module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: AWS Lambda function'
# cfn-modules:implements(ExposeArn, ExposeName, LambdaDependency)
# TODO integrate with event sources
# * Amazon Simple Notification Service (via standalone module using AWS::SNS::Subscription)
# * Amazon Simple Email Service (via TODO)
# * Amazon Cognito (via TODO)
# * AWS CloudFormation (via TODO)
# * Amazon CloudWatch Logs (via TODO)
# * Amazon CloudWatch Events (via standalone module using AWS::Events::Rule)
# * AWS CodeCommit (via TODO)
# * AWS Config (via TODO)
# * Amazon Alexa (via TODO)
# * Amazon Lex (via TODO)
# * Amazon API Gateway (via AWS::Serverless::Api DefinitionBody, not a module)
# * AWS IoT Button (via TODO)
# * Amazon CloudFront (via TODO)
# * Amazon Kinesis Data Firehose (via TODO)
Parameters:
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  KmsKeyModule:
    Description: 'Optional but recommended stack name of kms-key module.'
    Type: String
    Default: ''
  VpcModule:
    Description: 'Optional stack name of vpc module.'
    Type: String
    Default: ''
  DeadLetterQueueModule:
    Description: 'Optional but recommended for async invocations stack name of sqs-queue module where Lambda sends events to after the maximum number of retries was reached'
    Type: String
    Default: ''
  FunctionName:
    Description: 'An optional but recommended name for the function and log group.'
    Type: String
    Default: ''
  Description:
    Description: 'Optional description of the function'
    Type: String
    Default: ''
  Handler:
    Description: 'The name of the function (within your source code) that Lambda calls to start running your code (file must be in the lambda-src folder)'
    Type: String
  MemorySize:
    Description: 'The amount of memory, in MB, that is allocated to your Lambda function'
    Type: Number
    Default: 128
    MinValue: 128
    MaxValue: 10240
  ReservedConcurrentExecutions:
    Type: Number
    Default: -1
  Runtime:
    Description: 'The runtime environment for the Lambda function that you are uploading'
    Type: String
  Timeout:
    Description: 'The function execution time at which Lambda should terminate the function'
    Type: Number
    Default: 3
    MinValue: 1
    MaxValue: 900
  TracingConfigMode:
    Type: String
    Default: PassThrough
    AllowedValues: [PassThrough, Active]
  LogGroupRetentionInDays:
    Description: 'The number of days log events are kept in CloudWatch Logs'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  DependencyModule1:
    Description: 'Optional stack name of module implementing LambdaDependency to generate IAM Policy'
    Type: String
    Default: ''
  DependencyModule2:
    Description: 'Optional stack name of module implementing LambdaDependency to generate IAM Policy'
    Type: String
    Default: ''
  DependencyModule3:
    Description: 'Optional stack name of module implementing LambdaDependency to generate IAM Policy'
    Type: String
    Default: ''
  EnvironmentVariable1:
    Description: 'Optional value of environment variable VARIABLE1'
    Type: String
    Default: ''
  EnvironmentVariable2:
    Description: 'Optional value of environment variable VARIABLE2'
    Type: String
    Default: ''
  EnvironmentVariable3:
    Description: 'Optional value of environment variable VARIABLE3'
    Type: String
    Default: ''
  EnvironmentVariable4:
    Description: 'Optional value of environment variable VARIABLE4'
    Type: String
    Default: ''
  EnvironmentVariable5:
    Description: 'Optional value of environment variable VARIABLE5'
    Type: String
    Default: ''
  ManagedPolicyArns:
    Description: 'Optional comma-delimited list of IAM managed policy ARNs to attach to the function''s IAM role'
    Type: String
    Default: ''
  LayerArns:
    Description: 'Optional comma-delimited list of Layer ARNs to attach to the function'
    Type: String
    Default: ''
  ClientSgModule1:
    Description: 'Optional stack name of client-sg module to mark traffic from the Lambda function.'
    Type: String
    Default: ''
  ClientSgModule2:
    Description: 'Optional stack name of client-sg module to mark traffic from the Lambda function.'
    Type: String
    Default: ''
  ClientSgModule3:
    Description: 'Optional stack name of client-sg module to mark traffic from the Lambda function.'
    Type: String
    Default: ''
Conditions:
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasKmsKeyModule: !Not [!Equals [!Ref KmsKeyModule, '']]
  HasDeadLetterQueueModule: !Not [!Equals [!Ref DeadLetterQueueModule, '']]
  HasReservedConcurrentExecutions: !Not [!Equals [!Ref ReservedConcurrentExecutions, -1]]
  HasVpcModule: !Not [!Equals [!Ref VpcModule, '']]
  HasFunctionName: !Not [!Equals [!Ref FunctionName, '']]
  HasDescription: !Not [!Equals [!Ref Description, '']]
  HasDependencyModule1: !Not [!Equals [!Ref DependencyModule1, '']]
  HasDependencyModule2: !Not [!Equals [!Ref DependencyModule2, '']]
  HasDependencyModule3: !Not [!Equals [!Ref DependencyModule3, '']]
  HasManagedPolicyArns: !Not [!Equals [!Ref ManagedPolicyArns, '']]
  HasLayerArns: !Not [!Equals [!Ref LayerArns, '']]
  HasClientSgModule1: !Not [!Equals [!Ref ClientSgModule1, '']]
  HasClientSgModule2: !Not [!Equals [!Ref ClientSgModule2, '']]
  HasClientSgModule3: !Not [!Equals [!Ref ClientSgModule3, '']]
  HasTracingConfigModeActive: !Equals [!Ref TracingConfigMode, Active]
Resources:
  Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
      Policies:
      - PolicyName: 'cfn-modules'
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: !GetAtt 'LogGroup.Arn'
          - !If
            - HasVpcModule
            - Effect: Allow
              Action:
              - 'ec2:CreateNetworkInterface'
              - 'ec2:DescribeNetworkInterfaces'
              - 'ec2:DeleteNetworkInterface'
              Resource: '*'
            - !Ref 'AWS::NoValue'
          - !If
            - HasDeadLetterQueueModule
            - Effect: Allow
              Action: 'sqs:SendMessage'
              Resource: {'Fn::ImportValue': !Sub '${DeadLetterQueueModule}-Arn'}
            - !Ref 'AWS::NoValue'
          - !If
            - HasTracingConfigModeActive
            - Effect: Allow
              Action:
              - 'xray:PutTraceSegments'
              - 'xray:PutTelemetryRecords'
              - 'xray:GetSamplingRules'
              - 'xray:GetSamplingTargets'
              - 'xray:GetSamplingStatisticSummaries'
              Resource: '*'
            - !Ref 'AWS::NoValue'
          - !If
            - HasDependencyModule1
            - Effect: Allow
              Action: !Split [',', {'Fn::ImportValue': !Sub '${DependencyModule1}-IamActions'}]
              Resource: !Split [',', {'Fn::ImportValue': !Sub '${DependencyModule1}-IamResources'}]
            - !Ref 'AWS::NoValue'
          - !If
            - HasDependencyModule2
            - Effect: Allow
              Action: !Split [',', {'Fn::ImportValue': !Sub '${DependencyModule2}-IamActions'}]
              Resource: !Split [',', {'Fn::ImportValue': !Sub '${DependencyModule2}-IamResources'}]
            - !Ref 'AWS::NoValue'
          - !If
            - HasDependencyModule3
            - Effect: Allow
              Action: !Split [',', {'Fn::ImportValue': !Sub '${DependencyModule3}-IamActions'}]
              Resource: !Split [',', {'Fn::ImportValue': !Sub '${DependencyModule3}-IamResources'}]
            - !Ref 'AWS::NoValue'
  SecurityGroup:
    Condition: HasVpcModule
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      VpcId:
        'Fn::ImportValue': !Sub '${VpcModule}-Id'
  LogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !If [HasFunctionName, !Sub '/aws/lambda/${FunctionName}', !Join ['', ['/aws/lambda/cfn-modules-lambda-', !Select [2, !Split ['/', !Ref 'AWS::StackId']]]]]
      RetentionInDays: !Ref LogGroupRetentionInDays
  Function:
    Type: 'AWS::Lambda::Function'
    DependsOn: LogGroup
    Properties:
      Code: '../../../lambda-src/' # we can not make this a parameter because `aws cloudformation package` does not take parameters into account
      DeadLetterConfig: !If [HasDeadLetterQueueModule, {TargetArn: {'Fn::ImportValue': !Sub '${DeadLetterQueueModule}-Arn'}}, !Ref 'AWS::NoValue']
      Description: !If [HasDescription, !Ref Description, !Ref AWS::NoValue]
      Environment:
        Variables:
          VARIABLE1: !Ref EnvironmentVariable1
          VARIABLE2: !Ref EnvironmentVariable2
          VARIABLE3: !Ref EnvironmentVariable3
          VARIABLE4: !Ref EnvironmentVariable4
          VARIABLE5: !Ref EnvironmentVariable5
          DEPENDENCY1_ARN: !If [HasDependencyModule1, {'Fn::ImportValue': !Sub '${DependencyModule1}-Arn'}, '']
          DEPENDENCY2_ARN: !If [HasDependencyModule2, {'Fn::ImportValue': !Sub '${DependencyModule2}-Arn'}, '']
          DEPENDENCY3_ARN: !If [HasDependencyModule3, {'Fn::ImportValue': !Sub '${DependencyModule3}-Arn'}, '']
      FunctionName: !If [HasFunctionName, !Ref FunctionName, !Join ['', ['cfn-modules-lambda-', !Select [2, !Split ['/', !Ref 'AWS::StackId']]]]]
      Handler: !Ref Handler
      KmsKeyArn: !If [HasKmsKeyModule, {'Fn::ImportValue': !Sub '${KmsKeyModule}-Arn'}, !Ref 'AWS::NoValue']
      MemorySize: !Ref MemorySize
      ReservedConcurrentExecutions: !If [HasReservedConcurrentExecutions, !Ref ReservedConcurrentExecutions, !Ref 'AWS::NoValue']
      Role: !GetAtt 'Role.Arn'
      Runtime: !Ref Runtime
      Timeout: !Ref Timeout
      TracingConfig:
        Mode: !Ref TracingConfigMode
      VpcConfig: !If
      - HasVpcModule
      - SecurityGroupIds:
        - !Ref SecurityGroup
        - !If [HasClientSgModule1, {'Fn::ImportValue': !Sub '${ClientSgModule1}-SecurityGroupId'}, !Ref 'AWS::NoValue']
        - !If [HasClientSgModule2, {'Fn::ImportValue': !Sub '${ClientSgModule2}-SecurityGroupId'}, !Ref 'AWS::NoValue']
        - !If [HasClientSgModule3, {'Fn::ImportValue': !Sub '${ClientSgModule3}-SecurityGroupId'}, !Ref 'AWS::NoValue']
        SubnetIds: !Split [',', {'Fn::ImportValue': !Sub '${VpcModule}-SubnetIdsPrivate'}]
      - !Ref 'AWS::NoValue'
      Layers: !If [HasLayerArns, !Split [',', !Ref LayerArns], !Ref 'AWS::NoValue']
  EventInvokeConfig:
    Condition: HasDeadLetterQueueModule
    Type: 'AWS::Lambda::EventInvokeConfig'
    Properties:
      FunctionName: !Ref Function
      MaximumEventAgeInSeconds: 60
      MaximumRetryAttempts: 2
      Qualifier: '$LATEST'
  ErrorsTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Invocations failed due to errors in the function'
      Namespace: 'AWS/Lambda'
      MetricName: Errors
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      TreatMissingData: notBreaching
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Dimensions:
      - Name: FunctionName
        Value: !Ref Function
  ThrottlesTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Invocation attempts that were throttled due to invocation rates exceeding the concurrent limits'
      Namespace: 'AWS/Lambda'
      MetricName: Throttles
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      TreatMissingData: notBreaching
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Dimensions:
      - Name: FunctionName
        Value: !Ref Function
Outputs:
  ModuleId:
    Value: 'lambda-function'
  ModuleVersion:
    Value: '2.10.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Arn:
    Value: !GetAtt 'Function.Arn'
    Export:
      Name: !Sub '${AWS::StackName}-Arn'
  Name:
    Value: !Ref Function
    Export:
      Name: !Sub '${AWS::StackName}-Name'
  IamActions:
    Value: 'lambda:InvokeFunction'
    Export:
      Name: !Sub '${AWS::StackName}-IamActions'
  IamResources:
    Value: !GetAtt Function.Arn
    Export:
      Name: !Sub '${AWS::StackName}-IamResources'
  RoleArn:
    Value: !GetAtt 'Role.Arn'
    Export:
      Name: !Sub '${AWS::StackName}-RoleArn'
  RoleName:
    Value: !Ref Role
    Export:
      Name: !Sub '${AWS::StackName}-RoleName'