Skip to content

CCM-22820: Add tags for lambda IAM policy #280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sidnhs merged 4 commits into from
Sep 14, 2026
Merged

CCM-22820: Add tags for lambda IAM policy #280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d0e56bf
CCM-22820: Add tags to lambda role and policy
sidnhs Sep 11, 2026
0c94d74
CCM-22820: Add tags to lambda role and policy
sidnhs Sep 11, 2026
ca9ad06
CCM-22820: Fix workflow
sidnhs Sep 14, 2026
43cee52
CCM-22820: Fix workflow
sidnhs Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/cicd-1-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ permissions:
id-token: write
contents: write
packages: write
pull-requests: read

jobs:
metadata:
Expand Down
1 change: 1 addition & 0 deletions .tool-versions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ ruby 3.2.0
# docker/hadolint/hadolint 2.12.0-alpine@sha256:7dba9a9f1a0350f6d021fb2f6f88900998a4fb0aaf8e4330aa8c38544f04db42 # SEE: https://hub.docker.com/r/hadolint/hadolint/tags
# docker/hashicorp/terraform 1.5.6@sha256:180a7efa983386a27b43657ed610e9deed9e6c3848d54f9ea9b6cb8a5c8c25f5 # SEE: https://hub.docker.com/r/hashicorp/terraform/tags
# docker/jdkato/vale v3.6.0@sha256:0ef22c8d537f079633cfff69fc46f69a2196072f69cab1ab232e8a79a388e425 # SEE: https://hub.docker.com/r/jdkato/vale/tags
# docker/quay.io/terraform-docs/terraform-docs 0.24.0-amd64@sha256:16990b28302390f7c4ae398b371a46762b6b3eb8534e75eeee8185caa8029b8c # SEE: https://quay.io/repository/terraform-docs/terraform-docs?tab=tags
# docker/koalaman/shellcheck latest@sha256:e40388688bae0fcffdddb7e4dea49b900c18933b452add0930654b2dea3e7d5c # SEE: https://hub.docker.com/r/koalaman/shellcheck/tags
# docker/mstruebing/editorconfig-checker 2.7.1@sha256:dd3ca9ea50ef4518efe9be018d669ef9cf937f6bb5cfe2ef84ff2a620b5ddc24 # SEE: https://hub.docker.com/r/mstruebing/editorconfig-checker/tags
# docker/sonarsource/sonar-scanner-cli 11.3@sha256:7462f132388135e32b948f8f18ff0db9ae28a87c6777f1df5b2207e04a6d7c5c # SEE: https://hub.docker.com/r/sonarsource/sonar-scanner-cli/tags
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/amp_branch/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_amplify_app_id"></a> [amplify\_app\_id](#input\_amplify\_app\_id) | Amplify application ID | `string` | n/a | yes |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_branch"></a> [branch](#input\_branch) | The name of the branch being deployed | `string` | n/a | yes |
Expand All @@ -34,7 +34,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_name"></a> [name](#output\_name) | Name of the Amplify branch |

<!-- vale on -->
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/apim-authentication/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_acct_s3_buckets"></a> [acct\_s3\_buckets](#input\_acct\_s3\_buckets) | Account S3 buckets | `map(any)` | n/a | yes |
| <a name="input_apim_auth_token_schedule"></a> [apim\_auth\_token\_schedule](#input\_apim\_auth\_token\_schedule) | Schedule to renew the APIM auth token | `string` | `"rate(9 minutes)"` | no |
| <a name="input_apim_auth_token_url"></a> [apim\_auth\_token\_url](#input\_apim\_auth\_token\_url) | URL to generate an APIM auth token | `string` | n/a | yes |
Expand Down Expand Up @@ -41,7 +41,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_apim_access_token_ssm_parameter"></a> [apim\_access\_token\_ssm\_parameter](#output\_apim\_access\_token\_ssm\_parameter) | APIM Access Token SSM parameter details |

<!-- vale on -->
Expand Down
2 changes: 1 addition & 1 deletion infrastructure/terraform/modules/aws-backup-source/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ No requirements.
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_backup_copy_vault_account_id"></a> [backup\_copy\_vault\_account\_id](#input\_backup\_copy\_vault\_account\_id) | The account id of the destination backup vault for allowing restores back into the source account. | `string` | `""` | no |
| <a name="input_backup_copy_vault_arn"></a> [backup\_copy\_vault\_arn](#input\_backup\_copy\_vault\_arn) | The ARN of the destination backup vault for cross-account backup copies. | `string` | `""` | no |
| <a name="input_backup_plan_config_dynamodb"></a> [backup\_plan\_config\_dynamodb](#input\_backup\_plan\_config\_dynamodb) | Configuration for backup plans with dynamodb | <pre>object({<br/> enable = bool<br/> selection_tag = string<br/> compliance_resource_types = list(string)<br/> rules = optional(list(object({<br/> name = string<br/> schedule = string<br/> enable_continuous_backup = optional(bool)<br/> lifecycle = object({<br/> delete_after = number<br/> cold_storage_after = optional(number)<br/> })<br/> copy_action = optional(object({<br/> delete_after = optional(number)<br/> }))<br/> })))<br/> })</pre> | <pre>{<br/> "compliance_resource_types": [<br/> "DynamoDB"<br/> ],<br/> "enable": false,<br/> "rules": [<br/> {<br/> "copy_action": {<br/> "delete_after": 365<br/> },<br/> "lifecycle": {<br/> "delete_after": 35<br/> },<br/> "name": "dynamodb_daily_kept_5_weeks",<br/> "schedule": "cron(0 0 * * ? *)"<br/> },<br/> {<br/> "copy_action": {<br/> "delete_after": 365<br/> },<br/> "lifecycle": {<br/> "delete_after": 90<br/> },<br/> "name": "dynamodb_weekly_kept_3_months",<br/> "schedule": "cron(0 1 ? * SUN *)"<br/> },<br/> {<br/> "copy_action": {<br/> "delete_after": 365<br/> },<br/> "lifecycle": {<br/> "cold_storage_after": 30,<br/> "delete_after": 2555<br/> },<br/> "name": "dynamodb_monthly_kept_7_years",<br/> "schedule": "cron(0 2 1 * ? *)"<br/> }<br/> ],<br/> "selection_tag": "BackupDynamoDB"<br/>}</pre> | no |
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/eventpub/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_access_logging_bucket"></a> [access\_logging\_bucket](#input\_access\_logging\_bucket) | S3 Access logging bucket name. | `string` | `""` | no |
| <a name="input_additional_policies_for_event_cache_bucket"></a> [additional\_policies\_for\_event\_cache\_bucket](#input\_additional\_policies\_for\_event\_cache\_bucket) | A list of JSON policies to use to build the bucket policy | `list(string)` | `[]` | no |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
Expand Down Expand Up @@ -45,7 +45,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_publishing_anomaly_alarm"></a> [publishing\_anomaly\_alarm](#output\_publishing\_anomaly\_alarm) | CloudWatch anomaly detection alarm details for SNS publishing |
| <a name="output_s3_bucket_event_cache"></a> [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache |
| <a name="output_sns_topic"></a> [sns\_topic](#output\_sns\_topic) | SNS Topic ARN and Name |
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/eventsub/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_access_logging_bucket"></a> [access\_logging\_bucket](#input\_access\_logging\_bucket) | Name of S3 bucket to use for access logging | `string` | `""` | no |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes |
Expand Down Expand Up @@ -42,7 +42,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_s3_bucket_event_cache"></a> [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache |
| <a name="output_sns_topic"></a> [sns\_topic](#output\_sns\_topic) | SNS Topic ARN and Name |

Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/kms/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_alias"></a> [alias](#input\_alias) | Alias name for the hieradata KMS key | `string` | n/a | yes |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes |
Expand All @@ -29,7 +29,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_admin_policy_arn"></a> [admin\_policy\_arn](#output\_admin\_policy\_arn) | ARN of the admin IAM policy |
| <a name="output_key_arn"></a> [key\_arn](#output\_key\_arn) | ARN of the KMS key |
| <a name="output_key_id"></a> [key\_id](#output\_key\_id) | ID of the KMS key |
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/lambda/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,13 @@ output "processor_lambda_error_rate_alarm_arn" {
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_application_log_level"></a> [application\_log\_level](#input\_application\_log\_level) | The detail level of the logs the application sends to CloudWatch | `string` | `"INFO"` | no |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |
Expand Down Expand Up @@ -91,7 +91,7 @@ output "processor_lambda_error_rate_alarm_arn" {
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of the CloudWatch Log Group for the Lambda function |
| <a name="output_function_arn"></a> [function\_arn](#output\_function\_arn) | ARN of the Lambda function |
| <a name="output_function_env_vars"></a> [function\_env\_vars](#output\_function\_env\_vars) | Environment variables for the Lambda function |
Expand Down
2 changes: 2 additions & 0 deletions infrastructure/terraform/modules/lambda/iam_policy.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,6 @@ resource "aws_iam_policy" "main" {
name = local.csi
description = "Policy created from the data object supplied through the modules attributes"
policy = var.iam_policy_document.body

tags = local.default_tags
}
1 change: 1 addition & 0 deletions infrastructure/terraform/modules/lambda/iam_role.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
resource "aws_iam_role" "main" {
name = local.csi
assume_role_policy = data.aws_iam_policy_document.lambda_assumerole.json
tags = local.default_tags
}
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/obs-datasource/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes |
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | Default tag map for application to all taggable resources in the module | `map(string)` | `{}` | no |
Expand All @@ -29,7 +29,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_log_subscription_role_arn"></a> [log\_subscription\_role\_arn](#output\_log\_subscription\_role\_arn) | The ARN of the log subscription IAM role. |

<!-- vale on -->
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/s3bucket/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_acl"></a> [acl](#input\_acl) | ACL to set on the bucket. Defaults to private | `string` | `"private"` | no |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_bucket_key_enabled"></a> [bucket\_key\_enabled](#input\_bucket\_key\_enabled) | Boolean to toggle bucket key enablement | `bool` | `true` | no |
Expand All @@ -37,7 +37,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_acl"></a> [acl](#output\_acl) | The ACL of the S3 bucket. If the object ownership is set to 'BucketOwnerEnforced', the ACL will be 'private'. Otherwise, it will reflect the ACL set in the aws\_s3\_bucket\_acl resource. |
| <a name="output_arn"></a> [arn](#output\_arn) | The ARN of the S3 bucket |
| <a name="output_bucket"></a> [bucket](#output\_bucket) | The name of the S3 bucket |
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/sqs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_allowed_arns"></a> [allowed\_arns](#input\_allowed\_arns) | A list of AWS account IDs allowed to access this resource | `list(any)` | `null` | no |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |
Expand Down Expand Up @@ -42,7 +42,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_sqs_dlq_arn"></a> [sqs\_dlq\_arn](#output\_sqs\_dlq\_arn) | The ARN of the SQS dead-letter queue |
| <a name="output_sqs_dlq_messages_alarm_arn"></a> [sqs\_dlq\_messages\_alarm\_arn](#output\_sqs\_dlq\_messages\_alarm\_arn) | The ARN of the CloudWatch alarm for messages in the SQS dead-letter queue |
| <a name="output_sqs_dlq_messages_alarm_name"></a> [sqs\_dlq\_messages\_alarm\_name](#output\_sqs\_dlq\_messages\_alarm\_name) | The name of the CloudWatch alarm for messages in the SQS dead-letter queue |
Expand Down
6 changes: 3 additions & 3 deletions infrastructure/terraform/modules/ssl/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.10.1 |
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | 4.1.0 |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
Expand All @@ -31,7 +31,7 @@
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_cacert_pem"></a> [cacert\_pem](#output\_cacert\_pem) | Truststore |
| <a name="output_server_crt"></a> [server\_crt](#output\_server\_crt) | Server Certificate |
| <a name="output_server_key"></a> [server\_key](#output\_server\_key) | Server Key |
Expand Down
Loading