Skip to content

Commit c01687a

Browse files
author
Ryan Lohan
committed
Added CFN templates for provisioning the package
1 parent 7f465b4 commit c01687a

File tree

3 files changed

+196
-0
lines changed

3 files changed

+196
-0
lines changed

‎template/CloudFormationHandlerInfrastructure.yaml

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Description: This CloudFormation template provisions all the infrastructure and dependencies for a Java Provider on Lambda
3+
4+
Parameters:
5+
ManagementUserArn:
6+
NoEcho: True
7+
Type: String
8+
9+
Resources:
10+
ArtifactBucket:
11+
Type: AWS::S3::Bucket
12+
Properties:
13+
BucketEncryption:
14+
ServerSideEncryptionConfiguration:
15+
- ServerSideEncryptionByDefault:
16+
KMSMasterKeyID:
17+
Ref: EncryptionKey
18+
SSEAlgorithm: aws:kms
19+
20+
LogGroup:
21+
Type: AWS::Logs::LogGroup
22+
Properties:
23+
RetentionInDays: 30
24+
25+
LambdaRole:
26+
Type: AWS::IAM::Role
27+
Properties:
28+
AssumeRolePolicyDocument:
29+
Version: "2012-10-17"
30+
Statement:
31+
-
32+
Effect: "Allow"
33+
Principal:
34+
Service:
35+
- "lambda.amazonaws.com"
36+
Action: "sts:AssumeRole"
37+
Policies:
38+
-
39+
PolicyName: CloudWatchMetricsPolicy
40+
PolicyDocument:
41+
Version: "2012-10-17"
42+
Statement:
43+
-
44+
Effect: "Allow"
45+
Action: "cloudwatch:PutMetricData"
46+
Resource: "*"
47+
-
48+
PolicyName: CloudWatchLogsPolicy
49+
PolicyDocument:
50+
Version: "2012-10-17"
51+
Statement:
52+
-
53+
Effect: "Allow"
54+
Action:
55+
- "logs:PutLogEvents"
56+
- "logs:CreateLogGroup"
57+
- "logs:CreateLogStream"
58+
Resource: !GetAtt LogGroup.Arn
59+
-
60+
PolicyName: CloudWatchEventsPolicy
61+
PolicyDocument:
62+
Version: "2012-10-17"
63+
Statement:
64+
-
65+
Effect: "Allow"
66+
Action:
67+
- "events:DeleteRule"
68+
- "events:PutTargets"
69+
- "events:DescribeRule"
70+
- "events:EnableRule"
71+
- "events:PutRule"
72+
- "events:RemoveTargets"
73+
Resource: "*"
74+
75+
76+
EncryptionKey:
77+
Type: AWS::KMS::Key
78+
Properties:
79+
Description: KMS key used to encrypt the resource provider artifacts and API payloads
80+
EnableKeyRotation: false # Can't rotate keys until we can ensure that re-invokes are not broken by rotation
81+
KeyPolicy:
82+
Version: "2012-10-17"
83+
Id: "key-default-1"
84+
Statement:
85+
-
86+
Sid: "Allow administration of the key"
87+
Effect: "Allow"
88+
Principal:
89+
AWS: !Ref ManagementUserArn
90+
Action:
91+
- "kms:Create*"
92+
- "kms:Describe*"
93+
- "kms:Enable*"
94+
- "kms:List*"
95+
- "kms:Put*"
96+
- "kms:Update*"
97+
- "kms:Revoke*"
98+
- "kms:Disable*"
99+
- "kms:Get*"
100+
- "kms:Delete*"
101+
- "kms:ScheduleKeyDeletion"
102+
- "kms:CancelKeyDeletion"
103+
Resource: "*"
104+
-
105+
Sid: "Allow use of the key"
106+
Effect: "Allow"
107+
Principal:
108+
AWS:
109+
- !GetAtt LambdaRole.Arn
110+
- !Ref ManagementUserArn
111+
Action:
112+
- "kms:Encrypt"
113+
- "kms:Decrypt"
114+
- "kms:ReEncrypt*"
115+
- "kms:GenerateDataKey*"
116+
- "kms:DescribeKey"
117+
Resource: "*"
118+
119+
Outputs:
120+
BucketName:
121+
Value: !Ref ArtifactBucket
122+
Export:
123+
Name: ArtifactBucket
124+
EncryptionKey:
125+
Value: !GetAtt EncryptionKey.Arn
126+
Export:
127+
Name: EncryptionKey
128+
LambdaRole:
129+
Value: !GetAtt LambdaRole.Arn
130+
Export:
131+
Name: LambdaRole

‎template/Handlers.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Description: This CloudFormation template provisions an S3 bucket to upload handler artifacts to
3+
4+
Parameters:
5+
ResourceType:
6+
Type: String
7+
AllowedPattern: "^[a-zA-Z0-9]{2,64}-[a-zA-Z0-9]{2,64}-[a-zA-Z0-9]{2,64}$"
8+
PackageS3Key:
9+
Type: String
10+
11+
Resources:
12+
CreateHandler:
13+
Type: AWS::Lambda::Function
14+
Properties:
15+
Code:
16+
S3Bucket: !ImportValue ArtifactBucket
17+
S3Key: !Ref PackageS3Key
18+
Description: !Sub "Create Handler for ${ResourceType} Resources"
19+
FunctionName: !Sub "create-${ResourceType}-handler"
20+
Handler: "com.aws.cfn.LambdaWrapper::handleRequest"
21+
KmsKeyArn: !ImportValue EncryptionKey
22+
MemorySize: 128
23+
Role: !ImportValue LambdaRole
24+
Runtime: "java8"
25+
Timeout: 120
26+
27+
Outputs:
28+
CreateHandlerArn:
29+
Value: !GetAtt CreateHandler.Arn
30+
Export:
31+
Name: !Sub "${ResourceType}-create-handler"

‎template/deploy.sh

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!sh
2+
ACCOUNT=123456789012
3+
HANDLERS_STACK_NAME=cfn-initech-tps-report-handlers
4+
INFRA_STACK_NAME=cfn-handler-infra
5+
RESOURCE_TYPE=Initech-TPS-Report
6+
TEST_PAYLOAD='{"action":"Create","requestContext":{"invocation":1,"resourceType":"Initech::TPS::Report"},"resourceModel":{"author":"Peter","title":"PC Load Letter","typeName":"Initech::TPS::Report"}}'
7+
OUTFILE=response.out
8+
9+
# create infra stack
10+
awscfn create-stack --stack-name $INFRA_STACK_NAME --template-body file://./CloudFormationHandlerInfrastructure.yaml --capabilities CAPABILITY_NAMED_IAM --parameters ParameterKey=ManagementUserArn,ParameterValue="arn:aws:iam::$ACCOUNT:root"
11+
12+
# wait til its done...
13+
...
14+
15+
# make sure infra stack can't be accidentally deleted
16+
awscfn update-termination-protection --stack-name cfn-handler-infra --enable-termination-protection
17+
18+
# I am no sed/awk guru but this works...
19+
BUCKET=`aws cloudformation list-exports | grep ArtifactBucket -A1 | awk '/Value/ {print $0}' | sed 's/"Value": "//g' | sed 's/"//g' | sed 's/ //g'`
20+
21+
# Upload handler pkg to S3 bucket. NOTE: Bucket is using KMS so your user needs to be able to use the KMS Key (Infra Stack should set this up automatically)
22+
aws s3 cp ../target/ResourceProviderExample-1.0.jar s3://$BUCKET
23+
24+
# Create the handlers
25+
awscfn create-stack --stack-name $STACK_NAME --template-body file://./Handlers.yaml --parameters ParameterKey=ResourceType,ParameterValue=$RESOURCE_TYPE ParameterKey=PackageS3Key,ParameterValue=ResourceProviderExample-1.0.jar
26+
27+
# Get handler Function ARN
28+
CREATE_HANDLER_ARN=`aws cloudformation list-exports | grep "$RESOURCE_TYPE-create-handler" -A1 | awk '/Value/ {print $0}' | sed 's/"Value": "//g' | sed 's/"//g' | sed 's/ //g'`
29+
30+
31+
# Test Invoke that puppy
32+
aws lambda invoke --function-name $CREATE_HANDLER_ARN --payload '{"action":"Create","requestContext":{"invocation":1,"resourceType":"Initech::TPS::Report"},"resourceModel":{"author":"Peter","title":"PC Load Letter","typeName":"Initech::TPS::Report"}}' $OUTFILE
33+
less $OUTFILE
34+
rm $OUTFILE

0 commit comments

Comments
 (0)