electronic-prescription-service-account-resources/SAMtemplates/common_lambda_resources.yml at 23562d4d2f91e77b1ab74c078f6cfef217c48986 · NHSDigital/electronic-prescription-service-account-resources · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >
  Resources for a lambda

Parameters:
  CloudWatchKMSKey:
    Type: String
    Description: Cloudwatch KMS key
    AllowedPattern: "^arn:[a-z0-9-]+:kms:[a-z0-9-]+:\\d{12}:(key|alias)/.+\\Z"
  SplunkSubscriptionFilterRole:
    Type: String
    Description: Subscription filter role for sending logs to splunk
    AllowedPattern: "^arn:(aws|aws-cn|aws-iso|aws-iso-[a-z]{1}|aws-us-gov):iam::\\d{12}:role/.*$"
  SplunkDeliveryStream:
    Type: String
    Description: Splunk delivery stream
    Default: none
  EnableSplunk:
    Type: String
    Description: Whether to use splunk
    Default: false
    AllowedValues: [true, false]
  LambdaName:
    Type: String
    Description: Name of lambda we are creating for
  LogRetentionDays:
    Type: Number
    Description: How long to keep logs for
    AllowedValues:
      [
        1,
        3,
        5,
        7,
        14,
        30,
        60,
        90,
        120,
        150,
        180,
        365,
        400,
        545,
        731,
        1096,
        1827,
        2192,
        2557,
        2922,
        3288,
        3653,
      ]
  IncludeAdditionalPolicies:
    Type: String
    Default: false

  AdditionalPolicies:
    Type: CommaDelimitedList
    Description: A list of additional policies to attach the lambdas role (comma delimited).
    Default: none

Conditions:
  ShouldUseSplunk: !Equals [true, !Ref EnableSplunk]

  ShouldIncludeAdditionalPolicies: !Equals
    - true
    - !Ref IncludeAdditionalPolicies

Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns: !Split
        - ","
        - !Join
          - ","
          - - !Ref LambdaManagedPolicy
            - !ImportValue account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn
            - !ImportValue account-resources-cdk-uk:IAM:LambdaEncryptCloudwatchKMSPolicy:Arn
            - !ImportValue secrets-cdk:IAM:LambdaDecryptSecretsKMSPolicy:Arn
            - !If
              - ShouldIncludeAdditionalPolicies
              - !Join
                - ','
                - !Ref AdditionalPolicies
              - !Ref AWS::NoValue

  LambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !GetAtt LambdaLogGroup.Arn
              - !Sub ${LambdaLogGroup.Arn}:log-stream:*

  LambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Metadata:
      guard:
        SuppressedRules:
        - CW_LOGGROUP_RETENTION_PERIOD_CHECK
    Properties:
      LogGroupName: !Sub "/aws/lambda/${LambdaName}"
      RetentionInDays: !Ref LogRetentionDays
      KmsKeyId: !Ref CloudWatchKMSKey

  LambdaSplunkSubscriptionFilter:
    Condition: ShouldUseSplunk
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      RoleArn: !Ref SplunkSubscriptionFilterRole
      LogGroupName: !Ref LambdaLogGroup
      FilterPattern: "" # All logs
      DestinationArn: !Ref SplunkDeliveryStream

Outputs:
  LambdaRoleArn:
    Description: "LambdaRole ARN"
    Value: !GetAtt LambdaRole.Arn
  LambdaRoleName:
    Description: "LambdaRole Name"
    Value: !Ref LambdaRole