handle existing package + update example

Author: Fran-Rg

examples/code-signing/main.tf

@@ -1,3 +1,6 @@
+locals {
+  lambda_code_signing_profile_name = replace(random_pet.this.id, "-", "")
+}
 provider "aws" {
   region = "eu-west-1"
 
@@ -14,21 +17,23 @@ provider "aws" {
 module "lambda" {
   source = "../../"
 
-  function_name           = random_pet.this.id
-  handler                 = "index.lambda_handler"
-  runtime                 = "python3.12"
-  code_signing_config_arn = aws_lambda_code_signing_config.this.arn
-  create_package          = false
+  function_name                    = random_pet.this.id
+  handler                          = "index.lambda_handler"
+  runtime                          = "python3.12"
+  create_package                   = false
+  enable_code_signing              = true
+  code_signing_config_arn          = aws_lambda_code_signing_config.this.arn
+  lambda_code_signing_profile_name = local.lambda_code_signing_profile_name
+  s3_signing_prefix                = "signed/"
 
+  store_on_s3 = true
   s3_existing_package = {
-    bucket = aws_signer_signing_job.this.signed_object[0].s3[0].bucket
-    key    = aws_signer_signing_job.this.signed_object[0].s3[0].key
+    bucket     = module.s3_bucket.s3_bucket_id
+    key        = aws_s3_object.unsigned.key
+    version_id = aws_s3_object.unsigned.version_id
   }
-}
 
-################################################################################
-# Lambda Code Signing
-################################################################################
+}
 
 resource "aws_s3_object" "unsigned" {
   bucket = module.s3_bucket.s3_bucket_id
@@ -41,38 +46,21 @@ resource "aws_s3_object" "unsigned" {
   ]
 }
 
+# ################################################################################
+# # Lambda Code Signing
+# ################################################################################
+
 resource "aws_signer_signing_profile" "this" {
   platform_id = "AWSLambda-SHA384-ECDSA"
   # invalid value for name (must be alphanumeric with max length of 64 characters)
-  name = replace(random_pet.this.id, "-", "")
+  name = local.lambda_code_signing_profile_name
 
   signature_validity_period {
     value = 3
     type  = "MONTHS"
   }
 }
 
-resource "aws_signer_signing_job" "this" {
-  profile_name = aws_signer_signing_profile.this.name
-
-  source {
-    s3 {
-      bucket  = module.s3_bucket.s3_bucket_id
-      key     = aws_s3_object.unsigned.id
-      version = aws_s3_object.unsigned.version_id
-    }
-  }
-
-  destination {
-    s3 {
-      bucket = module.s3_bucket.s3_bucket_id
-      prefix = "signed/"
-    }
-  }
-
-  ignore_signing_job_failure = true
-}
-
 resource "aws_lambda_code_signing_config" "this" {
   allowed_publishers {
     signing_profile_version_arns = [aws_signer_signing_profile.this.version_arn]

main.tf

@@ -20,7 +20,7 @@ locals {
   s3_object_version = var.s3_existing_package != null ? try(var.s3_existing_package.version_id, null) : (var.store_on_s3 ? try(aws_s3_object.lambda_package[0].version_id, null) : null)
 
   # s3_signing
-  s3_signing_enabled = local.create && var.store_on_s3 && var.create_package && var.enable_code_signing && var.lambda_code_signing_profile_name != null
+  s3_signing_enabled = local.s3_key != null && local.s3_bucket != null && var.enable_code_signing && var.lambda_code_signing_profile_name != null
   s3_signing_bucket  = var.s3_signing_bucket != null && local.s3_signing_enabled ? var.s3_signing_bucket : local.s3_bucket
   s3_signing_prefix  = var.s3_signing_prefix != null && local.s3_signing_enabled ? var.s3_signing_prefix : (var.s3_prefix != null ? var.s3_prefix : "")