diff --git a/roles/aws/aws_admin_tools/tasks/create_schedule.yml b/roles/aws/aws_admin_tools/tasks/create_schedule.yml index a76973eef..8deb13d5d 100644 --- a/roles/aws/aws_admin_tools/tasks/create_schedule.yml +++ b/roles/aws/aws_admin_tools/tasks/create_schedule.yml @@ -6,7 +6,7 @@ region: "{{ _aws_region }}" targets: - id: "{{ 'schedule_' + item.name }}" - arn: "{{ (aws_lambda._result['schedule_' + item.name].configuration.function_arn.split(':') | map('trim'))[:-1] | join(':') }}" # Remove the version number from ARN + arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}" register: _schedule_result - name: Update Lambda policy. diff --git a/roles/aws/aws_admin_tools/tasks/lambda_iam.yml b/roles/aws/aws_admin_tools/tasks/lambda_iam.yml index 93a11c2d3..798d2eba1 100644 --- a/roles/aws/aws_admin_tools/tasks/lambda_iam.yml +++ b/roles/aws/aws_admin_tools/tasks/lambda_iam.yml @@ -12,3 +12,7 @@ managed_policies: "{{ _policies }}" inline_policies: "{{ item.inline_policies | default(omit) }}" policy_document: "{{ lookup('template', 'trust_lambda.j2') }}" + +- name: Wait for 6 seconds for IAM to be ready. + ansible.builtin.wait_for: + timeout: 6 diff --git a/roles/aws/aws_admin_tools/tasks/main.yml b/roles/aws/aws_admin_tools/tasks/main.yml index 264499aac..a34b07207 100644 --- a/roles/aws/aws_admin_tools/tasks/main.yml +++ b/roles/aws/aws_admin_tools/tasks/main.yml @@ -92,6 +92,10 @@ - "s3:GetObject" policy_document: "{{ lookup('template', 'trust_apigateway.j2') }}" +- name: Wait for 6 seconds for IAM to be ready. + ansible.builtin.wait_for: + timeout: 6 + - name: Configure Lambda IAM policies. ansible.builtin.include_tasks: lambda_iam.yml loop: "{{ _api_without_s3 }}" diff --git a/roles/aws/aws_backup/tasks/resource.yml b/roles/aws/aws_backup/tasks/resource.yml index c939a5805..68c764bf8 100644 --- a/roles/aws/aws_backup/tasks/resource.yml +++ b/roles/aws/aws_backup/tasks/resource.yml @@ -36,6 +36,10 @@ policy_document: backup when: aws_backup.backup.iam_role_arn == "Default" +- name: Wait for 6 seconds for IAM to be ready. + ansible.builtin.wait_for: + timeout: 6 + - name: Set IAM role ARN for backups. ansible.builtin.set_fact: _iam_role_arn: "{{ _aws_iam_role_result.iam_role.arn }}" diff --git a/roles/aws/aws_backup_validation/defaults/main.yml b/roles/aws/aws_backup_validation/defaults/main.yml index 8264ff268..9679dc28a 100644 --- a/roles/aws/aws_backup_validation/defaults/main.yml +++ b/roles/aws/aws_backup_validation/defaults/main.yml @@ -2,14 +2,15 @@ aws_backup_validation: s3_bucket: "{{ _general_bucket }}" s3_bucket_prefix: "backup-validation" # Prefix used for storing backup validation info - name: "RestoreValidation" description: "Restore validation is running every Sunday at 00:00AM, and validation reporting is triggered on Monday 00:00AM" timeout: 60 runtime: "python3.12" + main_file: "app" handler: "lambda_handler" + git_url: example.git-url.codeenigma.com # Can be overwritten by git_url in item resources: - name: ec2_test_instance - git_url: true + git: true # if true, it will build git url to download repo type: EC2 lambda_policy: - "backup:PutRestoreValidationResult" @@ -18,7 +19,7 @@ aws_backup_validation: - "ssm:SendCommand" - "ec2:DescribeInstances" - name: rds_test_instance - git_url: true + git: true type: RDS lambda_policy: - "backup:PutRestoreValidationResult" @@ -27,12 +28,14 @@ aws_backup_validation: - "ec2:DescribeInstances" - "rds:DescribeDBInstances" - name: aurora_create_instance - git_url: true + git: true type: Aurora lambda_policy: - - "lambda:InvokeFunction" + - "rds:DescribeDbClusters" + - "rds:CreateDbInstance" + - "rds:AddTagsToResource" - name: aurora_test_instance - git_url: true + git: true type: Aurora event_pattern: '{ "source": ["aws.rds"], "detail-type": ["RDS DB Instance Event"], "resources": [{ "prefix": "arn:aws:rds:eu-west-1:{{ _acc_id }}:db:restoretest" }], "detail": { "EventID": ["RDS-EVENT-0005"] } }' lambda_policy: @@ -42,7 +45,7 @@ aws_backup_validation: - "rds:DescribeDBClusters" - "rds:DeleteDBInstance" - name: validation_report - git_url: true + git: true type: Schedule schedule: "cron(0 0 ? * MON *)" lambda_policy: diff --git a/roles/aws/aws_backup_validation/tasks/main.yml b/roles/aws/aws_backup_validation/tasks/main.yml index 4ef77ab35..ecdee8d7d 100644 --- a/roles/aws/aws_backup_validation/tasks/main.yml +++ b/roles/aws/aws_backup_validation/tasks/main.yml @@ -8,7 +8,7 @@ - name: Setting previous command output into variable. ansible.builtin.set_fact: - _acc_id: "{{ _acc_id.stdout | from_json }}" + _acc_id: "{{ _acc_id.stdout }}" - name: Create a role and attach policies for events. ansible.builtin.include_role: @@ -16,7 +16,7 @@ vars: aws_iam_role: name: "{{ item.name }}_event" - source: "{{ item.name}}" + source: "{{ item.name }}" aws_profile: "{{ _aws_profile }}" inline_policies: name: "{{ item.name }}_event" @@ -25,9 +25,6 @@ - "lambda:InvokeFunction" policy_document: "{{ lookup('template', 'event_document_policy.json.j2') }}" loop: "{{ aws_backup_validation.resources }}" - loop_control: - extended: true - extended_allitems: false - name: Create a role and attach policies for Lambda functions. ansible.builtin.include_role: @@ -35,7 +32,7 @@ vars: aws_iam_role: name: "{{ item.name}}_lambda" - source: "{{ item.name}}" + source: "{{ item.name }}" aws_profile: "{{ _aws_profile }}" managed_policies: - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess @@ -45,9 +42,10 @@ action: "{{ item.lambda_policy }}" policy_document: "{{ lookup('template', 'trusted_entitites.json.j2') }}" loop: "{{ aws_backup_validation.resources }}" - loop_control: - extended: true - extended_allitems: false + +- name: Wait for 6 seconds for IAM to be ready. + ansible.builtin.wait_for: + timeout: 6 - name: Get info about newly created restore testing plan. ansible.builtin.command: > @@ -107,6 +105,10 @@ - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores +- name: Wait for 6 seconds for IAM to be ready. + ansible.builtin.wait_for: + timeout: 6 + # TODO: Not all clients have verified identity #- name: Get verified domain. # ansible.builtin.include_tasks: get_valid_email.yml diff --git a/roles/aws/aws_cloudfront_distribution/tasks/create_lambda_function.yml b/roles/aws/aws_cloudfront_distribution/tasks/create_lambda_function.yml index 4f7c06275..f45822c1c 100644 --- a/roles/aws/aws_cloudfront_distribution/tasks/create_lambda_function.yml +++ b/roles/aws/aws_cloudfront_distribution/tasks/create_lambda_function.yml @@ -14,6 +14,10 @@ - "lambda:GetFunction" policy_document: "{{ lookup('template', 'lambda_policy.json') }}" +- name: Wait for 6 seconds for IAM to be ready. + ansible.builtin.wait_for: + timeout: 6 + - name: Create Lambda function. ansible.builtin.include_role: name: aws/aws_lambda