terraform.aws-baseline-infra/modules/ApplicationIntegration/apigw-lambda/main.tf

resource "aws_api_gateway_rest_api" "api" {
  name        = var.name
  description = var.description

  endpoint_configuration {
    types            = ["PRIVATE"]
    vpc_endpoint_ids = [aws_vpc_endpoint.apigw-vpcep.id]
  }
}

# private endpoint for inbound access
data "aws_region" "current" {}

resource "aws_vpc_endpoint" "apigw-vpcep" {
  private_dns_enabled = false
  security_group_ids  = [var.apigw-security-group-id]
  service_name        = "com.amazonaws.${data.aws_region.current.name}.execute-api"
  subnet_ids          = var.apigw-subnet-ids
  vpc_endpoint_type   = "Interface"
  vpc_id              = var.apigw-vpc-id
}

# vpc link for outbound access
resource "aws_api_gateway_vpc_link" "api-vpc-link" {
  count       = var.create-vpc-link ? 1 : 0
  name        = "${var.name}-vpclink"
  description = "VPC link for apigateway ${var.name}"
  target_arns = var.apigw-vpc-link-target-arns
}

# The resource for the endpoint
resource "aws_api_gateway_resource" "api-res" {
  path_part   = var.path_part
  parent_id   = aws_api_gateway_rest_api.api.root_resource_id
  rest_api_id = aws_api_gateway_rest_api.api.id
}

resource "aws_api_gateway_method" "api-method" {
  rest_api_id   = aws_api_gateway_rest_api.api.id
  resource_id   = aws_api_gateway_resource.api-res.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "api-integration" {
  rest_api_id             = aws_api_gateway_rest_api.api.id
  resource_id             = aws_api_gateway_resource.api-res.id
  http_method             = aws_api_gateway_method.api-method.http_method
  integration_http_method = "POST"
  type                    = "AWS_PROXY"
  uri                     = aws_lambda_function.function.invoke_arn
}

# apigw deployment and stage
resource "aws_api_gateway_deployment" "apigw-deployment" {
  rest_api_id = aws_api_gateway_rest_api.api.id

  triggers = {
    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.api.body))
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_api_gateway_stage" "apigw-stage" {
  depends_on    = [aws_cloudwatch_log_group.this]
  deployment_id = aws_api_gateway_deployment.apigw-deployment.id
  rest_api_id   = aws_api_gateway_rest_api.api.id
  stage_name    = var.stage-name
}

resource "aws_api_gateway_method_settings" "apigw-method-settings" {
  rest_api_id = aws_api_gateway_rest_api.api.id
  stage_name  = aws_api_gateway_stage.apigw-stage.stage_name
  method_path = "*/*"

  settings {
    metrics_enabled = true
    logging_level   = "INFO"
  }
}

# apigateway account setting
resource "aws_api_gateway_account" "settings" {
  cloudwatch_role_arn = aws_iam_role.apigw-logging-role.arn
}

resource "aws_iam_role" "apigw-logging-role" {
  name = "ApiGatewayLoggingRole"

  assume_role_policy = data.aws_iam_policy_document.apigw-logging-role.json
}

data "aws_iam_policy_document" "apigw-logging-role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "cloudwatch" {
  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
      "logs:GetLogEvents",
      "logs:FilterLogEvents",
    ]

    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "cloudwatch" {
  name   = "AllowLoggingFromApiGateway"
  role   = aws_iam_role.apigw-logging-role.id
  policy = data.aws_iam_policy_document.cloudwatch.json
}


# Cloudwatch log group path: API-Gateway-Execution-Logs_{rest-api-id}/{stage_name}
resource "aws_cloudwatch_log_group" "this" {
  name              = "API-Gateway-Execution-Logs_${aws_api_gateway_rest_api.api.id}/${var.stage-name}"
  retention_in_days = var.cloudwatchlog-retention
  # kms_key_id        = var.kms-key-id
}

# lambda function
resource "aws_lambda_function" "function" {
  filename      = var.lambda-archive-file
  function_name = "${var.name}-lambda-function"
  handler       = "main.lambda_handler"
  role          = aws_iam_role.lambda-exec-role.arn
  runtime       = var.lambda-runtime-version
  # source_code_hash = local.source_code_hash
}

resource "aws_lambda_permission" "allow_api_gateway" {
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.function.function_name
  principal     = "apigateway.amazonaws.com"
}

# Lambda execution role
data "aws_caller_identity" "this" {}

resource "random_id" "this" {
  byte_length = 4
}

resource "aws_iam_role" "lambda-exec-role" {
  name = "lambda-apigw-${var.name}-${random_id.this.dec}"

  assume_role_policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Principal" : {
            "Service" : "lambda.amazonaws.com"
          },
          "Action" : "sts:AssumeRole"
        }
      ]
    }
  )
}

resource "aws_iam_role_policy" "this" {
  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Sid" : "AllowCreationOfCloudwatchLogGroup",
          "Effect" : "Allow",
          "Action" : "logs:CreateLogGroup",
          "Resource" : "arn:aws:logs:ap-east-1:${data.aws_caller_identity.this.account_id}:*"
        },
        {
          "Sid" : "AllowWritingToCloudwatchLogGroup",
          "Effect" : "Allow",
          "Action" : [
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ],
          "Resource" : [
            "arn:aws:logs:ap-east-1:${data.aws_caller_identity.this.account_id}:log-group:/aws/lambda/*"
          ]
        }
      ]
    }
  )
  role = aws_iam_role.lambda-exec-role.id
  name = "LambdaExecutionPolicy"
}

# apigateway policy
data "aws_iam_policy_document" "api-policy" {
  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions   = ["execute-api:Invoke"]
    resources = [aws_api_gateway_rest_api.api.execution_arn]

    condition {
      test     = "IpAddress"
      variable = "aws:SourceIp"
      values   = [data.aws_vpc.vpc.cidr_block]
    }
  }
}

data "aws_vpc" "vpc" {
  id = var.apigw-vpc-id
}
resource "aws_api_gateway_rest_api_policy" "api-policy" {
  rest_api_id = aws_api_gateway_rest_api.api.id
  policy      = data.aws_iam_policy_document.api-policy.json
}