Fix: Lambda creation access denied

[gcharest]

Summary | Résumé

Trying to fix the lambda creation access denied error.

[github-actions]

cloud_asset_inventory

✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 3 to add, 0 to change, 0 to destroy

Show plan

Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.sentinel_forwarder.aws_lambda_function.sentinel_forwarder will be created
  + resource "aws_lambda_function" "sentinel_forwarder" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + description                    = "Lambda function to forward AWS logs to Azure Sentinel"
      + filename                       = "/tmp/sentinel_forwarder.py.zip"
      + function_name                  = "cloudquery-sentinel-forwarder"
      + handler                        = "sentinel_forwarder.lambda_handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + layers                         = [
          + "arn:aws:lambda:ca-central-1:283582579564:layer:aws-sentinel-connector-layer:20",
        ]
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = "arn:aws:iam::794722365809:role/SentinelForwarderLambda-cloudquery-sentinel-forwarder"
      + runtime                        = "python3.9"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + source_code_hash               = "liR4yJNhp6SJtCjkSwnH0xGC0q00Uxebs1Cyqv8JLDw="
      + source_code_size               = (known after apply)
      + tags                           = {
          + "CostCentre" = "security-tools-794722365809"
        }
      + tags_all                       = {
          + "CostCentre" = "security-tools-794722365809"
        }
      + timeout                        = 30
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "CUSTOMER_ID" = (sensitive)
              + "LOG_TYPE"    = "cloudquery"
              + "SHARED_KEY"  = (sensitive)
            }
        }

      + ephemeral_storage {
          + size = (known after apply)
        }

      + tracing_config {
          + mode = "Active"
        }
    }

  # module.sentinel_forwarder.aws_lambda_permission.sentinel_forwarder_s3_triggers[0] will be created
  + resource "aws_lambda_permission" "sentinel_forwarder_s3_triggers" {
      + action              = "lambda:InvokeFunction"
      + function_name       = "cloudquery-sentinel-forwarder"
      + id                  = (known after apply)
      + principal           = "s3.amazonaws.com"
      + source_account      = "794722365809"
      + source_arn          = "arn:aws:s3:::security-tools-794722365809-cloudquery-results"
      + statement_id        = "AllowExecutionFromS3-cloudquery-sentinel-forwarder-0"
      + statement_id_prefix = (known after apply)
    }

  # module.sentinel_forwarder.aws_s3_bucket_notification.sentinel_forwarder_trigger_notification[0] will be created
  + resource "aws_s3_bucket_notification" "sentinel_forwarder_trigger_notification" {
      + bucket      = "security-tools-794722365809-cloudquery-results"
      + eventbridge = false
      + id          = (known after apply)

      + lambda_function {
          + events              = [
              + "s3:ObjectCreated:*",
            ]
          + filter_prefix       = "cloudquery/"
          + id                  = (known after apply)
          + lambda_function_arn = (known after apply)
        }
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.cloudquery_s3_bucket.aws_s3_bucket.this,
  on .terraform/modules/cloudquery_s3_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_versioning resource instead

(and 3 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.cloudquery"]
WARN - plan.json - main - Missing Common Tags: ["module.sentinel_forwarder.aws_cloudwatch_log_group.sentinel_forwarder_lambda"]
WARN - plan.json - main - Missing Common Tags: ["module.sentinel_forwarder.aws_iam_policy.sentinel_forwarder_lambda"]
WARN - plan.json - main - Missing Common Tags: ["module.sentinel_forwarder.aws_iam_policy.sentinel_forwarder_lambda_s3[0]"]
WARN - plan.json - main - Missing Common Tags: ["module.sentinel_forwarder.aws_iam_role.sentinel_forwarder_lambda"]
WARN - plan.json - main - Missing Common Tags: ["module.sentinel_forwarder.aws_lambda_function.sentinel_forwarder"]

23 tests, 17 passed, 6 warnings, 0 failures, 0 exceptions