Merge pull request #44 from fingerprintjs/INTER-1219/extend-module

Add support for locally built Lambda function

Author: TheUnderScorer

.github/workflows/trivy.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   build:
     name: Scan
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

main.tf

@@ -100,12 +100,13 @@ data "aws_s3_object" "fpjs_integration_s3_bucket" {
 
 resource "aws_lambda_function" "fpjs_proxy_lambda" {
   description      = "Fingerprint Proxy Lambda@Edge function"
-  s3_bucket        = data.aws_s3_object.fpjs_integration_s3_bucket.bucket
-  s3_key           = data.aws_s3_object.fpjs_integration_s3_bucket.key
+  s3_bucket        = var.fetch_lambda_from_s3 ? data.aws_s3_object.fpjs_integration_s3_bucket.bucket : null
+  s3_key           = var.fetch_lambda_from_s3 ? data.aws_s3_object.fpjs_integration_s3_bucket.key : null
+  filename         = !var.fetch_lambda_from_s3 ? var.local_lambda_path : null
   function_name    = "fingerprint-pro-cloudfront-lambda-${local.integration_id}"
   role             = aws_iam_role.fpjs_proxy_lambda.arn
   handler          = "fingerprintjs-pro-cloudfront-lambda-function.handler"
-  source_code_hash = data.aws_s3_object.fpjs_integration_s3_bucket.etag
+  source_code_hash = var.fetch_lambda_from_s3 ? data.aws_s3_object.fpjs_integration_s3_bucket.etag : filemd5(var.local_lambda_path)
   memory_size      = 128
   timeout          = 10
 

variables.tf

@@ -34,3 +34,15 @@ variable "fpjs_proxy_lambda_role_permissions_boundary_arn" {
   description = "Permissions boundary ARN for the role assumed by the Proxy lambda. Make sure your permissions boundary allows the function to access the Secrets Manager secret created for the integration (`secretsmanager:GetSecretValue`) and create logs (`logs:CreateLogStream`, `logs:CreateLogGroup`, `logs:PutLogEvents`)."
   default     = null
 }
+
+variable "local_lambda_path" {
+  type        = string
+  default     = null
+  description = "Path to locally built lambda function that should be used for deployment, instead of the lambda stored in S3 bucket. Should be in zip format."
+}
+
+variable "fetch_lambda_from_s3" {
+  type = bool
+  default = true
+  description = "Whether to fetch lambda code from Fingerprint S3 bucket. Should be set to `false` if `local_lambda_path` is used."
+}