eps-FHIR-validator-lambda/SAMtemplates/lambda_resources.yaml at e21056cb3b574805d6c20111f61d9361a93233db · NHSDigital/eps-FHIR-validator-lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >
  Resources for a lambda

Parameters:
  StackName:
    Type: String
    Description: The name of the main stack
  CloudWatchKMSKey:
    Type: String
    Description: Cloudwatch KMS key
    AllowedPattern: "^arn:[a-z0-9-]+:kms:[a-z0-9-]+:\\d{12}:(key|alias)/.+\\Z"
  SplunkSubscriptionFilterRole:
    Type: String
    Description: Subscription filter role for sending logs to splunk
  SplunkDeliveryStream:
    Type: String
    Description: Splunk delivery stream
    Default: none
  LambdaName:
    Type: String
    Description: Name of lambda we are creating for
  LambdaArn:
    Type: String
    Description: Arn of lambda we are creating resources for.
    AllowedPattern: "^(arn:(aws|aws-cn|aws-us-gov):[^:]+:[^:]*:(?:\\d{12}|\\*)?:.+|\\*)$"
  LogRetentionDays:
    Type: Number
    Description: How long to keep logs for
    AllowedValues:
      [
        1,
        3,
        5,
        7,
        14,
        30,
        60,
        90,
        120,
        150,
        180,
        365,
        400,
        545,
        731,
        1096,
        1827,
        2192,
        2557,
        2922,
        3288,
        3653,
      ]
  ExecutePolicyExportName:
    Type: String
  IncludeAdditionalPolicies:
    Type: String
    Default: false
  AdditionalPolicies:
    Type: CommaDelimitedList
    Description: A list of additional policies to attach the lambdas role (comma delimited).
    Default: none

Conditions:
  ShouldIncludeAdditionalPolicies: !Equals
    - true
    - !Ref IncludeAdditionalPolicies

Resources:
  ExecuteLambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !Sub ${LambdaArn}:*

  LambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "lambda.amazonaws.com"
            Action: "sts:AssumeRole"
      ManagedPolicyArns: !Split
        - ","
        - !Join
          - ","
          - - !Ref LambdaManagedPolicy
            - !ImportValue lambda-resources:LambdaInsightsLogGroupPolicy
            - !ImportValue account-resources:CloudwatchEncryptionKMSPolicyArn
            - !If
              - ShouldIncludeAdditionalPolicies
              - !Join
                - ","
                - !Ref AdditionalPolicies
              - !Ref AWS::NoValue

  LambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !GetAtt LambdaLogGroup.Arn
              - !Sub ${LambdaLogGroup.Arn}:log-stream:*

  LambdaLogGroup:
    Type: "AWS::Logs::LogGroup"
    Metadata:
      guard:
        SuppressedRules:
          - CW_LOGGROUP_RETENTION_PERIOD_CHECK
    Properties:
      LogGroupName: !Sub "/aws/lambda/${LambdaName}"
      RetentionInDays: !Ref LogRetentionDays
      KmsKeyId: !Ref CloudWatchKMSKey

  LambdaSplunkSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      RoleArn: !Ref SplunkSubscriptionFilterRole
      LogGroupName: !Ref LambdaLogGroup
      FilterPattern: "" # All logs
      DestinationArn: !Ref SplunkDeliveryStream

Outputs:
  ExecuteLambdaPolicyArn:
    Description: Lambda execution policy arn
    Value: !GetAtt ExecuteLambdaManagedPolicy.PolicyArn
    Export:
      Name: !Sub ${StackName}:${ExecutePolicyExportName}
  ExecuteLambdaPolicyArnNewFormat:
    Description: Lambda execution policy arn
    Value: !GetAtt ExecuteLambdaManagedPolicy.PolicyArn
    Export:
      Name: !Sub ${StackName}:functions:${LambdaName}:ExecutePolicy:Arn
  LambdaRoleArn:
    Description: "LambdaRole ARN"
    Value: !GetAtt LambdaRole.Arn
  LambdaRole:
    Description: "LambdaRole"
    Value: !Ref LambdaRole
  LogGroupName:
    Description: Lambda log group name
    Value: !Ref LambdaLogGroup
    Export:
      Name: !Sub ${StackName}:functions:${LambdaName}:LambdaLogGroupName