aws_lambda_private_vulnerable_python.tf_test

# AWS-Vulnerable-Lambda: https://github.com/torque59/AWS-Vulnerable-Lambda

# References:
# https://johnroach.io/2020/09/04/deploying-lambda-functions-with-terraform-just-dont/
# https://github.com/edonosotti/terraform-terragrunt-aws-lambda-tutorial/edit/master/terraform/lambda.tf
# https://automateinfra.com/aws-lambda-using-terraform/
# https://engineering.door2door.io/deploy-a-flask-app-with-aws-api-gateway-managed-via-zappa-and-terraform-91d3603721c
# https://github.com/techjacker/terraform-aws-lambda-api-gateway

# Get AWS-Vulnerable-Lambda from GitHub
module "AWS-Vulnerable-Lambda" {
  source = "github.com/torque59/AWS-Vulnerable-Lambda"
}

# Define a local variable for the Lambda function
locals {
  lambda_src_path = "${path.module}/.terraform/modules/AWS-Vulnerable-Lambda"
}

# Compute the source code hash, only taking into
# consideration the actual application code files
# and the dependencies list.
resource "random_uuid" "lambda_src_hash" {

  keepers = {
    for filename in setunion(
      fileset(local.lambda_src_path, "*.py"),
      fileset(local.lambda_src_path, "requirements.txt"),
      fileset(local.lambda_src_path, "core/**/*.py")
    ):
    filename => filemd5("${local.lambda_src_path}/${filename}")
  }
}

# Automatically install dependencies to be packaged
# with the Lambda function as required by AWS Lambda:
# https://docs.aws.amazon.com/lambda/latest/dg/python-package.html#python-package-dependencies
resource "null_resource" "install_dependencies" {

  provisioner "local-exec" {
    command = "pip install -r ${local.lambda_src_path}/requirements.txt -t ${local.lambda_src_path}/ --upgrade"
  }

  # Only re-run this if the dependencies or their versions
  # have changed since the last deployment with Terraform
  triggers = {
    dependencies_versions = filemd5("${local.lambda_src_path}/requirements.txt")
    # source_code_hash = random_uuid.lambda_src_hash.result # This is a suitable option too
  }
}

# Create an archive form the Lambda source code,
# filtering out unneeded files.
data "archive_file" "lambda_source_package" {
  type        = "zip"
  source_dir  = local.lambda_src_path
  output_path = "${path.module}/.tmp/${random_uuid.lambda_src_hash.result}.zip"

  excludes    = [
    ".*",
    "__pycache__",
    "core/__pycache__",
    "tests"
  ]

  # This is necessary, since archive_file is now a
  # `data` source and not a `resource` anymore.
  # Use `depends_on` to wait for the "install dependencies"
  # task to be completed.
  depends_on = [null_resource.install_dependencies]
}

# Create an IAM execution role for the Lambda function.
resource "aws_iam_role" "execution_role" {
  # IAM Roles are "global" resources. Lambda functions aren't.
  # In order to deploy the Lambda function in multiple regions
  # within the same account, separate Roles must be created.
  # The same Role could be shared across different Lambda functions,
  # but it's just not convenient to do so in Terraform.
  name = "lambda-execution-role-zero-provider-${var.aws-region}"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF

  tags = {
    provisioner = "terraform"
  }
}

# Attach a IAM policy to the execution role to allow
# the Lambda to stream logs to Cloudwatch Logs.
resource "aws_iam_role_policy" "log_writer" {
  name = "lambda-log-writer-zero-provider"
  role = aws_iam_role.execution_role.id

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "ec2:CreateNetworkInterface",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DeleteNetworkInterface"
        ],
        "Resource": "*"
        #"Resource": "arn:aws:logs:*:*:*"
      }
    ]
  })
}

# data "aws_s3_bucket_object" "vuln_lambda_function_hash" {
  
#   bucket = "bucket-for-lambda-zips"
#   key    = data.archive_file.lambda_source_package.output_base64sha256
# }

# resource "aws_s3_bucket" "vuln_lambda_function" {
#   bucket = "bucket-for-lambda-zips"
# }

# resource "aws_s3_bucket_object" "vuln_lambda_function" {
#   bucket = "bucket-for-lambda-zips"
#   acl = "private"
#   key    = data.archive_file.lambda_source_package.output_base64sha256
#   source = data.archive_file.lambda_source_package.output_path

#   # The filemd5() function is available in Terraform 0.11.12 and later
#   # For Terraform 0.11.11 and earlier, use the md5() function and the file() function:
#   # etag = "${md5(file("path/to/file"))}"
#   etag = filemd5(data.archive_file.lambda_source_package.output_path)
# }


# Deploy the Lambda function to AWS
resource "aws_lambda_function" "lambda_vulnerable_app" {
  count  = var.deploment-control["create_lambda_app"] ? 1 :0 

  function_name    = "AWS-Vulnerable-Lambda"
  description      = "Vulnerable Lambda function using flask"
  role             = aws_iam_role.execution_role.arn

  #s3_bucket        = "bucket-for-lambda-zips"
  #s3_key           = data.archive_file.lambda_source_package.output_base64sha256

  handler          = "main"
  runtime          = "python3.8"

  filename         = data.archive_file.lambda_source_package.output_path
  source_code_hash = data.archive_file.lambda_source_package.output_base64sha256   
   
  memory_size      = 128
  timeout          = 30
  publish          = true


   vpc_config {
       #private_ip    = "10.0.1.10"
       subnet_ids = [aws_subnet.privateSubnet.id]
       security_group_ids = [aws_security_group.SecurityGroup-VulnerableMachines.id]
   }

  environment {
    variables = {
      LOG_LEVEL = var.lambda_log_level
    }
  }


  depends_on = [
    null_resource.install_dependencies,
    aws_vpc.VPC,
    aws_subnet.privateSubnet,
    aws_route_table.PublicRouteTable,
    aws_security_group.SecurityGroup-VulnerableMachines,
  ]

 }


# API Gateway

resource "aws_api_gateway_rest_api" "lambda_vulnerable_apigw" {
  name        = "AWS-Vulnerable-Lambda-APIGateway"
  description = "API Gateway for AWS-Vulnerable-Lambda"
}

resource "aws_api_gateway_resource" "proxy" {
   rest_api_id = aws_api_gateway_rest_api.lambda_vulnerable_apigw.id
   parent_id   = aws_api_gateway_rest_api.lambda_vulnerable_apigw.root_resource_id
   path_part   = "{proxy+}"
}

resource "aws_api_gateway_method" "proxy" {
   rest_api_id   = aws_api_gateway_rest_api.lambda_vulnerable_apigw.id
   resource_id   = aws_api_gateway_resource.proxy.id
   http_method   = "ANY"
   authorization = "NONE"
}

resource "aws_api_gateway_integration" "lambda" {
   rest_api_id = aws_api_gateway_rest_api.lambda_vulnerable_apigw.id
   resource_id = aws_api_gateway_method.proxy.resource_id
   http_method = aws_api_gateway_method.proxy.http_method

   integration_http_method = "POST"
   type                    = "AWS_PROXY"
   uri                     = aws_lambda_function.lambda_vulnerable_app[0].invoke_arn
}


resource "aws_api_gateway_method" "proxy_root" {
   rest_api_id   = aws_api_gateway_rest_api.lambda_vulnerable_apigw.id
   resource_id   = aws_api_gateway_rest_api.lambda_vulnerable_apigw.root_resource_id
   http_method   = "ANY"
   authorization = "NONE"
}

resource "aws_api_gateway_integration" "lambda_root" {
   rest_api_id = aws_api_gateway_rest_api.lambda_vulnerable_apigw.id
   resource_id = aws_api_gateway_method.proxy_root.resource_id
   http_method = aws_api_gateway_method.proxy_root.http_method

   integration_http_method = "POST"
   type                    = "AWS_PROXY"
   uri                     = aws_lambda_function.lambda_vulnerable_app[0].invoke_arn
}


resource "aws_api_gateway_deployment" "example" {
   depends_on = [
     aws_api_gateway_integration.lambda,
     aws_api_gateway_integration.lambda_root,
   ]

   rest_api_id = aws_api_gateway_rest_api.lambda_vulnerable_apigw.id
   stage_name  = "test"
}


resource "aws_lambda_permission" "apigw" {
   statement_id  = "AllowAPIGatewayInvoke"
   action        = "lambda:InvokeFunction"
   function_name = aws_lambda_function.lambda_vulnerable_app[0].function_name

   principal     = "apigateway.amazonaws.com"

   # The "/*/*" portion grants access from any method on any resource
   # within the API Gateway REST API.
   source_arn = "${aws_api_gateway_rest_api.lambda_vulnerable_apigw.execution_arn}/*/*"
}


output "base_url" {
  value = aws_api_gateway_deployment.lambda_vulnerable_apigw.invoke_url
}