mirror of
https://github.com/Hestia-Homes/Model.git
synced 2026-07-12 13:29:04 +00:00
b6746cc24a
New lambda_with_sqs consumer (timeout 900, memory 3008, ephemeral_storage 10240 for multi-GB ZIPs); dedicated retrofit-document-exports bucket (no lifecycle on DATA_BUCKET); IAM to read source buckets + write/presign-read the exports bucket; SES SMTP creds baked from Secrets Manager (no ses:* on the role). Adds ephemeral_storage_size knob to the shared lambda modules (default 512, backward compatible). Wires the queue url+arn into fast-api and orders the CI jobs (ADR-0055). NOTE: terraform is drafted, not validated (no AWS/terraform in the dev env). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
111 lines
4.1 KiB
HCL
111 lines
4.1 KiB
HCL
############################################
|
|
# Credentials from Secrets Manager (resolved at plan/apply time and baked into
|
|
# env vars). The SES SMTP credentials are an IAM *user* (see modules/ses), so
|
|
# the Lambda authenticates to SES over SMTP with them — the execution role needs
|
|
# neither ses:* nor runtime secretsmanager access.
|
|
############################################
|
|
data "aws_secretsmanager_secret_version" "db_credentials" {
|
|
secret_id = "${var.stage}/assessment_model/db_credentials"
|
|
}
|
|
|
|
data "aws_secretsmanager_secret_version" "ses_smtp" {
|
|
secret_id = "${var.stage}/ses/smtp_credentials"
|
|
}
|
|
|
|
locals {
|
|
db_credentials = jsondecode(data.aws_secretsmanager_secret_version.db_credentials.secret_string)
|
|
ses_smtp = jsondecode(data.aws_secretsmanager_secret_version.ses_smtp.secret_string)
|
|
|
|
document_exports_bucket = "retrofit-document-exports-${var.stage}"
|
|
|
|
# Source buckets the uploaded_files rows point at (read for packaging).
|
|
# OPEN QUESTION: confirm this is the closed set — if files can live in
|
|
# arbitrary buckets, widen to ["arn:aws:s3:::*"].
|
|
source_bucket_arns = [
|
|
"arn:aws:s3:::retrofit-data-${var.stage}",
|
|
"arn:aws:s3:::retrofit-energy-assessments-${var.stage}",
|
|
]
|
|
}
|
|
|
|
############################################
|
|
# Lambda + SQS queue + trigger
|
|
############################################
|
|
module "lambda" {
|
|
source = "../../modules/lambda_with_sqs"
|
|
|
|
name = var.lambda_name
|
|
stage = var.stage
|
|
|
|
image_uri = local.image_uri
|
|
|
|
reserved_concurrent_executions = var.reserved_concurrent_executions
|
|
|
|
batch_size = var.batch_size
|
|
maximum_concurrency = var.maximum_concurrency
|
|
|
|
timeout = 900
|
|
memory_size = 3008
|
|
# A Download Package can be several GB; it is streamed to /tmp before the
|
|
# multipart upload (ADR-0060), so raise ephemeral storage to the 10 GB max.
|
|
ephemeral_storage_size = 10240
|
|
|
|
environment = {
|
|
STAGE = var.stage
|
|
LOG_LEVEL = "info"
|
|
|
|
POSTGRES_USERNAME = local.db_credentials.db_assessment_model_username
|
|
POSTGRES_PASSWORD = local.db_credentials.db_assessment_model_password
|
|
POSTGRES_HOST = var.db_host
|
|
POSTGRES_DATABASE = var.db_name
|
|
POSTGRES_PORT = var.db_port
|
|
|
|
DOCUMENT_EXPORTS_BUCKET = local.document_exports_bucket
|
|
|
|
# SES SMTP — IAM-user credentials sourced from Secrets Manager (modules/ses).
|
|
SES_SMTP_HOST = "email-smtp.eu-west-2.amazonaws.com"
|
|
SES_SMTP_PORT = "587"
|
|
SES_SMTP_USERNAME = local.ses_smtp.username
|
|
SES_SMTP_PASSWORD = local.ses_smtp.password
|
|
SES_SMTP_FROM_ADDRESS = var.ses_from_address
|
|
}
|
|
}
|
|
|
|
############################################
|
|
# IAM: read uploaded documents from their source buckets
|
|
############################################
|
|
module "s3_read" {
|
|
source = "../../modules/s3_iam_policy"
|
|
|
|
policy_name = "BulkDocumentDownloadS3Read-${var.stage}"
|
|
policy_description = "Allow bulk_document_download Lambda to read uploaded_files objects from their source buckets"
|
|
bucket_arns = local.source_bucket_arns
|
|
actions = ["s3:GetObject", "s3:ListBucket"]
|
|
resource_paths = ["/*"]
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "s3_read" {
|
|
role = module.lambda.role_name
|
|
policy_arn = module.s3_read.policy_arn
|
|
}
|
|
|
|
############################################
|
|
# IAM: write + read the assembled ZIP on the dedicated exports bucket.
|
|
# GetObject is required so the Lambda-signed presigned GET URL resolves.
|
|
############################################
|
|
module "s3_exports" {
|
|
source = "../../modules/s3_iam_policy"
|
|
|
|
policy_name = "BulkDocumentDownloadS3Exports-${var.stage}"
|
|
policy_description = "Allow bulk_document_download Lambda to write and presign-read Download Packages on the exports bucket"
|
|
bucket_arns = ["arn:aws:s3:::${local.document_exports_bucket}"]
|
|
actions = ["s3:PutObject", "s3:GetObject"]
|
|
resource_paths = ["/*"]
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "s3_exports" {
|
|
role = module.lambda.role_name
|
|
policy_arn = module.s3_exports.policy_arn
|
|
}
|
|
|
|
# NOTE: no ses:* on the role — the handler sends over SMTP with the SES IAM-user
|
|
# credentials injected above.
|