lambda-highest-version/template.yaml at main · nasratk/lambda-highest-version · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'

Parameters:
  FunctionName:
    Type: String
    Default: LambdaVersionFinder
    Description: The name of the Lambda function

  VpcId:
    Type: AWS::EC2::VPC::Id
    Default: vpc-0b3fedbd3cb005585
    Description: The ID of the VPC

  SubnetId1:
    Type: AWS::EC2::Subnet::Id
    Default: subnet-0dd5ee5ee4ad36255
    Description: The ID of the first subnet

  SubnetId2:
    Type: AWS::EC2::Subnet::Id
    Default: subnet-0c363b383db077bf9
    Description: The ID of the second subnet

Resources:
  LambdaVersionFinderFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Ref FunctionName
      Handler: lambda_function.get_highest_version
      Runtime: python3.12
      CodeUri: src
      Description: 'Queries lambda functions and returns the highest published version'
      MemorySize: 128
      Timeout: 10
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaVersionFinderSecurityGroup
        SubnetIds:
          - !Ref SubnetId1
          - !Ref SubnetId2
      Role: !GetAtt LambdaExecutionRole.Arn

  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub ExecutionRoleFor${FunctionName}
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: LambdaVersionFinderPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - lambda:ListVersionsByFunction
                  - lambda:GetFunction
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DeleteNetworkInterface
                  - ec2:AssignPrivateIpAddresses
                  - ec2:UnassignPrivateIpAddresses
                Resource: "*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  LambdaVersionFinderSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: !Sub ${FunctionName}SG
      GroupDescription: 'Security group for LambdaVersionFinder'
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: -1
          FromPort: 0
          ToPort: 65535
          CidrIp: 10.2.0.0/16
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0

  LiveAlias:
    Type: 'AWS::Lambda::Alias'
    Properties:
      FunctionName: !Ref LambdaVersionFinderFunction
      FunctionVersion: '$LATEST'
      Name: live