs.tf

@@ -6,6 +6,6 @@ output "lambda" {
   value = aws_lambda_function.webhook
 }
 
-output "lambda_role" {
+output "role" {
   value = aws_iam_role.webhook_lambda
 }

outputs.tf

@@ -18,6 +18,6 @@ output "webhook" {
   value = {
     gateway     = module.webhook.gateway
     lambda      = module.webhook.lambda
-    lambda_role = module.webhook.lambda_role
+    lambda_role = module.webhook.role
   }
 }