rds-auth-helper/function_template.yml at master · lambda-my-aws/rds-auth-helper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
Transform:
- AWS::Serverless-2016-10-31
Description: Template for function pgsql-auth-helper
Outputs:
  FunctionArn:
    Description: >-
      Lambda Function ARN
    Value: !GetAtt LambdaFunction.Arn
Parameters:
  AppSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
  VpcId:
    Type: AWS::EC2::VPC::Id
Resources:
  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for sg-psql-auth-helper
      GroupName:
        Fn::Sub: psql-auth-helper-${AWS::StackName}
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
          FromPort: '-1'
          ToPort: '-1'
      VpcId:
        Ref: VpcId

  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      VpcConfig:
        SubnetIds: !Ref AppSubnetIds
        SecurityGroupIds:
          - !Ref LambdaSecurityGroup
      CodeUri: pgsql-auth-helper.zip
      AutoPublishAlias: live
      Handler: function.lambda_handler
      Layers:
        - arn:aws:lambda:eu-west-1:373709687836:layer:requests:1
        - arn:aws:lambda:eu-west-1:373709687836:layer:pg8000:1
      MemorySize: 256
      Role:
        Fn::GetAtt:
        - LambdaFunctionRole
        - Arn
      Runtime: python3.7
      Timeout: 30
      FunctionName:
        Ref: AWS::NoValue

  LambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: DecryptWithKmsAnyKey
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action: kms:Decrypt
            Effect: Allow
            Resource:
            - '*'
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - Fn::Sub: lambda.${AWS::URLSuffix}
        Version: '2012-10-17'
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
      - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess