16 |
17 |
18 | 
19 |
20 |
21 | 
22 |
23 |
24 | 
25 |
26 |
27 |
28 | 8 | With our comprehensive DevOps toolkit - streamline operations, automate workflows, enhance collaboration and, most importantly, deploy with confidence. 9 |
10 | 11 | 12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
30 |
31 |
32 | 
33 |
34 |
35 | 
36 |
37 |
38 | 
39 |
40 |
41 | 
42 |
43 |
44 |
We are The Cloud Experts!
181 |We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
183 | 184 | [website]: https://clouddrove.com 185 | [blog]: https://blog.clouddrove.com 186 | [slack]: https://www.launchpass.com/devops-talks 187 | [github]: https://github.com/clouddrove 188 | [linkedin]: https://cpco.io/linkedin 189 | [twitter]: https://twitter.com/clouddrove/ 190 | [email]: https://clouddrove.com/contact-us.html 191 | [terraform_modules]: https://github.com/clouddrove?utf8=%E2%9C%93&q=terraform-&type=&language= 192 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | # 3 | # This is the canonical configuration for the `README.md` 4 | # Run `make readme` to rebuild the `README.md` 5 | # 6 | 7 | # Name of this project 8 | name : Terraform Module API-GATEWAY-V2 9 | 10 | # License of this project 11 | license: "APACHE" 12 | 13 | # Canonical GitHub repo 14 | github_repo: clouddrove/terraform-aws-api-gateway 15 | 16 | # Badges to display 17 | badges: 18 | - name: "Latest Release" 19 | image: "https://img.shields.io/github/release/clouddrove/terraform-aws-api-gateway.svg" 20 | url: "https://github.com/clouddrove/terraform-aws-api-gateway/releases/latest" 21 | - name: "tfsec" 22 | image: "https://github.com/clouddrove/terraform-aws-api-gateway/actions/workflows/tfsec.yml/badge.svg" 23 | url: "https://github.com/clouddrove/terraform-aws-api-gateway/actions/workflows/tfsec.yml" 24 | - name: "Licence" 25 | image: "https://img.shields.io/badge/License-APACHE-blue.svg" 26 | url: "LICENSE.md" 27 | - name: "Changelog" 28 | image: "https://img.shields.io/badge/Changelog-blue" 29 | url: "CHANGELOG.md" 30 | 31 | prerequesties: 32 | - name: Terraform 33 | url: https://learn.hashicorp.com/terraform/getting-started/install.html 34 | version: ">= 1.6.1" 35 | 36 | providers: 37 | - name: aws 38 | url: https://aws.amazon.com/ 39 | version: ">= 5.20.0" 40 | 41 | module_dependencies: 42 | - name: Labels Module 43 | url: https://github.com/clouddrove/terraform-aws-labels 44 | description: Provides resource tagging. 45 | 46 | # description of this project 47 | description: |- 48 | Terraform module api-gateway-v2 to create new modules using this as baseline 49 | 50 | # How to use this project 51 | # How to use this project 52 | usage: |- 53 | Here are examples of how you can use this module in your inventory structure: 54 | ### complete Example 55 | ```hcl 56 | module "api-gateway" { 57 | source = "clouddrove/api-gateway/aws" 58 | version = "1.4.0" 59 | 60 | domain_name = "example.cam" 61 | domain_name_certificate_arn = module.acm.arn 62 | integration_uri = module.lambda.arn 63 | zone_id = "1234059QJ345674343" 64 | create_vpc_link_enabled = false 65 | cors_configuration = { 66 | allow_credentials = true 67 | allow_methods = ["GET", "OPTIONS", "POST"] 68 | max_age = 5 69 | } 70 | integrations = { 71 | "ANY /" = { 72 | lambda_arn = module.lambda.arn 73 | payload_format_version = "2.0" 74 | timeout_milliseconds = 12000 75 | } 76 | "GET /some-route-with-authorizer" = { 77 | lambda_arn = module.lambda.arn 78 | payload_format_version = "2.0" 79 | authorizer_key = "cognito" 80 | } 81 | "POST /start-step-function" = { 82 | lambda_arn = module.lambda.arn 83 | payload_format_version = "2.0" 84 | authorizer_key = "cognito" 85 | } 86 | } 87 | } 88 | ``` 89 | ### vpc_link_api Example 90 | ```hcl 91 | module "api-gateway" { 92 | source = "clouddrove/api-gateway/aws" 93 | version = "1.4.0" 94 | 95 | name = "api" 96 | environment = "test" 97 | label_order = ["environment", "name"] 98 | domain_name = "example.cam" 99 | create_vpc_link_enabled = true 100 | zone_id = "1`23456059QJZ25345678" 101 | integration_uri = module.lambda.arn 102 | domain_name_certificate_arn = module.acm.arn 103 | subnet_ids = tolist(module.public_subnets.public_subnet_id) 104 | security_group_ids = [module.security_group.security_group_ids] 105 | cors_configuration = { 106 | allow_credentials = true 107 | allow_methods = ["GET", "OPTIONS", "POST"] 108 | max_age = 5 109 | } 110 | integrations = { 111 | "ANY /" = { 112 | lambda_arn = module.lambda.arn 113 | payload_format_version = "2.0" 114 | timeout_milliseconds = 12000 115 | } 116 | "GET /some-route-with-authorizer" = { 117 | lambda_arn = module.lambda.arn 118 | payload_format_version = "2.0" 119 | authorizer_key = "cognito" 120 | } 121 | "POST /start-step-function" = { 122 | lambda_arn = module.lambda.arn 123 | payload_format_version = "2.0" 124 | authorizer_key = "cognito" 125 | } 126 | } 127 | } 128 | ``` -------------------------------------------------------------------------------- /docs/io.md: -------------------------------------------------------------------------------- 1 | ## Inputs 2 | 3 | | Name | Description | Type | Default | Required | 4 | |------|-------------|------|---------|:--------:| 5 | | access\_log\_settings | Settings for logging access in this stage. | `map(string)` | `{}` | no | 6 | | api\_deployment\_description | flag to manage description of api deployment | `string` | `"test"` | no | 7 | | api\_description | the description of the API. | `string` | `"Manages an Amazon API Gateway Version 2 API."` | no | 8 | | api\_key\_selection\_expression | An API key selection expression. Valid values: $context.authorizer.usageIdentifierKey, $request.header.x-api-key. | `string` | `"$request.header.x-api-key"` | no | 9 | | api\_resources | flag to control of resources path | `map(map(string))` | `{}` | no | 10 | | api\_version | A version identifier for the API | `string` | `null` | no | 11 | | apigatewayv2\_api\_mapping\_enabled | Flag to control the mapping creation. | `bool` | `true` | no | 12 | | authorization | Required The type of authorization used for the method (NONE, CUSTOM, AWS\_IAM, COGNITO\_USER\_POOLS) | `string` | `"NONE"` | no | 13 | | authorizer\_iam\_role | Custome IAMRole for Authorizer Credentials. | `string` | `""` | no | 14 | | authorizer\_result\_ttl\_in\_seconds | TTL of cached authorizer results in seconds. Defaults to 300. | `number` | `300` | no | 15 | | authorizer\_type | The authorizer type. Valid values: JWT, REQUEST. For WebSocket APIs, specify REQUEST for a Lambda function using incoming request parameters. For HTTP APIs, specify JWT to use JSON Web Tokens. | `string` | `"JWT"` | no | 16 | | authorizers | Map of API gateway authorizers | `map(any)` | `{}` | no | 17 | | auto\_deploy | Set this to true to enable stage Auto Deployment | `bool` | `false` | no | 18 | | body | An OpenAPI specification that defines the set of routes and integrations to create as part of the HTTP APIs. Supported only for HTTP APIs. | `string` | `null` | no | 19 | | cache\_cluster\_enabled | Whether a cache cluster is enabled for the stage | `bool` | `false` | no | 20 | | cache\_cluster\_size | Size of the cache cluster for the stage, if enabled. Allowed values include 0.5, 1.6, 6.1, 13.5, 28.4, 58.2, 118 and 237. | `string` | `"0.5"` | no | 21 | | cache\_key\_parameters | List of cache key parameters for the integration. | `list(any)` | `[]` | no | 22 | | cache\_namespace | Integration's cache namespace. | `string` | `""` | no | 23 | | canary\_settings | (optional) describe your variable | `map(any)` | `{}` | no | 24 | | client\_certificate\_id | Identifier of a client certificate for the stage. | `string` | `""` | no | 25 | | connection\_id | ID of the VpcLink used for the integration. Required if connection\_type is VPC\_LINK | `string` | `""` | no | 26 | | connection\_rest\_api\_type | Valid values are INTERNET (default for connections through the public routable internet), and VPC\_LINK (for private connections between API Gateway and a network load balancer in a VPC). | `string` | `"INTERNET"` | no | 27 | | connection\_type | Type of the network connection to the integration endpoint. Valid values: INTERNET, VPC\_LINK. Default is INTERNET. | `string` | `"INTERNET"` | no | 28 | | content\_handling | Supported values are CONVERT\_TO\_BINARY and CONVERT\_TO\_TEXT. If this property is not defined, the request payload will be passed through from the method request to integration request without modification, provided that the passthroughBehaviors is configured to support payload pass-through. | `string` | `"CONVERT_TO_TEXT"` | no | 29 | | cors\_configuration | The cross-origin resource sharing (CORS) configuration. Applicable for HTTP APIs. | `any` | `{}` | no | 30 | | create\_api\_domain\_name\_enabled | Flag to control the domain creation. | `bool` | `true` | no | 31 | | create\_default\_stage\_enabled | Flag to control the stage creation. | `bool` | `true` | no | 32 | | create\_http\_api | Flag to control creation of HTTP api. | `bool` | `false` | no | 33 | | create\_kms\_key | Set this to `false` to provide existing kms key arn in `kms_key_arn` variable. | `bool` | `true` | no | 34 | | create\_rest\_api | Flag to control the rest api creation. | `bool` | `false` | no | 35 | | create\_rest\_api\_deployment | Flag to control the mapping creation. | `bool` | `true` | no | 36 | | create\_rest\_api\_gateway\_authorizer | Flag to control the rest api gateway authorizer creation. | `bool` | `true` | no | 37 | | create\_rest\_api\_gateway\_integration | Flag to control the rest api gateway integration creation. | `bool` | `true` | no | 38 | | create\_rest\_api\_gateway\_integration\_response | Flag to control the rest api gateway integration response creation. | `bool` | `true` | no | 39 | | create\_rest\_api\_gateway\_method | Flag to control the rest api gateway method creation. | `bool` | `true` | no | 40 | | create\_rest\_api\_gateway\_method\_response | Flag to control the rest api gateway stage creation. | `bool` | `true` | no | 41 | | create\_rest\_api\_gateway\_resource | flag to control the rest api gateway resources creation | `bool` | `true` | no | 42 | | create\_rest\_api\_gateway\_stage | Flag to control the rest api gateway stage creation. | `bool` | `true` | no | 43 | | create\_routes\_and\_integrations\_enabled | Whether to create routes and integrations resources | `bool` | `true` | no | 44 | | create\_vpc\_endpoint | VPC endpoint is required to access api gateway url from outside the vpc. Set this to `false` to prevent vpc endpoint creation. | `bool` | `true` | no | 45 | | create\_vpc\_link\_enabled | Whether to create VPC links | `bool` | `true` | no | 46 | | credentials | To specify an IAM Role for Amazon API Gateway to assume, use the role's ARN. To require that the caller's identity be passed through from the request, specify the string | `string` | `""` | no | 47 | | credentials\_arn | Part of quick create. Specifies any credentials required for the integration. Applicable for HTTP APIs. | `string` | `null` | no | 48 | | default\_route\_settings | Default route settings for the stage. | `map(string)` | `{}` | no | 49 | | default\_stage\_access\_log\_destination\_arn | ARN of the CloudWatch Logs log group to receive access logs. | `string` | `null` | no | 50 | | default\_stage\_access\_log\_format | Single line format of the access logs of data. Refer to log settings for HTTP or Websocket. | `string` | `null` | no | 51 | | description\_gateway\_stage | (optional) describe your variable | `string` | `"demo-test"` | no | 52 | | documentation\_version | Version of the associated API documentation | `string` | `""` | no | 53 | | domain\_name | The domain name to use for API gateway | `string` | `null` | no | 54 | | domain\_name\_certificate\_arn | The ARN of an AWS-managed certificate that will be used by the endpoint for the domain name | `string` | `""` | no | 55 | | domain\_name\_ownership\_verification\_certificate\_arn | ARN of the AWS-issued certificate used to validate custom domain ownership (when certificate\_arn is issued via an ACM Private CA or mutual\_tls\_authentication is configured with an ACM-imported certificate.) | `string` | `null` | no | 56 | | enable\_access\_logs | flag to manage of cloudwatch log group creation | `bool` | `true` | no | 57 | | enable\_key\_rotation | Specifies whether key rotation is enabled. Defaults to false. | `bool` | `null` | no | 58 | | enabled | Set this to `false` to prevent resource creation by this terraform module. | `bool` | `true` | no | 59 | | environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `"test"` | no | 60 | | gateway\_authorizer | flag to control the gateway authorizer name. | `string` | `"demo"` | no | 61 | | gateway\_integration\_type | flag tp control the gatway integration type. | `string` | `"AWS_PROXY"` | no | 62 | | http\_method | HTTP method (GET, POST, PUT, DELETE, HEAD, OPTION, ANY) when calling the associated resource. | `string` | `"ANY"` | no | 63 | | identity\_source | Source of the identity in an incoming request. Defaults to method.request.header.Authorization. For REQUEST type, this may be a comma-separated list of values, including headers, query string parameters and stage variable | `string` | `"method.request.header.Authorization"` | no | 64 | | identity\_sources | The identity sources for which authorization is requested. | `list(string)` |[| no | 65 | | integration\_description | Description of the integration. | `string` | `"Lambda example"` | no | 66 | | integration\_http\_method | flag to control the gateway intergration http method. | `string` | `"POST"` | no | 67 | | integration\_method | Integration's HTTP method. Must be specified if integration\_type is not MOCK. | `string` | `"POST"` | no | 68 | | integration\_response\_parameters | Map of response parameters that can be read from the backend response. For example: response\_parameters = { method.response.header.X-Some-Header = integration.response.header.X-Some-Other-Header }. | `map(string)` | `{}` | no | 69 | | integration\_type | Integration type of an integration. Valid values: AWS (supported only for WebSocket APIs), AWS\_PROXY, HTTP (supported only for WebSocket APIs), HTTP\_PROXY, MOCK (supported only for WebSocket APIs). | `string` | `"AWS_PROXY"` | no | 70 | | integration\_uri | URI of the Lambda function for a Lambda proxy integration, when integration\_type is AWS\_PROXY. For an HTTP integration, specify a fully-qualified URL. | `string` | `""` | no | 71 | | integrations | Map of API gateway routes with integrations | `map(any)` | `{}` | no | 72 | | kms\_key\_arn | Pass existing KMS key arn. Only applicable when `create_kms_key` is set to false. | `string` | `""` | no | 73 | | label\_order | Label order, e.g. `name`,`application`. | `list(any)` |
"$request.header.Authorization"
]
[| no | 74 | | log\_format | Formatting and values recorded in the logs. For more information on configuring the log format rules visit the AWS documentation | `string` | `" {\n\t\"requestTime\": \"$context.requestTime\",\n\t\"requestId\": \"$context.requestId\",\n\t\"httpMethod\": \"$context.httpMethod\",\n\t\"path\": \"$context.path\",\n\t\"resourcePath\": \"$context.resourcePath\",\n\t\"status\": $context.status,\n\t\"responseLatency\": $context.responseLatency,\n \"xrayTraceId\": \"$context.xrayTraceId\",\n \"integrationRequestId\": \"$context.integration.requestId\",\n\t\"functionResponseStatus\": \"$context.integration.status\",\n \"integrationLatency\": \"$context.integration.latency\",\n\t\"integrationServiceStatus\": \"$context.integration.integrationStatus\",\n \"authorizeResultStatus\": \"$context.authorize.status\",\n\t\"authorizerServiceStatus\": \"$context.authorizer.status\",\n\t\"authorizerLatency\": \"$context.authorizer.latency\",\n\t\"authorizerRequestId\": \"$context.authorizer.requestId\",\n \"ip\": \"$context.identity.sourceIp\",\n\t\"userAgent\": \"$context.identity.userAgent\",\n\t\"principalId\": \"$context.authorizer.principalId\",\n\t\"cognitoUser\": \"$context.identity.cognitoIdentityId\",\n \"user\": \"$context.identity.user\"\n}\n"` | no | 75 | | log\_group\_class | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS. | `string` | `"STANDARD"` | no | 76 | | managedby | ManagedBy, eg 'CloudDrove' | `string` | `"hello@clouddrove.com"` | no | 77 | | multi\_region | ndicates whether the KMS key is a multi-Region (true) or regional (false) key. Defaults to false. | `bool` | `false` | no | 78 | | mutual\_tls\_authentication | An Amazon S3 URL that specifies the truststore for mutual TLS authentication as well as version, keyed at uri and version | `map(string)` | `{}` | no | 79 | | name | Name (e.g. `app` or `api`). | `string` | `""` | no | 80 | | passthrough\_behavior | Pass-through behavior for incoming requests based on the Content-Type header in the request, and the available mapping templates specified as the request\_templates attribute. | `string` | `"WHEN_NO_MATCH"` | no | 81 | | private\_dns\_enabled | AWS services and AWS Marketplace partner services only) Whether or not to associate a private hosted zone with the specified VPC. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. | `bool` | `false` | no | 82 | | protocol\_type | The API protocol. Valid values: HTTP, WEBSOCKET | `string` | `"HTTP"` | no | 83 | | provider\_arns | required for type COGNITO\_USER\_POOLS) List of the Amazon Cognito user pool ARNs. Each element is of this format: arn:aws:cognito-idp:{region}:{account\_id}:userpool/{user\_pool\_id}. | `set(string)` | `[]` | no | 84 | | repository | Terraform current module repo | `string` | `""` | no | 85 | | request\_parameters | Map of request query string parameters and headers that should be passed to the backend responder | `map(string)` | `null` | no | 86 | | request\_templates | Map of the integration's request templates. | `map(string)` | `null` | no | 87 | | response\_models | A map of the API models used for the response's content type | `map(string)` |
"name",
"environment"
]
{
"application/json": "Empty"
} | no |
88 | | response\_parameters | Map of response parameters that can be sent to the caller. For example: response\_parameters { method.response.header.X-Some-Header = true } would define that the header X-Some-Header can be provided on the response | `map(bool)` | `{}` | no |
89 | | rest\_api\_assume\_role\_policy | Custome Trust Relationship Policy for Authorizer IAMRole. | `string` | `""` | no |
90 | | rest\_api\_base\_path | Path segment that must be prepended to the path when accessing the API via this mapping. If omitted, the API is exposed at the root of the given domain. | `string` | `""` | no |
91 | | rest\_api\_description | The description of the REST API | `string` | `"test"` | no |
92 | | rest\_api\_endpoint\_type | (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: EDGE, REGIONAL or PRIVATE. If unspecified, defaults to EDGE. | `string` | `null` | no |
93 | | rest\_api\_resource\_policy | (Optional) custom resource policy for private rest api. | `string` | `""` | no |
94 | | rest\_api\_stage\_name | The name of the stage | `string` | `""` | no |
95 | | rest\_variables | Map to set on the stage managed by the stage\_name argument. | `map(string)` | `{}` | no |
96 | | retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653, and 0. If you select 0, the events in the log group are always retained and never expire. | `number` | `null` | no |
97 | | route\_key | Part of quick create. Specifies any route key. Applicable for HTTP APIs. | `string` | `null` | no |
98 | | route\_selection\_expression | The route selection expression for the API. | `string` | `"$request.method $request.path"` | no |
99 | | route\_settings | Settings for default route | `map(string)` | `{}` | no |
100 | | security\_group\_ids | A list of security group IDs to associate with. | `list(string)` | `[]` | no |
101 | | service\_name | The service name. For AWS services the service name is usually in the form com.amazonaws.[| no | 112 | | vpc\_endpoint\_type | The VPC endpoint type, Gateway, GatewayLoadBalancer, or Interface. Defaults to Gateway. | `string` | `"Gateway"` | no | 113 | | vpc\_id | The ID of the VPC in which the endpoint will be used. | `string` | `""` | no | 114 | | vpc\_links | Map of VPC Links details to create | `map(any)` | `{}` | no | 115 | | xray\_tracing\_enabled | A flag to indicate whether to enable X-Ray tracing. | `bool` | `true` | no | 116 | | zone\_id | The ID of the hosted zone to contain this record. | `string` | `""` | no | 117 | 118 | ## Outputs 119 | 120 | | Name | Description | 121 | |------|-------------| 122 | | api\_arn | The HTTP API ARN. | 123 | | api\_endpoint | The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com. | 124 | | api\_id | The HTTP Api ID. | 125 | | invoke\_url | URL to invoke the API pointing to the stage | 126 | | rest\_api\_arn | The Rest Api Arn. | 127 | | rest\_api\_execution\_arn | Execution arn of rest api gateway. | 128 | | rest\_api\_id | The ID of the REST API | 129 | | rest\_api\_invoke\_url | The URL to invoke the API pointing to the stage | 130 | 131 | -------------------------------------------------------------------------------- /examples/complete/http-api-gateway/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## PROVIDER 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | 8 | ####---------------------------------------------------------------------------------- 9 | ## LOCALS 10 | ####---------------------------------------------------------------------------------- 11 | 12 | locals { 13 | name = "api" 14 | environment = "test" 15 | region = "us-east-1" 16 | domain_name = "clouddrove.ca" 17 | hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" 18 | } 19 | ####---------------------------------------------------------------------------------- 20 | ## ACM 21 | ####---------------------------------------------------------------------------------- 22 | module "acm" { 23 | source = "clouddrove/acm/aws" 24 | version = "1.4.1" 25 | 26 | name = local.name 27 | environment = local.environment 28 | enable_aws_certificate = true 29 | domain_name = local.domain_name 30 | subject_alternative_names = ["*.${local.domain_name}"] 31 | validation_method = "DNS" 32 | enable_dns_validation = false 33 | } 34 | 35 | ####---------------------------------------------------------------------------------- 36 | ## LAMBDA 37 | ####---------------------------------------------------------------------------------- 38 | module "lambda" { 39 | source = "clouddrove/lambda/aws" 40 | version = "1.3.1" 41 | 42 | name = local.name 43 | environment = local.environment 44 | enable = true 45 | timeout = 60 46 | filename = "../lambda_packages/index.zip" 47 | handler = "index.lambda_handler" 48 | runtime = "python3.8" 49 | iam_actions = [ 50 | "logs:CreateLogStream", 51 | "logs:CreateLogGroup", 52 | "logs:PutLogEvents" 53 | ] 54 | names = [ 55 | "python_layer" 56 | ] 57 | compatible_runtimes = [ 58 | ["python3.8"] 59 | ] 60 | statement_ids = [ 61 | "AllowExecutionFromApiGateway" 62 | ] 63 | actions = [ 64 | "lambda:InvokeFunction" 65 | ] 66 | principals = [ 67 | "apigateway.amazonaws.com" 68 | ] 69 | variables = { 70 | foo = "bar" 71 | } 72 | } 73 | 74 | ####---------------------------------------------------------------------------------- 75 | ## API GATEWAY 76 | ####---------------------------------------------------------------------------------- 77 | module "api_gateway" { 78 | source = "../../../" 79 | 80 | name = local.name 81 | environment = local.environment 82 | domain_name = "api.${local.domain_name}" 83 | domain_name_certificate_arn = module.acm.arn 84 | integration_uri = module.lambda.invoke_arn 85 | zone_id = local.hosted_zone_id 86 | auto_deploy = true 87 | stage_name = "$default" 88 | create_vpc_link_enabled = false 89 | create_http_api = true 90 | cors_configuration = { 91 | allow_credentials = true 92 | allow_methods = ["GET", "OPTIONS", "POST"] 93 | max_age = 5 94 | } 95 | integrations = { 96 | "ANY /" = { 97 | lambda_arn = module.lambda.arn 98 | payload_format_version = "2.0" 99 | timeout_milliseconds = 30000 100 | } 101 | "GET /some-route-with-authorizer" = { 102 | lambda_arn = module.lambda.arn 103 | payload_format_version = "1.0" 104 | authorizer_key = "cognito" 105 | } 106 | "POST /start-step-function" = { 107 | lambda_arn = module.lambda.arn 108 | payload_format_version = "1.0" 109 | authorizer_key = "cognito" 110 | } 111 | } 112 | } -------------------------------------------------------------------------------- /examples/complete/http-api-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | output "api_id" { 2 | value = module.api_gateway.api_id 3 | description = "The API identifier." 4 | } 5 | 6 | output "api_arn" { 7 | value = module.api_gateway.api_arn 8 | description = "The API arn." 9 | } 10 | 11 | output "api_endpoint" { 12 | value = module.api_gateway.api_endpoint 13 | description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com." 14 | } 15 | 16 | output "invoke_url" { 17 | value = module.api_gateway.invoke_url 18 | description = "URL to invoke the API pointing to the stage" 19 | } 20 | -------------------------------------------------------------------------------- /examples/complete/http-api-gateway/version.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /examples/complete/lambda_packages/index.py: -------------------------------------------------------------------------------- 1 | import json 2 | def lambda_handler(event, context): 3 | print('Lambda function with Python!|') 4 | return { 5 | 'statusCode': 200, 6 | 'body': json.dumps('Hello from Lambda!') 7 | } 8 | -------------------------------------------------------------------------------- /examples/complete/lambda_packages/index.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/clouddrove/terraform-aws-api-gateway/226598b35a0769d30c42fb7c1abdf3a68c583c74/examples/complete/lambda_packages/index.zip -------------------------------------------------------------------------------- /examples/complete/private-rest-api-gateway/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## PROVIDER 3 | ####---------------------------------------------------------------------------------- 4 | 5 | provider "aws" { 6 | region = local.region 7 | } 8 | ####---------------------------------------------------------------------------------- 9 | ## LOCALS 10 | ####---------------------------------------------------------------------------------- 11 | 12 | locals { 13 | name = "api" 14 | environment = "test" 15 | region = "us-east-1" 16 | domain_name = "clouddrove.ca" 17 | hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" 18 | } 19 | ####---------------------------------------------------------------------------------- 20 | ## ACM 21 | ####---------------------------------------------------------------------------------- 22 | 23 | module "acm" { 24 | source = "clouddrove/acm/aws" 25 | version = "1.4.1" 26 | 27 | name = local.name 28 | environment = local.environment 29 | enable_aws_certificate = true 30 | domain_name = local.domain_name 31 | subject_alternative_names = ["*.${local.domain_name}"] 32 | validation_method = "DNS" 33 | enable_dns_validation = false 34 | } 35 | 36 | ####---------------------------------------------------------------------------------- 37 | ## LAMBDA 38 | ####---------------------------------------------------------------------------------- 39 | 40 | module "lambda" { 41 | source = "clouddrove/lambda/aws" 42 | version = "1.3.1" 43 | 44 | name = local.name 45 | environment = local.environment 46 | enable = true 47 | timeout = 60 48 | filename = "../lambda_packages/index.zip" 49 | handler = "index.lambda_handler" 50 | runtime = "python3.8" 51 | iam_actions = [ 52 | "logs:CreateLogStream", 53 | "logs:CreateLogGroup", 54 | "logs:PutLogEvents" 55 | ] 56 | names = [ 57 | "python_layer" 58 | ] 59 | compatible_runtimes = [ 60 | ["python3.8"] 61 | ] 62 | statement_ids = [ 63 | "AllowExecutionFromApiGateway" 64 | ] 65 | actions = [ 66 | "lambda:InvokeFunction" 67 | ] 68 | principals = [ 69 | "apigateway.amazonaws.com" 70 | ] 71 | variables = { 72 | foo = "bar" 73 | } 74 | } 75 | 76 | 77 | ####---------------------------------------------------------------------------------- 78 | ## VPC 79 | ####---------------------------------------------------------------------------------- 80 | 81 | module "vpc" { 82 | source = "clouddrove/vpc/aws" 83 | version = "2.0.0" 84 | 85 | name = "${local.name}-rest-api-private" 86 | environment = local.environment 87 | enable = true 88 | cidr_block = "10.0.0.0/16" 89 | 90 | } 91 | 92 | ####---------------------------------------------------------------------------------- 93 | ## SUBNETS 94 | ####---------------------------------------------------------------------------------- 95 | #tfsec:ignore:aws-ec2-no-excessive-port-access 96 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 97 | module "subnets" { 98 | source = "clouddrove/subnet/aws" 99 | version = "2.0.1" 100 | 101 | name = "${local.name}-rest-api-private" 102 | environment = local.environment 103 | 104 | nat_gateway_enabled = true 105 | single_nat_gateway = true 106 | availability_zones = ["${local.region}a", "${local.region}b", "${local.region}c"] 107 | vpc_id = module.vpc.vpc_id 108 | type = "public-private" 109 | igw_id = module.vpc.igw_id 110 | cidr_block = module.vpc.vpc_cidr_block 111 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 112 | enable_ipv6 = true 113 | private_inbound_acl_rules = [ 114 | { 115 | rule_number = 100 116 | rule_action = "allow" 117 | from_port = 0 118 | to_port = 0 119 | protocol = "-1" 120 | cidr_block = module.vpc.vpc_cidr_block 121 | } 122 | ] 123 | private_outbound_acl_rules = [ 124 | { 125 | rule_number = 100 126 | rule_action = "allow" 127 | from_port = 0 128 | to_port = 0 129 | protocol = "-1" 130 | cidr_block = module.vpc.vpc_cidr_block 131 | } 132 | ] 133 | public_inbound_acl_rules = [ 134 | { 135 | rule_number = 100 136 | rule_action = "allow" 137 | from_port = 0 138 | to_port = 0 139 | protocol = "-1" 140 | cidr_block = "0.0.0.0/0" 141 | } 142 | ] 143 | public_outbound_acl_rules = [ 144 | { 145 | rule_number = 100 146 | rule_action = "allow" 147 | from_port = 0 148 | to_port = 0 149 | protocol = "-1" 150 | cidr_block = "0.0.0.0/0" 151 | } 152 | ] 153 | 154 | } 155 | 156 | ####---------------------------------------------------------------------------------- 157 | ## SECURITY GROUP 158 | ####---------------------------------------------------------------------------------- 159 | 160 | module "security_group" { 161 | source = "clouddrove/security-group/aws" 162 | version = "2.0.0" 163 | 164 | name = "${local.name}-rest-api-private" 165 | environment = local.environment 166 | 167 | vpc_id = module.vpc.vpc_id 168 | new_sg_ingress_rules_with_cidr_blocks = [ 169 | { 170 | rule_count = 1 171 | from_port = 0 172 | protocol = "-1" 173 | to_port = 0 174 | cidr_blocks = [module.vpc.vpc_cidr_block] 175 | description = "Allow all traffic from ${local.environment} VPC." 176 | } 177 | ] 178 | new_sg_egress_rules_with_cidr_blocks = [ 179 | { 180 | rule_count = 1 181 | from_port = 0 182 | protocol = "-1" 183 | to_port = 0 184 | cidr_blocks = [module.vpc.vpc_cidr_block] 185 | description = "Allow all outbound traffic." 186 | } 187 | ] 188 | } 189 | 190 | 191 | ####---------------------------------------------------------------------------------- 192 | ## REST API PRIVATE 193 | ####---------------------------------------------------------------------------------- 194 | 195 | module "rest_api_private" { 196 | source = "../../../" 197 | 198 | name = "${local.name}-rest-api-private" 199 | environment = local.environment 200 | enabled = true 201 | create_rest_api = true 202 | rest_api_endpoint_type = "PRIVATE" 203 | rest_api_description = "Private REST API for ${module.lambda.name} lambda function" 204 | integration_uri = module.lambda.invoke_arn 205 | rest_api_stage_name = "default" 206 | auto_deploy = true 207 | rest_api_base_path = "test" 208 | domain_name = "api.${local.domain_name}" 209 | zone_id = local.hosted_zone_id 210 | 211 | # -- VPC Endpoint configuration 212 | vpc_id = module.vpc.vpc_id 213 | subnet_ids = module.subnets.private_subnet_id 214 | security_group_ids = [module.security_group.security_group_id] 215 | service_name = "com.amazonaws.${local.region}.execute-api" 216 | vpc_endpoint_type = "Interface" 217 | private_dns_enabled = true 218 | domain_name_certificate_arn = module.acm.arn 219 | 220 | #---access log---- 221 | enable_access_logs = true 222 | retention_in_days = 7 223 | } 224 | 225 | 226 | -------------------------------------------------------------------------------- /examples/complete/private-rest-api-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | ##------------------------------------------------------------- 2 | # REST API PRIVATE 3 | ##------------------------------------------------------------- 4 | 5 | output "private_rest_api_id" { 6 | value = module.rest_api_private.rest_api_id 7 | description = " The ID of the REST API" 8 | 9 | } 10 | 11 | output "private_rest_api_arn" { 12 | value = module.rest_api_private.rest_api_arn 13 | description = "The Rest api arn" 14 | 15 | } 16 | 17 | output "private_rest_api_invoke_url" { 18 | value = module.rest_api_private.rest_api_invoke_url 19 | description = "The URL to invoke the API pointing to the stage" 20 | 21 | } -------------------------------------------------------------------------------- /examples/complete/private-rest-api-gateway/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /examples/complete/rest-api-gateway/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## PROVIDER 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | 8 | ####---------------------------------------------------------------------------------- 9 | ## LOCALS 10 | ####---------------------------------------------------------------------------------- 11 | 12 | locals { 13 | name = "api" 14 | environment = "test" 15 | region = "us-east-1" 16 | domain_name = "clouddrove.ca" 17 | hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" 18 | } 19 | ####---------------------------------------------------------------------------------- 20 | ## ACM 21 | ####---------------------------------------------------------------------------------- 22 | module "acm" { 23 | source = "clouddrove/acm/aws" 24 | version = "1.4.1" 25 | 26 | name = local.name 27 | environment = local.environment 28 | enable_aws_certificate = true 29 | domain_name = local.domain_name 30 | subject_alternative_names = ["*.${local.domain_name}"] 31 | validation_method = "DNS" 32 | enable_dns_validation = false 33 | } 34 | 35 | ####---------------------------------------------------------------------------------- 36 | ## LAMBDA 37 | ####---------------------------------------------------------------------------------- 38 | module "lambda" { 39 | source = "clouddrove/lambda/aws" 40 | version = "1.3.1" 41 | 42 | name = local.name 43 | environment = local.environment 44 | enable = true 45 | timeout = 60 46 | filename = "../lambda_packages/index.zip" 47 | handler = "index.lambda_handler" 48 | runtime = "python3.8" 49 | iam_actions = [ 50 | "logs:CreateLogStream", 51 | "logs:CreateLogGroup", 52 | "logs:PutLogEvents" 53 | ] 54 | names = [ 55 | "python_layer" 56 | ] 57 | compatible_runtimes = [ 58 | ["python3.8"] 59 | ] 60 | statement_ids = [ 61 | "AllowExecutionFromApiGateway" 62 | ] 63 | actions = [ 64 | "lambda:InvokeFunction" 65 | ] 66 | principals = [ 67 | "apigateway.amazonaws.com" 68 | ] 69 | variables = { 70 | foo = "bar" 71 | } 72 | } 73 | 74 | 75 | ####---------------------------------------------------------------------------------- 76 | ## REST API 77 | ####---------------------------------------------------------------------------------- 78 | 79 | module "rest_api" { 80 | source = "../../../" 81 | 82 | name = "${local.name}-rest-api" 83 | environment = local.environment 84 | create_rest_api = true 85 | domain_name_certificate_arn = module.acm.arn 86 | domain_name = "api.${local.domain_name}" 87 | zone_id = local.hosted_zone_id 88 | rest_api_description = "REST API for ${module.lambda.name} lambda function" 89 | rest_api_endpoint_type = "REGIONAL" 90 | integration_uri = module.lambda.invoke_arn 91 | rest_api_stage_name = "default" 92 | api_resources = { 93 | users = { 94 | path_part = "users" 95 | http_method = "ANY" 96 | uri = module.lambda.invoke_arn 97 | 98 | }, 99 | cards = { 100 | path_part = "cards" 101 | http_method = "ANY" 102 | uri = module.lambda.invoke_arn 103 | } 104 | } 105 | 106 | #---access log---- 107 | enable_access_logs = true 108 | retention_in_days = 7 109 | } 110 | 111 | 112 | 113 | 114 | 115 | 116 | -------------------------------------------------------------------------------- /examples/complete/rest-api-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | ##------------------------------------------------------------- 2 | # REST API 3 | ##------------------------------------------------------------- 4 | 5 | output "rest_api_id" { 6 | value = module.rest_api.rest_api_id 7 | description = " The ID of the REST API" 8 | 9 | } 10 | 11 | output "rest_api_arn" { 12 | value = module.rest_api.rest_api_arn 13 | description = "The Rest api arn" 14 | } 15 | 16 | output "rest_api_invoke_url" { 17 | value = module.rest_api.rest_api_invoke_url 18 | description = "The URL to invoke the API pointing to the stage" 19 | 20 | } 21 | 22 | 23 | -------------------------------------------------------------------------------- /examples/complete/rest-api-gateway/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /examples/http-api-gateway/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## PROVIDER 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | 8 | ####---------------------------------------------------------------------------------- 9 | ## LOCALS 10 | ####---------------------------------------------------------------------------------- 11 | 12 | locals { 13 | name = "api" 14 | environment = "test" 15 | region = "us-east-1" 16 | domain_name = "clouddrove.ca" 17 | hosted_zone_id = "Z0xxxxxxxxxxxxxxEP" 18 | } 19 | ####---------------------------------------------------------------------------------- 20 | ## ACM 21 | ####---------------------------------------------------------------------------------- 22 | module "acm" { 23 | source = "clouddrove/acm/aws" 24 | version = "1.4.1" 25 | 26 | name = local.name 27 | environment = local.environment 28 | enable_aws_certificate = true 29 | domain_name = local.domain_name 30 | subject_alternative_names = ["*.${local.domain_name}"] 31 | validation_method = "DNS" 32 | enable_dns_validation = false 33 | } 34 | 35 | ####---------------------------------------------------------------------------------- 36 | ## LAMBDA 37 | ####---------------------------------------------------------------------------------- 38 | module "lambda" { 39 | source = "clouddrove/lambda/aws" 40 | version = "1.3.1" 41 | 42 | name = local.name 43 | environment = local.environment 44 | enable = true 45 | timeout = 60 46 | filename = "../lambda_packages/index.zip" 47 | handler = "index.lambda_handler" 48 | runtime = "python3.8" 49 | iam_actions = [ 50 | "logs:CreateLogStream", 51 | "logs:CreateLogGroup", 52 | "logs:PutLogEvents" 53 | ] 54 | names = [ 55 | "python_layer" 56 | ] 57 | compatible_runtimes = [ 58 | ["python3.8"] 59 | ] 60 | statement_ids = [ 61 | "AllowExecutionFromApiGateway" 62 | ] 63 | actions = [ 64 | "lambda:InvokeFunction" 65 | ] 66 | principals = [ 67 | "apigateway.amazonaws.com" 68 | ] 69 | variables = { 70 | foo = "bar" 71 | } 72 | } 73 | 74 | ####---------------------------------------------------------------------------------- 75 | ## API GATEWAY 76 | ####---------------------------------------------------------------------------------- 77 | module "api_gateway" { 78 | source = "../../." 79 | 80 | name = local.name 81 | environment = local.environment 82 | domain_name = "api.${local.domain_name}" 83 | domain_name_certificate_arn = module.acm.arn 84 | integration_uri = module.lambda.invoke_arn 85 | zone_id = local.hosted_zone_id 86 | auto_deploy = true 87 | stage_name = "$default" 88 | create_vpc_link_enabled = false 89 | create_http_api = true 90 | cors_configuration = { 91 | allow_credentials = true 92 | allow_methods = ["GET", "OPTIONS", "POST"] 93 | max_age = 5 94 | } 95 | integrations = { 96 | "ANY /" = { 97 | lambda_arn = module.lambda.arn 98 | payload_format_version = "2.0" 99 | timeout_milliseconds = 30000 100 | } 101 | "GET /some-route-with-authorizer" = { 102 | lambda_arn = module.lambda.arn 103 | payload_format_version = "1.0" 104 | authorizer_key = "cognito" 105 | } 106 | "POST /start-step-function" = { 107 | lambda_arn = module.lambda.arn 108 | payload_format_version = "1.0" 109 | authorizer_key = "cognito" 110 | } 111 | } 112 | } -------------------------------------------------------------------------------- /examples/http-api-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | output "api_id" { 2 | value = module.api_gateway.api_id 3 | description = "The API identifier." 4 | } 5 | 6 | output "api_arn" { 7 | value = module.api_gateway.api_arn 8 | description = "The API arn." 9 | } 10 | 11 | output "api_endpoint" { 12 | value = module.api_gateway.api_endpoint 13 | description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com." 14 | } 15 | 16 | output "invoke_url" { 17 | value = module.api_gateway.invoke_url 18 | description = "URL to invoke the API pointing to the stage" 19 | } 20 | -------------------------------------------------------------------------------- /examples/http-api-gateway/version.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /examples/lambda_packages/index.py: -------------------------------------------------------------------------------- 1 | import json 2 | def lambda_handler(event, context): 3 | print('Lambda function with Python!|') 4 | return { 5 | 'statusCode': 200, 6 | 'body': json.dumps('Hello from Lambda!') 7 | } 8 | -------------------------------------------------------------------------------- /examples/lambda_packages/index.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/clouddrove/terraform-aws-api-gateway/226598b35a0769d30c42fb7c1abdf3a68c583c74/examples/lambda_packages/index.zip -------------------------------------------------------------------------------- /examples/private-rest-api-gateway/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## PROVIDER 3 | ####---------------------------------------------------------------------------------- 4 | 5 | provider "aws" { 6 | region = local.region 7 | } 8 | ####---------------------------------------------------------------------------------- 9 | ## LOCALS 10 | ####---------------------------------------------------------------------------------- 11 | 12 | locals { 13 | name = "api" 14 | environment = "test" 15 | region = "us-east-1" 16 | domain_name = "clouddrove.ca" 17 | hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" 18 | } 19 | ####---------------------------------------------------------------------------------- 20 | ## ACM 21 | ####---------------------------------------------------------------------------------- 22 | 23 | module "acm" { 24 | source = "clouddrove/acm/aws" 25 | version = "1.4.1" 26 | 27 | name = local.name 28 | environment = local.environment 29 | enable_aws_certificate = true 30 | domain_name = local.domain_name 31 | subject_alternative_names = ["*.${local.domain_name}"] 32 | validation_method = "DNS" 33 | enable_dns_validation = false 34 | } 35 | 36 | ####---------------------------------------------------------------------------------- 37 | ## LAMBDA 38 | ####---------------------------------------------------------------------------------- 39 | 40 | module "lambda" { 41 | source = "clouddrove/lambda/aws" 42 | version = "1.3.1" 43 | 44 | name = local.name 45 | environment = local.environment 46 | enable = true 47 | timeout = 60 48 | filename = "../lambda_packages/index.zip" 49 | handler = "index.lambda_handler" 50 | runtime = "python3.8" 51 | iam_actions = [ 52 | "logs:CreateLogStream", 53 | "logs:CreateLogGroup", 54 | "logs:PutLogEvents" 55 | ] 56 | names = [ 57 | "python_layer" 58 | ] 59 | compatible_runtimes = [ 60 | ["python3.8"] 61 | ] 62 | statement_ids = [ 63 | "AllowExecutionFromApiGateway" 64 | ] 65 | actions = [ 66 | "lambda:InvokeFunction" 67 | ] 68 | principals = [ 69 | "apigateway.amazonaws.com" 70 | ] 71 | variables = { 72 | foo = "bar" 73 | } 74 | } 75 | 76 | 77 | ####---------------------------------------------------------------------------------- 78 | ## VPC 79 | ####---------------------------------------------------------------------------------- 80 | 81 | module "vpc" { 82 | source = "clouddrove/vpc/aws" 83 | version = "2.0.0" 84 | 85 | name = "${local.name}-rest-api-private" 86 | environment = local.environment 87 | enable = true 88 | cidr_block = "10.0.0.0/16" 89 | 90 | } 91 | 92 | ####---------------------------------------------------------------------------------- 93 | ## SUBNETS 94 | ####---------------------------------------------------------------------------------- 95 | #tfsec:ignore:aws-ec2-no-excessive-port-access 96 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 97 | module "subnets" { 98 | source = "clouddrove/subnet/aws" 99 | version = "2.0.1" 100 | 101 | name = "${local.name}-rest-api-private" 102 | environment = local.environment 103 | 104 | nat_gateway_enabled = true 105 | single_nat_gateway = true 106 | availability_zones = ["${local.region}a", "${local.region}b", "${local.region}c"] 107 | vpc_id = module.vpc.vpc_id 108 | type = "public-private" 109 | igw_id = module.vpc.igw_id 110 | cidr_block = module.vpc.vpc_cidr_block 111 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 112 | enable_ipv6 = true 113 | private_inbound_acl_rules = [ 114 | { 115 | rule_number = 100 116 | rule_action = "allow" 117 | from_port = 0 118 | to_port = 0 119 | protocol = "-1" 120 | cidr_block = module.vpc.vpc_cidr_block 121 | } 122 | ] 123 | private_outbound_acl_rules = [ 124 | { 125 | rule_number = 100 126 | rule_action = "allow" 127 | from_port = 0 128 | to_port = 0 129 | protocol = "-1" 130 | cidr_block = module.vpc.vpc_cidr_block 131 | } 132 | ] 133 | public_inbound_acl_rules = [ 134 | { 135 | rule_number = 100 136 | rule_action = "allow" 137 | from_port = 0 138 | to_port = 0 139 | protocol = "-1" 140 | cidr_block = "0.0.0.0/0" 141 | } 142 | ] 143 | public_outbound_acl_rules = [ 144 | { 145 | rule_number = 100 146 | rule_action = "allow" 147 | from_port = 0 148 | to_port = 0 149 | protocol = "-1" 150 | cidr_block = "0.0.0.0/0" 151 | } 152 | ] 153 | 154 | } 155 | 156 | ####---------------------------------------------------------------------------------- 157 | ## SECURITY GROUP 158 | ####---------------------------------------------------------------------------------- 159 | 160 | module "security_group" { 161 | source = "clouddrove/security-group/aws" 162 | version = "2.0.0" 163 | 164 | name = "${local.name}-rest-api-private" 165 | environment = local.environment 166 | 167 | vpc_id = module.vpc.vpc_id 168 | new_sg_ingress_rules_with_cidr_blocks = [ 169 | { 170 | rule_count = 1 171 | from_port = 0 172 | protocol = "-1" 173 | to_port = 0 174 | cidr_blocks = [module.vpc.vpc_cidr_block] 175 | description = "Allow all traffic from ${local.environment} VPC." 176 | } 177 | ] 178 | new_sg_egress_rules_with_cidr_blocks = [ 179 | { 180 | rule_count = 1 181 | from_port = 0 182 | protocol = "-1" 183 | to_port = 0 184 | cidr_blocks = [module.vpc.vpc_cidr_block] 185 | description = "Allow all outbound traffic." 186 | } 187 | ] 188 | } 189 | 190 | 191 | ####---------------------------------------------------------------------------------- 192 | ## REST API PRIVATE 193 | ####---------------------------------------------------------------------------------- 194 | 195 | module "rest_api_private" { 196 | source = "../../." 197 | 198 | name = "${local.name}-rest-api-private" 199 | environment = local.environment 200 | enabled = true 201 | create_rest_api = true 202 | rest_api_endpoint_type = "PRIVATE" 203 | rest_api_description = "Private REST API for ${module.lambda.name} lambda function" 204 | integration_uri = module.lambda.invoke_arn 205 | rest_api_stage_name = "default" 206 | auto_deploy = true 207 | rest_api_base_path = "test" 208 | domain_name = "api.${local.domain_name}" 209 | zone_id = local.hosted_zone_id 210 | 211 | # -- VPC Endpoint configuration 212 | vpc_id = module.vpc.vpc_id 213 | subnet_ids = module.subnets.private_subnet_id 214 | security_group_ids = [module.security_group.security_group_id] 215 | service_name = "com.amazonaws.${local.region}.execute-api" 216 | vpc_endpoint_type = "Interface" 217 | private_dns_enabled = true 218 | domain_name_certificate_arn = module.acm.arn 219 | 220 | #---access log---- 221 | enable_access_logs = true 222 | retention_in_days = 7 223 | } 224 | 225 | 226 | -------------------------------------------------------------------------------- /examples/private-rest-api-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | ##------------------------------------------------------------- 2 | # REST API PRIVATE 3 | ##------------------------------------------------------------- 4 | 5 | output "private_rest_api_id" { 6 | value = module.rest_api_private.rest_api_id 7 | description = " The ID of the REST API" 8 | 9 | } 10 | 11 | output "private_rest_api_arn" { 12 | value = module.rest_api_private.rest_api_arn 13 | description = "The Rest api arn" 14 | 15 | } 16 | 17 | output "private_rest_api_invoke_url" { 18 | value = module.rest_api_private.rest_api_invoke_url 19 | description = "The URL to invoke the API pointing to the stage" 20 | 21 | } -------------------------------------------------------------------------------- /examples/private-rest-api-gateway/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /examples/rest-api-gateway/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## PROVIDER 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | 8 | ####---------------------------------------------------------------------------------- 9 | ## LOCALS 10 | ####---------------------------------------------------------------------------------- 11 | 12 | locals { 13 | name = "api" 14 | environment = "test" 15 | region = "us-east-1" 16 | domain_name = "clouddrove.ca" 17 | hosted_zone_id = "Z015XXXXXXXXXXXXXXIEP" 18 | } 19 | ####---------------------------------------------------------------------------------- 20 | ## ACM 21 | ####---------------------------------------------------------------------------------- 22 | module "acm" { 23 | source = "clouddrove/acm/aws" 24 | version = "1.4.1" 25 | 26 | name = local.name 27 | environment = local.environment 28 | enable_aws_certificate = true 29 | domain_name = local.domain_name 30 | subject_alternative_names = ["*.${local.domain_name}"] 31 | validation_method = "DNS" 32 | enable_dns_validation = false 33 | } 34 | 35 | ####---------------------------------------------------------------------------------- 36 | ## LAMBDA 37 | ####---------------------------------------------------------------------------------- 38 | module "lambda" { 39 | source = "clouddrove/lambda/aws" 40 | version = "1.3.1" 41 | 42 | name = local.name 43 | environment = local.environment 44 | enable = true 45 | timeout = 60 46 | filename = "../lambda_packages/index.zip" 47 | handler = "index.lambda_handler" 48 | runtime = "python3.8" 49 | iam_actions = [ 50 | "logs:CreateLogStream", 51 | "logs:CreateLogGroup", 52 | "logs:PutLogEvents" 53 | ] 54 | names = [ 55 | "python_layer" 56 | ] 57 | compatible_runtimes = [ 58 | ["python3.8"] 59 | ] 60 | statement_ids = [ 61 | "AllowExecutionFromApiGateway" 62 | ] 63 | actions = [ 64 | "lambda:InvokeFunction" 65 | ] 66 | principals = [ 67 | "apigateway.amazonaws.com" 68 | ] 69 | variables = { 70 | foo = "bar" 71 | } 72 | } 73 | 74 | 75 | ####---------------------------------------------------------------------------------- 76 | ## REST API 77 | ####---------------------------------------------------------------------------------- 78 | 79 | module "rest_api" { 80 | source = "../../." 81 | 82 | name = "${local.name}-rest-api" 83 | environment = local.environment 84 | create_rest_api = true 85 | domain_name_certificate_arn = module.acm.arn 86 | domain_name = "api.${local.domain_name}" 87 | zone_id = local.hosted_zone_id 88 | rest_api_description = "REST API for ${module.lambda.name} lambda function" 89 | rest_api_endpoint_type = "REGIONAL" 90 | integration_uri = module.lambda.invoke_arn 91 | rest_api_stage_name = "default" 92 | api_resources = { 93 | users = { 94 | path_part = "users" 95 | http_method = "ANY" 96 | uri = module.lambda.invoke_arn 97 | 98 | }, 99 | cards = { 100 | path_part = "cards" 101 | http_method = "ANY" 102 | uri = module.lambda.invoke_arn 103 | } 104 | } 105 | 106 | #---access log---- 107 | enable_access_logs = true 108 | retention_in_days = 7 109 | } 110 | 111 | 112 | 113 | 114 | 115 | 116 | -------------------------------------------------------------------------------- /examples/rest-api-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | ##------------------------------------------------------------- 2 | # REST API 3 | ##------------------------------------------------------------- 4 | 5 | output "rest_api_id" { 6 | value = module.rest_api.rest_api_id 7 | description = " The ID of the REST API" 8 | 9 | } 10 | 11 | output "rest_api_arn" { 12 | value = module.rest_api.rest_api_arn 13 | description = "The Rest api arn" 14 | } 15 | 16 | output "rest_api_invoke_url" { 17 | value = module.rest_api.rest_api_invoke_url 18 | description = "The URL to invoke the API pointing to the stage" 19 | 20 | } 21 | 22 | 23 | -------------------------------------------------------------------------------- /examples/rest-api-gateway/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /examples/vpc_link_api/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = "eu-west-1" 6 | } 7 | 8 | locals { 9 | vpc_cidr_block = module.vpc.vpc_cidr_block 10 | additional_cidr_block = "172.16.0.0/16" 11 | name = "api" 12 | environment = "test" 13 | } 14 | ####---------------------------------------------------------------------------------- 15 | ## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center. 16 | ####---------------------------------------------------------------------------------- 17 | module "vpc" { 18 | source = "clouddrove/vpc/aws" 19 | version = "2.0.0" 20 | 21 | name = local.name 22 | environment = local.environment 23 | cidr_block = "172.16.0.0/16" 24 | } 25 | 26 | ####---------------------------------------------------------------------------------- 27 | ## A subnet is a range of IP addresses in your VPC. 28 | ####---------------------------------------------------------------------------------- 29 | #tfsec:ignore:aws-ec2-no-public-ip-subnet 30 | module "public_subnets" { 31 | source = "clouddrove/subnet/aws" 32 | version = "2.0.1" 33 | 34 | name = local.name 35 | environment = local.environment 36 | availability_zones = ["eu-west-1b", "eu-west-1c"] 37 | vpc_id = module.vpc.vpc_id 38 | cidr_block = module.vpc.vpc_cidr_block 39 | type = "public" 40 | igw_id = module.vpc.igw_id 41 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 42 | } 43 | 44 | ##---------------------------------------------------------------------------------- 45 | ## Below module will create SECURITY-GROUP and its components. 46 | ##---------------------------------------------------------------------------------- 47 | 48 | # ################################################################################ 49 | # Security Groups module call 50 | ################################################################################ 51 | 52 | module "ssh" { 53 | source = "clouddrove/security-group/aws" 54 | version = "2.0.0" 55 | 56 | name = local.name 57 | environment = local.environment 58 | vpc_id = module.vpc.vpc_id 59 | new_sg_ingress_rules_with_cidr_blocks = [{ 60 | rule_count = 1 61 | from_port = 22 62 | protocol = "tcp" 63 | to_port = 22 64 | cidr_blocks = [local.vpc_cidr_block, local.additional_cidr_block] 65 | description = "Allow ssh traffic." 66 | }] 67 | 68 | ## EGRESS Rules 69 | new_sg_egress_rules_with_cidr_blocks = [{ 70 | rule_count = 1 71 | from_port = 22 72 | protocol = "tcp" 73 | to_port = 22 74 | cidr_blocks = [local.vpc_cidr_block, local.additional_cidr_block] 75 | description = "Allow ssh outbound traffic." 76 | }] 77 | } 78 | 79 | #tfsec:ignore:aws-ec2-no-public-egress-sgr 80 | module "http_https" { 81 | source = "clouddrove/security-group/aws" 82 | version = "2.0.0" 83 | 84 | name = local.name 85 | environment = local.environment 86 | vpc_id = module.vpc.vpc_id 87 | ## INGRESS Rules 88 | new_sg_ingress_rules_with_cidr_blocks = [{ 89 | rule_count = 1 90 | from_port = 22 91 | protocol = "tcp" 92 | to_port = 22 93 | cidr_blocks = [local.vpc_cidr_block] 94 | description = "Allow ssh traffic." 95 | }, 96 | { 97 | rule_count = 2 98 | from_port = 80 99 | protocol = "tcp" 100 | to_port = 80 101 | cidr_blocks = [local.vpc_cidr_block] 102 | description = "Allow http traffic." 103 | }, 104 | { 105 | rule_count = 3 106 | from_port = 443 107 | protocol = "tcp" 108 | to_port = 443 109 | cidr_blocks = [local.vpc_cidr_block] 110 | description = "Allow https traffic." 111 | }, 112 | { 113 | rule_count = 3 114 | from_port = 3306 115 | protocol = "tcp" 116 | to_port = 3306 117 | cidr_blocks = [local.vpc_cidr_block] 118 | description = "Allow https traffic." 119 | } 120 | ] 121 | 122 | ## EGRESS Rules 123 | new_sg_egress_rules_with_cidr_blocks = [{ 124 | rule_count = 1 125 | from_port = 0 126 | protocol = "-1" 127 | to_port = 0 128 | cidr_blocks = ["0.0.0.0/0"] 129 | ipv6_cidr_blocks = ["::/0"] 130 | description = "Allow all traffic." 131 | } 132 | ] 133 | } 134 | 135 | ####---------------------------------------------------------------------------------- 136 | ## This terraform module is designed to generate consistent label names and tags for resources. 137 | ####---------------------------------------------------------------------------------- 138 | module "acm" { 139 | source = "clouddrove/acm/aws" 140 | version = "1.4.1" 141 | 142 | name = local.name 143 | environment = local.environment 144 | enable_aws_certificate = true 145 | domain_name = "clouddrove.ca" 146 | subject_alternative_names = ["*.clouddrove.ca"] 147 | validation_method = "DNS" 148 | enable_dns_validation = false 149 | } 150 | 151 | ####---------------------------------------------------------------------------------- 152 | ## This terraform module is designed to generate consistent label names and tags for resources. 153 | ####---------------------------------------------------------------------------------- 154 | module "lambda" { 155 | source = "clouddrove/lambda/aws" 156 | version = "1.3.1" 157 | 158 | name = local.name 159 | environment = local.environment 160 | enable = true 161 | timeout = 60 162 | filename = "./lambda_packages" 163 | handler = "index.lambda_handler" 164 | runtime = "python3.8" 165 | iam_actions = [ 166 | "logs:CreateLogStream", 167 | "logs:CreateLogGroup", 168 | "logs:PutLogEvents" 169 | ] 170 | names = [ 171 | "python_layer" 172 | ] 173 | layer_filenames = ["./lambda-test.zip"] 174 | compatible_runtimes = [ 175 | ["python3.8"] 176 | ] 177 | statement_ids = [ 178 | "AllowExecutionFromCloudWatch" 179 | ] 180 | actions = [ 181 | "lambda:InvokeFunction" 182 | ] 183 | principals = [ 184 | "events.amazonaws.com" 185 | ] 186 | source_arns = [module.api_gateway.api_arn] 187 | variables = { 188 | foo = "bar" 189 | } 190 | } 191 | 192 | ####---------------------------------------------------------------------------------- 193 | ## This terraform module is designed to generate consistent label names and tags for resources with vpc_link. 194 | ####---------------------------------------------------------------------------------- 195 | module "api_gateway" { 196 | source = "./../../" 197 | 198 | name = local.name 199 | environment = local.environment 200 | domain_name = "clouddrove.ca" 201 | create_vpc_link_enabled = true 202 | zone_id = "1`23456059QJZ25345678" 203 | integration_uri = module.lambda.arn 204 | domain_name_certificate_arn = module.acm.arn 205 | subnet_ids = tolist(module.public_subnets.public_subnet_id) 206 | security_group_ids = [module.ssh.security_group_id, module.http_https.security_group_id] 207 | cors_configuration = { 208 | allow_credentials = true 209 | allow_methods = ["GET", "OPTIONS", "POST"] 210 | max_age = 5 211 | } 212 | integrations = { 213 | "ANY /" = { 214 | lambda_arn = module.lambda.arn 215 | payload_format_version = "2.0" 216 | timeout_milliseconds = 12000 217 | } 218 | "GET /some-route-with-authorizer" = { 219 | lambda_arn = module.lambda.arn 220 | payload_format_version = "2.0" 221 | authorizer_key = "cognito" 222 | } 223 | "POST /start-step-function" = { 224 | lambda_arn = module.lambda.arn 225 | payload_format_version = "2.0" 226 | authorizer_key = "cognito" 227 | } 228 | } 229 | } -------------------------------------------------------------------------------- /examples/vpc_link_api/lambda-test.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/clouddrove/terraform-aws-api-gateway/226598b35a0769d30c42fb7c1abdf3a68c583c74/examples/vpc_link_api/lambda-test.zip -------------------------------------------------------------------------------- /examples/vpc_link_api/lambda_packages/index.py: -------------------------------------------------------------------------------- 1 | import os 2 | import json 3 | 4 | def lambda_handler(event, context): 5 | json_region = os.environ['AWS_REGION'] 6 | return { 7 | "statusCode": 200, 8 | "headers": { 9 | "Content-Type": "application/json" 10 | }, 11 | "body": json.dumps({ 12 | "Region ": json_region 13 | }) 14 | } 15 | -------------------------------------------------------------------------------- /examples/vpc_link_api/outputs.tf: -------------------------------------------------------------------------------- 1 | output "api_id" { 2 | value = join("", module.api_gateway[*].api_id) 3 | description = "The API identifier." 4 | } 5 | 6 | output "api_arn" { 7 | value = join("", module.api_gateway[*].api_arn) 8 | description = "The API arn." 9 | } 10 | 11 | output "api_endpoint" { 12 | value = join("", module.api_gateway[*].api_endpoint) 13 | description = "The URI of the API, of the form {api-id}.execute-api.{region}.amazonaws.com." 14 | } 15 | 16 | output "invoke_url" { 17 | value = join("", module.api_gateway[*].invoke_url) 18 | description = "URL to invoke the API pointing to the stage" 19 | } -------------------------------------------------------------------------------- /examples/vpc_link_api/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.1" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.20.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | ##---------------------------------------------------------------------------------- 2 | ## Labels module callled that will be used for naming and tags. 3 | ##---------------------------------------------------------------------------------- 4 | module "labels" { 5 | source = "clouddrove/labels/aws" 6 | version = "1.3.0" 7 | 8 | name = var.name 9 | environment = var.environment 10 | managedby = var.managedby 11 | label_order = var.label_order 12 | repository = var.repository 13 | } 14 | 15 | ##---------------------------------------------------------------------------------- 16 | ## Below resource will Manages an Amazon API Gateway Version 2 API. 17 | ##---------------------------------------------------------------------------------- 18 | resource "aws_apigatewayv2_api" "default" { 19 | count = var.enabled && var.create_http_api ? 1 : 0 20 | 21 | name = module.labels.id 22 | description = var.api_description 23 | protocol_type = var.protocol_type 24 | version = var.api_version 25 | body = var.body 26 | route_selection_expression = var.route_selection_expression 27 | api_key_selection_expression = var.api_key_selection_expression 28 | route_key = var.route_key 29 | credentials_arn = var.credentials_arn 30 | target = var.target 31 | dynamic "cors_configuration" { 32 | for_each = length(keys(var.cors_configuration)) == 0 ? [] : [var.cors_configuration] 33 | content { 34 | allow_credentials = try(cors_configuration.value.allow_credentials, null) 35 | allow_headers = try(cors_configuration.value.allow_headers, null) 36 | allow_methods = try(cors_configuration.value.allow_methods, null) 37 | allow_origins = try(cors_configuration.value.allow_origins, null) 38 | expose_headers = try(cors_configuration.value.expose_headers, null) 39 | max_age = try(cors_configuration.value.max_age, null) 40 | } 41 | } 42 | tags = module.labels.tags 43 | } 44 | 45 | ##---------------------------------------------------------------------------------- 46 | ## Below resource will Manages an Amazon API Gateway Version 2 domain name. 47 | ##---------------------------------------------------------------------------------- 48 | resource "aws_apigatewayv2_domain_name" "default" { 49 | count = var.enabled && var.create_api_domain_name_enabled && (var.create_http_api || var.create_rest_api) ? 1 : 0 50 | 51 | domain_name = var.domain_name 52 | domain_name_configuration { 53 | certificate_arn = var.domain_name_certificate_arn 54 | ownership_verification_certificate_arn = var.domain_name_ownership_verification_certificate_arn 55 | endpoint_type = "REGIONAL" 56 | security_policy = "TLS_1_2" 57 | } 58 | 59 | dynamic "mutual_tls_authentication" { 60 | for_each = var.mutual_tls_authentication 61 | content { 62 | truststore_uri = mutual_tls_authentication.value.truststore_uri 63 | truststore_version = lookup(mutual_tls_authentication.value.truststore_version, null) 64 | } 65 | } 66 | 67 | tags = module.labels.tags 68 | } 69 | 70 | ##---------------------------------------------------------------------------------- 71 | ## Below Provides a Route53 record resource. 72 | ##---------------------------------------------------------------------------------- 73 | resource "aws_route53_record" "default" { 74 | count = var.enabled && (var.create_http_api || var.create_rest_api) && var.rest_api_endpoint_type != "PRIVATE" ? 1 : 0 75 | 76 | name = join("", aws_apigatewayv2_domain_name.default[*].domain_name) 77 | type = "A" 78 | zone_id = var.zone_id 79 | alias { 80 | name = join("", aws_apigatewayv2_domain_name.default[*].domain_name_configuration[0].target_domain_name) 81 | zone_id = join("", aws_apigatewayv2_domain_name.default[*].domain_name_configuration[0].hosted_zone_id) 82 | evaluate_target_health = false 83 | } 84 | } 85 | 86 | ##---------------------------------------------------------------------------------- 87 | ## Below Manages an Amazon API Gateway Version 2 stage. 88 | ##---------------------------------------------------------------------------------- 89 | #tfsec:ignore:aws-api-gateway-enable-access-logging 90 | resource "aws_apigatewayv2_stage" "default" { 91 | count = var.enabled && var.create_default_stage_enabled && var.create_http_api ? 1 : 0 92 | 93 | api_id = aws_apigatewayv2_api.default[0].id 94 | name = var.stage_name != null ? var.stage_name : format("%s-stage", module.labels.id) 95 | auto_deploy = var.auto_deploy 96 | 97 | dynamic "access_log_settings" { 98 | for_each = var.access_log_settings 99 | content { 100 | destination_arn = var.default_stage_access_log_destination_arn 101 | format = var.default_stage_access_log_format 102 | } 103 | } 104 | 105 | dynamic "default_route_settings" { 106 | for_each = var.default_route_settings 107 | 108 | content { 109 | data_trace_enabled = lookup(default_route_settings.value.data_trace_enabled, false) 110 | logging_level = lookup(default_route_settings.value.logging_level, null) 111 | 112 | detailed_metrics_enabled = lookup(default_route_settings.value.detailed_metrics_enabled, false) 113 | throttling_burst_limit = lookup(default_route_settings.value.throttling_burst_limit, null) 114 | throttling_rate_limit = lookup(default_route_settings.value.throttling_rate_limit, null) 115 | } 116 | } 117 | 118 | dynamic "route_settings" { 119 | for_each = var.route_settings 120 | content { 121 | route_key = route_settings.key 122 | data_trace_enabled = lookup(route_settings.value, "data_trace_enabled", false) 123 | logging_level = lookup(route_settings.value, "logging_level", null) 124 | detailed_metrics_enabled = lookup(route_settings.value, "detailed_metrics_enabled", false) 125 | throttling_burst_limit = lookup(route_settings.value, "throttling_burst_limit", null) 126 | throttling_rate_limit = lookup(route_settings.value, "throttling_rate_limit", null) 127 | } 128 | } 129 | 130 | tags = module.labels.tags 131 | } 132 | 133 | ##---------------------------------------------------------------------------------- 134 | ## Below resource will Manages an Amazon API Gateway Version 2 API mapping. 135 | ##---------------------------------------------------------------------------------- 136 | resource "aws_apigatewayv2_api_mapping" "default" { 137 | count = var.enabled && var.apigatewayv2_api_mapping_enabled && var.create_http_api ? 1 : 0 138 | 139 | api_id = join("", aws_apigatewayv2_api.default[*].id) 140 | domain_name = join("", aws_apigatewayv2_domain_name.default[*].id) 141 | stage = join("", aws_apigatewayv2_stage.default[*].id) 142 | } 143 | 144 | ##---------------------------------------------------------------------------------- 145 | ## Below resource will Manages an Amazon API Gateway Version 2 route. 146 | ##---------------------------------------------------------------------------------- 147 | resource "aws_apigatewayv2_route" "default" { 148 | for_each = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? var.integrations : {} 149 | 150 | api_id = aws_apigatewayv2_api.default[0].id 151 | route_key = each.key 152 | 153 | api_key_required = try(each.value.api_key_required, null) 154 | authorization_scopes = try(split(",", each.value.authorization_scopes), null) 155 | authorization_type = try(each.value.authorization_type, "NONE") 156 | authorizer_id = try(aws_apigatewayv2_authorizer.default[each.value.authorizer_key].id, each.value.authorizer_id, null) 157 | model_selection_expression = try(each.value.model_selection_expression, null) 158 | operation_name = try(each.value.operation_name, null) 159 | route_response_selection_expression = try(each.value.route_response_selection_expression, null) 160 | target = "integrations/${(aws_apigatewayv2_integration.default[each.key].id)}" 161 | } 162 | 163 | ##---------------------------------------------------------------------------------- 164 | ## Below resource will Manages an Amazon API Gateway Version 2 integration. 165 | ##---------------------------------------------------------------------------------- 166 | 167 | resource "aws_apigatewayv2_integration" "default" { 168 | for_each = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? var.integrations : {} 169 | 170 | api_id = join("", aws_apigatewayv2_api.default[*].id) 171 | integration_type = var.integration_type 172 | connection_type = var.connection_type 173 | description = var.integration_description 174 | integration_method = var.integration_method 175 | integration_uri = var.integration_uri 176 | passthrough_behavior = var.passthrough_behavior 177 | payload_format_version = try(each.value.payload_format_version, null) 178 | } 179 | 180 | ##---------------------------------------------------------------------------------- 181 | ## Below resource will Manages an Amazon API Gateway Version 2 authorizer. 182 | ##---------------------------------------------------------------------------------- 183 | resource "aws_apigatewayv2_authorizer" "default" { 184 | for_each = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? var.authorizers : {} 185 | 186 | api_id = aws_apigatewayv2_api.default[0].id 187 | authorizer_type = lookup(each.value.authorizer_type, null) 188 | identity_sources = lookup(flatten([each.value.identity_sources]), null) 189 | name = lookup(each.value.name, null) 190 | authorizer_uri = lookup(each.value.authorizer_uri, null) 191 | authorizer_payload_format_version = lookup(each.value.authorizer_payload_format_version, null) 192 | authorizer_result_ttl_in_seconds = lookup(each.value.authorizer_result_ttl_in_seconds, null) 193 | authorizer_credentials_arn = lookup(each.value.authorizer_credentials_arn, null) 194 | enable_simple_responses = lookup(each.value.enable_simple_responses, null) 195 | } 196 | 197 | ##---------------------------------------------------------------------------------- 198 | ## Below resource will Manages an Amazon API Gateway Version 2 VPC Link. 199 | ##---------------------------------------------------------------------------------- 200 | resource "aws_apigatewayv2_vpc_link" "default" { 201 | for_each = var.enabled && var.create_vpc_link_enabled && var.create_http_api ? var.vpc_links : {} 202 | 203 | name = format("%s", module.labels.id) 204 | security_group_ids = var.security_group_ids 205 | subnet_ids = var.subnet_ids 206 | tags = module.labels.tags 207 | 208 | } 209 | 210 | ##---------------------------------------------------------------------------------- 211 | ## Below resource will Manages an Amazon API Gateway Version 2 authorizer. 212 | ##---------------------------------------------------------------------------------- 213 | resource "aws_apigatewayv2_authorizer" "some_authorizer" { 214 | count = var.enabled && var.create_routes_and_integrations_enabled && var.create_http_api ? 1 : 0 215 | 216 | api_id = aws_apigatewayv2_api.default[0].id 217 | authorizer_type = var.authorizer_type 218 | identity_sources = var.identity_sources 219 | name = module.labels.id 220 | jwt_configuration { 221 | audience = ["example"] 222 | issuer = "https://${aws_cognito_user_pool.default.endpoint}" 223 | } 224 | } 225 | 226 | ##---------------------------------------------------------------------------------- 227 | ## Below resource will Provides a Cognito User Pool resource. 228 | ##---------------------------------------------------------------------------------- 229 | resource "aws_cognito_user_pool" "default" { 230 | name = module.labels.id 231 | } 232 | 233 | ##---------------------------------------------------------------------------------- 234 | ## Below resource will Provides a REST API resource. 235 | ##---------------------------------------------------------------------------------- 236 | resource "aws_api_gateway_rest_api" "rest_api" { 237 | count = var.enabled && var.create_rest_api ? 1 : 0 238 | 239 | name = module.labels.id 240 | description = var.rest_api_description 241 | tags = module.labels.tags 242 | 243 | endpoint_configuration { 244 | types = [var.rest_api_endpoint_type] 245 | vpc_endpoint_ids = var.rest_api_endpoint_type == "PRIVATE" ? (var.create_vpc_endpoint ? [aws_vpc_endpoint.rest_api_private[0].id] : var.vpc_endpoint_id) : null 246 | } 247 | } 248 | 249 | ##-------------------------------------------------------------------------------- 250 | # Resource Policy for [aws_api_gateway_rest_api.rest_api] 251 | ##-------------------------------------------------------------------------------- 252 | resource "aws_api_gateway_rest_api_policy" "rest_api_resource_policy" { 253 | count = var.enabled && var.create_rest_api && var.rest_api_endpoint_type == "PRIVATE" ? 1 : 0 254 | 255 | rest_api_id = aws_api_gateway_rest_api.rest_api[0].id 256 | policy = var.rest_api_resource_policy != "" ? var.rest_api_resource_policy : <
""
]