pass allowed events to lambda

Author: npalm

examples/multi-runner/main.tf

@@ -80,6 +80,8 @@ module "runners" {
 
   # Deploy webhook in EventBridge mode
   webhook_mode = "eventbridge"
+  # adjust the allow events to only allow specific events, like workflow_job
+  # eventbridge_allowed_events = ['workflow_job']
 
   # enable this section for tracing
   # tracing_config = {

main.tf

@@ -124,7 +124,9 @@ module "ssm" {
 module "webhook" {
   source = "./modules/webhook"
 
-  mode = var.webhook_mode
+  mode                       = var.webhook_mode
+  eventbridge_allowed_events = var.eventbridge_allowed_events
+
   ssm_paths = {
     root    = local.ssm_root_path
     webhook = var.ssm_paths.webhook

modules/multi-runner/variables.tf

@@ -283,6 +283,12 @@ variable "webhook_mode" {
   }
 }
 
+variable "eventbridge_allowed_events" {
+  description = "List of events that are allowed (accepted) to be sent to the eventbridge by the webhook. Variable only have effect if `webhook_mode` is set to `eventbridge`."
+  type        = list(string)
+  default     = []
+}
+
 variable "webhook_lambda_s3_key" {
   description = "S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas."
   type        = string

modules/multi-runner/webhook.tf

@@ -1,9 +1,10 @@
 module "webhook" {
-  source      = "../webhook"
-  prefix      = var.prefix
-  tags        = local.tags
-  mode        = var.webhook_mode
-  kms_key_arn = var.kms_key_arn
+  source                     = "../webhook"
+  prefix                     = var.prefix
+  tags                       = local.tags
+  mode                       = var.webhook_mode
+  eventbridge_allowed_events = var.eventbridge_allowed_events
+  kms_key_arn                = var.kms_key_arn
 
   runner_matcher_config               = local.runner_config
   matcher_config_parameter_store_tier = var.matcher_config_parameter_store_tier

modules/webhook/eventbridge/variables.tf

@@ -50,5 +50,6 @@ variable "config" {
       arn     = string
       version = string
     })
+    allowed_events = optional(list(string), [])
   })
 }

modules/webhook/eventbridge/webhook.tf

@@ -21,9 +21,11 @@ resource "aws_lambda_function" "webhook" {
         POWERTOOLS_TRACE_ENABLED                 = var.config.tracing_config.mode != null ? true : false
         POWERTOOLS_TRACER_CAPTURE_HTTPS_REQUESTS = var.config.tracing_config.capture_http_requests
         POWERTOOLS_TRACER_CAPTURE_ERROR          = var.config.tracing_config.capture_error
-        PARAMETER_GITHUB_APP_WEBHOOK_SECRET      = var.config.github_app_parameters.webhook_secret.name
-        PARAMETER_RUNNER_MATCHER_CONFIG_PATH     = var.config.ssm_parameter_runner_matcher_config.name
-        EVENT_BUS_NAME                           = aws_cloudwatch_event_bus.main.name
+        # Parameters required for lambda configuration
+        ALLOWED_EVENTS                       = jsonencode(var.config.allowed_events)
+        EVENT_BUS_NAME                       = aws_cloudwatch_event_bus.main.name
+        PARAMETER_GITHUB_APP_WEBHOOK_SECRET  = var.config.github_app_parameters.webhook_secret.name
+        PARAMETER_RUNNER_MATCHER_CONFIG_PATH = var.config.ssm_parameter_runner_matcher_config.name
       } : k => v if v != null
     }
   }

modules/webhook/variables.tf

@@ -220,3 +220,9 @@ variable "mode" {
     error_message = "`mode` value is not valid, valid values are: `direct`, and `eventbridge`."
   }
 }
+
+variable "eventbridge_allowed_events" {
+  description = "List of events that are allowed (accepted) to be sent to the eventbridge by the webhook."
+  type        = list(string)
+  default     = []
+}

modules/webhook/webhook.tf

@@ -84,6 +84,7 @@ module "eventbridge" {
     lambda_tags                           = var.lambda_tags,
     api_gw_source_arn                     = "${aws_apigatewayv2_api.webhook.execution_arn}/*/*/${local.webhook_endpoint}"
     ssm_parameter_runner_matcher_config   = aws_ssm_parameter.runner_matcher_config
+    allowed_events                        = var.eventbridge_allowed_events
   }
 
 }

variables.tf

@@ -955,3 +955,9 @@ variable "webhook_mode" {
     error_message = "`mode` value is not valid, valid values are: `direct`, and `eventbridge`."
   }
 }
+
+variable "eventbridge_allowed_events" {
+  description = "List of events that are allowed (accepted) to be sent to the eventbridge by the webhook. Variable only have effect if `webhook_mode` is set to `eventbridge`."
+  type        = list(string)
+  default     = []
+}