def add_lambda_role(self, title, extra_permissions):
perms = self.DEFAULT_PERMISSIONS.union(extra_permissions)
permissions = [Action(*perm) for perm in perms]
return self.template.add_resource(
iam.Role(title + 'LambdaRole',
Path='/',
Policies=[
iam.Policy(
PolicyName=title + 'LambdaExecution',
PolicyDocument=Policy(
Version='2012-10-17',
Statement=[
Statement(Effect=Allow,
Action=[Action('logs', '*')],
Resource=['arn:aws:logs:*:*:*'
]),
Statement(
Effect=Allow,
Action=list(permissions),
Resource=['*'],
)
]))
],
AssumeRolePolicyDocument=get_lambda_assumerole_policy()))
def create_role(self):
t = self.template
vpc_policy = NoValue
if self.get_variables()["VpcConfig"]:
# allow this Lambda to modify ENIs to allow it to run in our VPC.
policy_prefix = self.context.get_fqn(self.name)
vpc_policy = [
iam.Policy(
PolicyName="%s-vpc-policy" % policy_prefix,
PolicyDocument=Policy(
Statement=lambda_vpc_execution_statements()
),
)
]
self.role = t.add_resource(
iam.Role(
"Role",
AssumeRolePolicyDocument=get_lambda_assumerole_policy(),
Policies=vpc_policy
)
)
t.add_output(
Output("RoleName", Value=Ref(self.role))
)
role_arn = self.role.GetAtt("Arn")
self.role_arn = role_arn
t.add_output(
Output("RoleArn", Value=role_arn)
)
def create_role(self):
t = self.template
self.role = t.add_resource(
iam.Role(
"Role",
AssumeRolePolicyDocument=get_lambda_assumerole_policy()
)
)
if self.get_variables()["VpcConfig"]:
# allow this Lambda to modify ENIs to allow it to run in our VPC.
self.role.Policies = [
iam.Policy(
PolicyName=Sub("${AWS::StackName}-vpc-policy"),
PolicyDocument=Policy(
Statement=lambda_vpc_execution_statements()
),
)
]
t.add_output(
Output("RoleName", Value=Ref(self.role))
)
role_arn = self.role.GetAtt("Arn")
self.role_arn = role_arn
t.add_output(
Output("RoleArn", Value=role_arn)
)
def create_role(self):
t = self.template
self.role = t.add_resource(
iam.Role(
"Role",
AssumeRolePolicyDocument=get_lambda_assumerole_policy(),
)
)
t.add_output(
Output("RoleName", Value=Ref(self.role))
)
t.add_output(
Output("RoleArn", Value=GetAtt(self.role.title, "Arn"))
)
def create_lambda_role(self, name):
return self.create_role(name, get_lambda_assumerole_policy())
def create_template():
t = Template(Description="Infrastructure for routezero")
api_key = t.add_parameter(Parameter("ZerotierApiKey", Type="String", NoEcho=True))
network_id = t.add_parameter(Parameter("ZerotierNetworkId", Type="String"))
role = t.add_resource(
Role(
"Role",
AssumeRolePolicyDocument=get_lambda_assumerole_policy(),
Policies=[
Policy(
PolicyName="cloudformation-route53-update",
PolicyDocument=PolicyDocument(
Statement=[
Statement(
Effect=Allow,
Action=[
cloudformation.Action("*"),
route53.Action("*"),
],
Resource=["*"],
)
]
),
)
],
ManagedPolicyArns=[
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
],
)
)
function = t.add_resource(
CLIFunction(
"Function",
MemorySize=256,
Timeout=60 * 15,
Handler=".".join([routezero.__name__, routezero.handler.__name__]),
Runtime="python3.6",
Code=create_bundle(),
Role=GetAtt(role, "Arn"),
Environment=Environment(
Variables={
"ZEROTIER_API_KEY": Ref(api_key),
"ZEROTIER_NETWORK_ID": Ref(network_id),
"ROUTE53_RECORD_STACK_NAME": Sub("${AWS::StackName}Records"),
}
),
)
)
log_group = t.add_resource(
LogGroup(
"LogGroup", LogGroupName=Sub("/aws/lambda/${Function}"), RetentionInDays=30
)
)
permission = t.add_resource(
Permission(
"Permission",
FunctionName=GetAtt(function, "Arn"),
Principal="events.amazonaws.com",
Action="lambda:InvokeFunction",
SourceArn=Sub(
"arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/*"
),
DependsOn=[log_group],
)
)
rule = t.add_resource(
Rule(
"Rule",
ScheduleExpression="rate(15 minutes)",
Targets=[Target(Id=Ref(function), Arn=GetAtt(function, "Arn"))],
DependsOn=[permission],
)
)
return t
def create_lambda_role(self, name):
return self.create_role(name, get_lambda_assumerole_policy())
def create_template(website_template, website_parameters):
template = Template()
runtime = template.add_parameter(
Parameter("LambdaRuntime", Default="python3.7", Type="String"))
smite_developer_id = template.add_parameter(
Parameter("SmiteDeveloperId", Type="String"))
smite_auth_key = template.add_parameter(
Parameter("SmiteAuthKey", Type="String", NoEcho=True))
twitter_consumer_key = template.add_parameter(
Parameter("TwitterConsumerKey", Type="String"))
twitter_consumer_secret = template.add_parameter(
Parameter("TwitterConsumerSecret", Type="String", NoEcho=True))
twitter_access_key = template.add_parameter(
Parameter("TwitterAccessKey", Type="String"))
twitter_access_secret = template.add_parameter(
Parameter("TwitterAccessSecret", Type="String", NoEcho=True))
table = template.add_resource(
Table(
"StorageTable",
AttributeDefinitions=[
AttributeDefinition(AttributeName="key", AttributeType="N")
],
KeySchema=[KeySchema(AttributeName="key", KeyType="HASH")],
BillingMode="PAY_PER_REQUEST",
DeletionPolicy="Retain",
))
website = template.add_resource(
Stack("Website",
TemplateURL=website_template,
Parameters=website_parameters))
role = template.add_resource(
Role(
"LambdaRole",
AssumeRolePolicyDocument=get_lambda_assumerole_policy(),
ManagedPolicyArns=[
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
"arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
"arn:aws:iam::aws:policy/AmazonS3FullAccess",
"arn:aws:iam::aws:policy/AWSLambdaFullAccess",
],
))
smite_api_function = template.add_resource(
Function(
"SmiteApiFunction",
Code=Code(ZipFile=inspect.getsource(smite)),
Handler="index.handler",
MemorySize=256,
Timeout=30,
Runtime=Ref(runtime),
Role=GetAtt(role, "Arn"),
Environment=Environment(
Variables={
smite.Config.SMITE_DEVELOPER_ID.name: Ref(
smite_developer_id),
smite.Config.SMITE_AUTH_KEY.name: Ref(smite_auth_key),
}),
))
smite_api_logs = template.add_resource(
log_group_for_function(smite_api_function))
twitter_api_function = template.add_resource(
Function(
"TwitterApiFunction",
Code=Code(ZipFile=inspect.getsource(twitter)),
Handler="index.handler",
MemorySize=256,
Timeout=30,
Runtime=Ref(runtime),
Role=GetAtt(role, "Arn"),
Environment=Environment(
Variables={
twitter.Config.TWITTER_CONSUMER_KEY.name:
Ref(twitter_consumer_key),
twitter.Config.TWITTER_CONSUMER_SECRET.name:
Ref(twitter_consumer_secret),
twitter.Config.TWITTER_ACCESS_KEY.name:
Ref(twitter_access_key),
twitter.Config.TWITTER_ACCESS_SECRET.name:
Ref(twitter_access_secret),
}),
))
twitter_api_logs = template.add_resource(
log_group_for_function(twitter_api_function))
table_export_function = template.add_resource(
Function(
"TableExportFunction",
Code=Code(ZipFile=packmodule.pack(inspect.getsource(exporter))),
Handler="index.handler",
MemorySize=512,
Timeout=30,
Runtime=Ref(runtime),
Role=GetAtt(role, "Arn"),
Environment=Environment(
Variables={
exporter.Config.DDB_TABLE_NAME.name:
Ref(table),
exporter.Config.S3_BUCKET_NAME.name:
Select(
5,
Split(":", GetAtt(website,
"Outputs.ContentBucketArn"))),
exporter.Config.SMITE_API_LAMBDA_ARN.name:
GetAtt(smite_api_function, "Arn"),
}),
))
table_export_logs = template.add_resource(
log_group_for_function(table_export_function))
update_check_function = template.add_resource(
Function(
"UpdateCheckFunction",
Code=Code(ZipFile=inspect.getsource(updater)),
Handler="index.handler",
MemorySize=256,
Timeout=30,
Runtime=Ref(runtime),
Role=GetAtt(role, "Arn"),
Environment=Environment(
Variables={
updater.Config.TWITTER_API_LAMBDA_ARN.name:
GetAtt(twitter_api_function, "Arn"),
updater.Config.SMITE_API_LAMBDA_ARN.name:
GetAtt(smite_api_function, "Arn"),
updater.Config.TABLE_EXPORT_LAMBDA_ARN.name:
GetAtt(table_export_function, "Arn"),
updater.Config.DDB_TABLE_NAME.name:
Ref(table),
}),
))
update_check_logs = template.add_resource(
log_group_for_function(update_check_function))
update_check_rule = template.add_resource(
Rule(
"UpdateCheckRule",
ScheduleExpression="rate(5 minutes)",
Targets=[
Target(
Id=Ref(update_check_function),
Arn=GetAtt(update_check_function, "Arn"),
)
],
DependsOn=[
update_check_logs,
table_export_logs,
smite_api_logs,
twitter_api_logs,
],
))
template.add_resource(
Permission(
"UpdateCheckPermission",
Action="lambda:InvokeFunction",
FunctionName=Ref(update_check_function),
SourceArn=GetAtt(update_check_rule, "Arn"),
Principal="events.amazonaws.com",
))
return template