eps-FHIR-validator-lambda/SAMtemplates/lambda_resources.yaml at 00310fa5d8f6ddaa38bd5db04bda599b3c55d373 · NHSDigital/eps-FHIR-validator-lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >
  Resources for a lambda

Parameters:
  StackName:
    Type: String
    Description: The name of the main stack
  CloudWatchKMSKey:
    Type: String
    Description: Cloudwatch KMS key
    AllowedPattern: "^arn:[a-z0-9-]+:kms:[a-z0-9-]+:\\d{12}:(key|alias)/.+\\Z"
  SplunkSubscriptionFilterRole:
    Type: String
    Description: Subscription filter role for sending logs to splunk
  SplunkDeliveryStream:
    Type: String
    Description: Splunk delivery stream
    Default: none
  EnableSplunk:
    Type: String
    Description: Whether to use splunk
    Default: false
    AllowedValues: [true, false]
  LambdaName:
    Type: String
    Description: Name of lambda we are creating for
  LambdaArn:
    Type: String
    Description: Arn of lambda we are creating resources for.
    AllowedPattern: "^(arn:(aws|aws-cn|aws-us-gov):[^:]+:[^:]*:(?:\\d{12}|\\*)?:.+|\\*)$"
  LogRetentionDays:
    Type: Number
    Description: How long to keep logs for
    AllowedValues:
      [
        1,
        3,
        5,
        7,
        14,
        30,
        60,
        90,
        120,
        150,
        180,
        365,
        400,
        545,
        731,
        1096,
        1827,
        2192,
        2557,
        2922,
        3288,
        3653,
      ]

Conditions:
  ShouldUseSplunk: !Equals [true, !Ref EnableSplunk]

Resources:
  ExecuteLambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !Sub ${LambdaArn}:*

  LambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "lambda.amazonaws.com"
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - !ImportValue lambda-resources:LambdaInsightsLogGroupPolicy
        - !ImportValue account-resources:LambdaEncryptCloudwatchKMSPolicy

  LambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - !Ref LambdaRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LambdaLogGroup}"
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LambdaLogGroup}:log-stream:*"

  LambdaLogGroup:
    Type: "AWS::Logs::LogGroup"
    Metadata:
      guard:
        SuppressedRules:
          - CW_LOGGROUP_RETENTION_PERIOD_CHECK
    Properties:
      LogGroupName: !Sub "/aws/lambda/${LambdaName}"
      RetentionInDays: !Ref LogRetentionDays
      KmsKeyId: !Ref CloudWatchKMSKey

  LambdaSplunkSubscriptionFilter:
    Condition: ShouldUseSplunk
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      RoleArn: !Ref SplunkSubscriptionFilterRole
      LogGroupName: !Ref LambdaLogGroup
      FilterPattern: "" # All logs
      DestinationArn: !Ref SplunkDeliveryStream

Outputs:
  ExecuteLambdaPolicyArn:
    Description: Lambda execution policy arn
    Value: !GetAtt ExecuteLambdaManagedPolicy.PolicyArn
    Export:
      Name: !Sub ${StackName}:FHIRValidatorUKCoreExecuteLambdaPolicyArn
  LambdaRoleArn:
    Description: "LambdaRole ARN"
    Value: !GetAtt LambdaRole.Arn
  LambdaRole:
    Description: "LambdaRole"
    Value: !Ref LambdaRole
  LogGroupName:
    Description: Lambda log group name
    Value: !Ref LambdaLogGroup
    Export:
      Name: !Sub ${StackName}:functions:${LambdaName}:LambdaLogGroupName