# [Terraform]
Lambda で AppConfig の設定データを取得する


published: 2025-01-26

AppConfig の設定データを取得する Lambda 関数を作成。
Terraform で管理する。


## 構成

Lambda 関数に Lambda Layer を付けるだけ。


![architecture.png](https://lab.enuesaa.dev/prototype/aws-lambda-fetch-appconfig-data/architecture.png)

## 仕組み

基本的に Lambda Layer がよしなにしてくれる。
AWS 公式ドキュメントの図が分かりやすい。


- [https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-how-it-works.html](https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-how-it-works.html)
## コード

### `main.tf`

```tf
terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      configuration_aliases = [ aws, aws.virginia ]
    }
  }
}

data "aws_caller_identity" "main" {}
data "aws_region" "main" {}

```

### `lambda.tf`

```tf
resource "aws_lambda_function" "main" {
  function_name = var.identifier

  filename         = data.archive_file.lambda.output_path
  source_code_hash = data.archive_file.lambda.output_base64sha256

  handler       = "app.lambda_handler"
  architectures = ["arm64"]
  runtime       = "python3.12"
  role          = aws_iam_role.lambda.arn
  memory_size   = 128
  timeout       = 10

  environment {
    variables = {
      APPCONFIG_APPLICATION   = var.appconfig_application_name
      APPCONFIG_ENVIRONMENT   = var.appconfig_environment_name
      APPCONFIG_CONFIGURATION = var.appconfig_configuration_profile_name
    }
  }

  layers = [
    // ここに Lambda Layer の ARN をセット
    // see https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-versions.html
  ]
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda.zip"

  source {
    filename = "app.py"
    content = file("${path.module}/lambda_app.py")
  }
}

```

### `lambda_role.tf`

```tf
resource "aws_iam_role" "lambda" {
  name = "${var.identifier}-lambda"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "lambda_logs" {
  name = "logs"
  role = aws_iam_role.lambda.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy" "lambda_appconfig" {
  name = "appconfig"
  role = aws_iam_role.lambda.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "appconfig:StartConfigurationSession",
          "appconfig:GetLatestConfiguration",
        ]
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

```

### `variables.tf`

```tf
variable "identifier" {
  type = string
}

# appconfig
variable "appconfig_application_name" {
  type = string
}

variable "appconfig_environment_name" {
  type = string
}

variable "appconfig_configuration_profile_name" {
  type = string
}

```

### `.gitignore`

```gitignore
# terraform が作成する zip ファイル
*.zip

```

### `lambda_app.py`

```py
import urllib.request
import os

def lambda_handler(event, context):
    application = os.environ['APPCONFIG_APPLICATION']
    environment = os.environ['APPCONFIG_ENVIRONMENT']
    configurations = os.environ['APPCONFIG_CONFIGURATION']

    # AWS公式ドキュメントより
    # see https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-add.html

    url = f'http://localhost:2772/applications/{application}/environments/{environment}/configurations/{configurations}'
    config = urllib.request.urlopen(url).read()

    return config

```

### memos

Application Name を環境変数より取得


mark: `lambda_app.py:5`

この URL はAWS公式ドキュメントより持ってきた


mark: `lambda_app.py:12`

- [https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-add.html](https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-add.html)
ここに Lambda Layer の ARN をセットする


mark: `lambda.tf:24`

- [https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-versions.html](https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-versions.html)
terraform apply で zip ファイルを作成する


mark: `lambda.tf:28`

AppConfig からデータを取得するための IAM 権限が必要


mark: `lambda_role.tf:38`

## Links

- [https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-add.html](https://docs.aws.amazon.com/ja_jp/appconfig/latest/userguide/appconfig-integration-lambda-extensions-add.html)