Terraform多个云观察事件触发相同的lambda函数

Question

我已经在Terraform中设置了以下内容。所以有两条事件规则，上午8点开始\u事件，下午6点停止\u事件。

# Create cloudwatch event rules
resource "aws_cloudwatch_event_rule" "stop_ec2_event_rule" {
  name        = "stop-ec2-event-rule"
  description = "Stop EC2 instance at a specified time each day"
  schedule_expression = var.cloudwatch_schedule_stop
}

resource "aws_cloudwatch_event_rule" "start_ec2_event_rule" {
  name        = "start-ec2-event-rule"
  description = "Start EC2 instance at a specified time each day"
  schedule_expression = var.cloudwatch_schedule_start
}

每个事件都将一个操作传递给lambda

resource "aws_cloudwatch_event_target" "stop_ec2_event_rule_target" {
  rule      = aws_cloudwatch_event_rule.stop_ec2_event_rule.name
  target_id = "TriggerLambdaFunction"
  arn       = aws_lambda_function.lambda_rscheduler.arn
  input     = "{\"environment\":\"${var.environment}\", \"action\":\"stop\"}"
}

resource "aws_cloudwatch_event_target" "start_ec2_event_rule_target" {
  rule      = aws_cloudwatch_event_rule.start_ec2_event_rule.name
  target_id = "TriggerLambdaFunction"
  arn       = aws_lambda_function.lambda_rscheduler.arn
  input     = "{\"environment\":\"${var.environment}\", \"action\":\"start\"}"
}

这很有效

resource "aws_lambda_permission" "allow_cloudwatch" {
  statement_id  = "AllowExecutionFromCloudWatch"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda_rscheduler.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.stop_ec2_event_rule.arn

我面临的问题是，我无法让Terraform将start\u事件与lambda函数相关联。我进入AWS控制台，可以手动将CloudWatch start\u事件触发器添加到lambda函数中。

如果我有start_event资源

resource "aws_lambda_permission" "allow_cloudwatch" {
  statement_id  = "AllowExecutionFromCloudWatch"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda_rscheduler.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.start_ec2_event_rule.arn

它会抱怨语句\u id重复。

我需要类似terraform aws\u lambda\u event\u source\u映射的东西，但它只允许lambda函数从Kinesis、DynamoDB和SQS获取事件；而不是CloudWatch活动。

我如何告诉terraform将多个cloudwatch事件关联到同一个lambda函数；何时可以从AWS控制台手动执行？

Answer 1

statement_id不是强制性的，因此您可以安全地将其从aws_lambda_permission中省略，terraform将自动为您生成唯一的id。您还可以使用count或for_each来为aws_lambda_permission节省一些输入。

例如，使用for_each可以将aws_lambda_permission定义为：

resource "aws_lambda_permission" "allow_cloudwatch" {
  
  for_each      = {for idx, v in [
      aws_cloudwatch_event_rule.stop_ec2_event_rule,
      aws_cloudwatch_event_rule.start_ec2_event_rule
  ]: idx => v}
  
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda_rscheduler.function_name
  principal     = "events.amazonaws.com"
  source_arn    = each.value.arn
}

可以为aws\U cloudwatch\u event\u rule和aws\U cloudwatch\u event\u target编写类似版本，以便您的代码基于每个或计数的，无需重复复制和粘贴。