aws-lambda-fanout/cfn/execution-role.yml at master · Scout24/aws-lambda-fanout · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
AWSTemplateFormatVersion: "2010-09-09"
Description: 'Demonstrates which permissions are required for the fanout lambda.'
Parameters:
  fanoutFunctionName:
    Description: The fanout function's name
    Type: String
  dynamoDbArn:
    Description: The ARN of the DDB of which's stream to read from
    Type: String
  topicArn:
    Description: The ARN of the SNS topic to write to
    Type: String
Resources:
  FanoutLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${fanoutFunctionName}'
      RetentionInDays: 7

  FanoutExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${fanoutFunctionName}-executionRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: logToCloudWatch
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: !GetAtt FanoutLogGroup.Arn
      - PolicyName: accessTargetsTable
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: dynamodb:Query
            Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${fanoutFunctionName}Targets'
      # ################################################################################################################
      # Depending on the source & destination the fanout should be attached to, more permissions will be required
      # ################################################################################################################
      - PolicyName: readStreamData
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - dynamodb:DescribeStream
            - dynamodb:GetRecords
            - dynamodb:GetShardIterator
            - dynamodb:ListStreams
            Resource: !Sub '${dynamoArn}/stream/*'
      - PolicyName: publishToSns
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: sns:Publish
            Resource: !Ref topicArn