lambda-template.yml

---
AWSTemplateFormatVersion: 2010-09-09
Description: 'Lambda resources'


Parameters:
  NameTag:
    Type: String
  KmsKeyArn:
    Type: String
  APISecretPath:
    Type: String
  AppIds:
    Type: String


Resources:
  CustomResourceLambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'sts:AssumeRole'
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
      - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess'

  CustomResourceLambda:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: 'generic-custom-resource-provider'
      Handler: generic_provider.lambda_handler
      Code: cfn-generic-custom-resource/generic_provider/build
      Runtime: python3.7
      Role: !Sub '${CustomResourceLambdaRole.Arn}'
      Description: 'CloudFormation custom generic resource provider.'
      Timeout: 900
      Tags:
      - Key: Name
        Value: !Sub '${NameTag}'

  APISecret:
    Type: 'Custom::GetSSMSecret'
    DependsOn: CustomResourceLambda
    Version: 1.0
    Properties:
      ServiceToken: !Sub 'arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:generic-custom-resource-provider'
      NoEcho: True
      Version: 1.0
      AgentService: ssm
      AgentType: client
      AgentCreateMethod: get_parameter
      AgentWaitQueryExpr: '$.Parameter.Value'
      AgentCreateArgs: !Sub |
        {
          "Name": "${APISecretPath}",
          "WithDecryption": true
        }

  LambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - 'lambda.amazonaws.com'
          Action:
          - 'sts:AssumeRole'
      Path: '/'
      Policies:
      - PolicyName: 'AmazonLambdaServicePolicy'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'kms:DescribeKey'
            - 'kms:Decrypt'
            - 'kms:CreateGrant'
            Resource: '*'
      ManagedPolicyArns:
      - !Sub 'arn:${AWS::Partition}:iam::aws:policy/ReadOnlyAccess'

  Lambda:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: lambda_function.lambda_handler
      Code: lambda-functions/call-api
      Runtime: python3.7
      Role: !Sub '${LambdaRole.Arn}'
      Environment:
        Variables:
          AUTH_TOKEN: !Sub '${APISecret}'
          URLS: !Sub 'https://api-${NameTag}.unzoner.com/api/v1.0/devices/purge/${AppIds} https://api-${NameTag}.unzoner.com/api/v1.0/vpnprovider/NordVPN/update https://api-${NameTag}.unzoner.com/api/v1.0/vpnprovider/IPVanish/update'
      KmsKeyArn: !Sub '${KmsKeyArn}'
      Description: 'Lambda to make API calls.'
      Timeout: 900
      Tags:
      - Key: Name
        Value: !Sub '${NameTag}'

  LambdaEvent:
    Type: 'AWS::Events::Rule'
    Properties:
      Description: 'Schedule expression to make API calls.'
      ScheduleExpression: 'cron(0 10 * * ? *)'
      State: 'ENABLED'
      Targets:
      - Id: Lambda
        Arn: !GetAtt Lambda.Arn

  LambdaEventPermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      FunctionName: !Ref 'Lambda'
      Action: 'lambda:InvokeFunction'
      Principal: 'events.amazonaws.com'
      SourceArn: !GetAtt LambdaEvent.Arn


Outputs:
  StackName:
    Value: !Sub '${AWS::StackName}'
    Export:
      Name: !Sub 'StackName-${AWS::StackName}'
  CustomResourceLambdaArn:
    Value: !Sub '${CustomResourceLambda.Arn}'
    Export:
      Name: !Sub 'CustomResourceLambdaArn-${AWS::StackName}'
  Lambda:
    Value: !Sub '${Lambda.Arn}'
    Export:
      Name: !Sub 'Lambda-${AWS::StackName}'