lambda-cloudformation.yaml

#  Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
#  the License. A copy of the License is located at
#      http://aws.amazon.com/apache2.0/
#  or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
#  CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and
#  limitations under the License.

AWSTemplateFormatVersion: '2010-09-09'
Description: custom lookup function
Resources:
  CUSTOMLOOKUP:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: team01-custom-lookup
      Handler: function.handler
      Runtime: python2.7
      Description: custom lookup function
      Code: ./
      MemorySize: 128
      Timeout: 60
      Role: !GetAtt CUSTOMLOOKUPLAMBDAROLE.Arn
  CUSTOMLOOKUPLAMBDAROLE:
      Type: AWS::IAM::Role
      Properties:
        RoleName: !Sub team01-custom-lookup-lambda-role-${AWS::Region}
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            -
              Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Path: /
  CUSTOMLOOKUPLAMBDAPOLICY:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub team01-custom-lookup-lambda-policy-${AWS::Region}
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - dynamodb:*
            Resource:
              - arn:aws:dynamodb:*:*:table/team01-custom-lookup
              - arn:aws:dynamodb:*:*:table/team01-custom-lookup/*
          -
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
      Roles:
        -
          !Ref CUSTOMLOOKUPLAMBDAROLE
  #Below is for Insert Lambda
  INSERTLOOKUP:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: insert-lookup
      Handler: dynamodb-sync.handler
      Runtime: python2.7
      Description: inserts records from codepipeline to dynamodb
      Code: ./
      MemorySize: 128
      Timeout: 300
      Role: !GetAtt INSERTLOOKUPLAMBDAROLE.Arn
  INSERTLOOKUPLAMBDAROLE:
      Type: AWS::IAM::Role
      Properties:
        RoleName: !Sub insert-lookup-lambda-role-${AWS::Region}
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            -
              Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Path: /
  INSERTLOOKUPLAMBDAPOLICY:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub insert-lookup-lambda-policy-${AWS::Region}
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - dynamodb:*
            Resource:
              - arn:aws:dynamodb:*:*:table/team01-custom-lookup
              - arn:aws:dynamodb:*:*:table/team01-custom-lookup/*
          -
            Effect: Allow
            Action:
              - codepipeline:PutJobFailureResult
              - codepipeline:PutJobSuccessResult
            Resource:
              - "*"
          -
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
      Roles:
        -
          !Ref INSERTLOOKUPLAMBDAROLE
Outputs:
  LambdaArn:
    Description: ARN of the Lambda Function, which returns the mappings
    Value: !GetAtt CUSTOMLOOKUP.Arn
    Export:
      Name: team01-custom-lookup-lambda