eps-prescription-status-update-api/SAMtemplates/functions/lambda_resources.yaml at 22e91d3f13fa4368bfd5236866f4f098dd99ddeb · NHSDigital/eps-prescription-status-update-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: |
  Resources for a lambda

Parameters:
  StackName:
    Type: String

  LambdaName:
    Type: String
    Default: none

  LambdaArn:
    Type: String
    AllowedPattern: "^(arn:(aws[A-Za-z\\-]*?|\\*):[^:]+:[^:]*(:(?:\\d{12}|\\*|aws)?:.+|)|\\*)$"

  IncludeAdditionalPolicies:
    Type: String
    Default: false

  AdditionalPolicies:
    Type: CommaDelimitedList
    Description: A list of additional policies to attach the lambdas role (comma delimited).
    Default: none

  LogRetentionInDays:
    Type: Number

  CloudWatchKMSKeyId:
    Type: String
    AllowedPattern: "^arn:[a-z0-9-]+:kms:[a-z0-9-]+:\\d{12}:(key|alias)/.+\\Z"

  EnableSplunk:
    Type: String

  SplunkSubscriptionFilterRole:
    Type: String
    AllowedPattern: "^arn:(aws|aws-cn|aws-iso|aws-iso-[a-z]{1}|aws-us-gov):iam::\\d{12}:role/.*$"

  SplunkDeliveryStreamArn:
    Type: String
    Default: none

Conditions:
  ShouldUseSplunk: !Equals
    - true
    - !Ref EnableSplunk

  ShouldIncludeAdditionalPolicies: !Equals
    - true
    - !Ref IncludeAdditionalPolicies

Resources:
  ExecuteLambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !Sub ${LambdaArn}*

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns: !Split
        - ","
        - !Join
          - ","
          - - !Ref LambdaManagedPolicy
            - !ImportValue account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn
            - !ImportValue account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn
            - !ImportValue secrets-cdk:IAM:LambdaDecryptSecretsKMSPolicy:Arn
            - !If
              - ShouldIncludeAdditionalPolicies
              - !Join
                - ","
                - !Ref AdditionalPolicies
              - !Ref AWS::NoValue

  LambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !GetAtt LambdaLogGroup.Arn
              - !Sub ${LambdaLogGroup.Arn}:log-stream:*

  LambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Metadata:
      guard:
        SuppressedRules:
          - CW_LOGGROUP_RETENTION_PERIOD_CHECK
    Properties:
      LogGroupName: !Sub /aws/lambda/${LambdaName}
      RetentionInDays: !Ref LogRetentionInDays
      KmsKeyId: !Ref CloudWatchKMSKeyId

  LambdaSplunkSubscriptionFilter:
    Condition: ShouldUseSplunk
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      RoleArn: !Ref SplunkSubscriptionFilterRole
      LogGroupName: !Ref LambdaLogGroup
      FilterPattern: ""
      DestinationArn: !Ref SplunkDeliveryStreamArn

Outputs:
  LambdaRoleArn:
    Description: LambdaRole ARN
    Value: !GetAtt LambdaRole.Arn

  ExecuteLambdaPolicyArn:
    Description: Lambda execution policy arn
    Value: !GetAtt ExecuteLambdaManagedPolicy.PolicyArn
    Export:
      Name: !Sub ${StackName}:functions:${LambdaName}:ExecuteLambdaPolicyArn

  LogGroupName:
    Description: Lambda log group name
    Value: !Ref LambdaLogGroup
    Export:
      Name: !Sub ${StackName}:functions:${LambdaName}:LambdaLogGroupName