bastion-lambda.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Lambda and API Gateway part of the Fargate Bastions
Parameters:
  BastionCluster:
    Type: String
    Description: What is the name of the Bastion Cluster?
    Default: default
  BastionSubnets:
    Type: String
    Description: The list of public subnets you want the bastions to appear in
  BastionVpc:
    Type: String
    Description: The vpc of the public subnets
  CleanupSchedule:
    Type: String
    Description: What is the schedule for automated deletion of all bastions?
    Default: "cron(0 14 * * ? *)"
Resources:
  CreateBastion:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python2.7
      CodeUri: ./create-bastion
      Description: Creates a bastion server
      Timeout: 30
      Environment:
        Variables:
          BASTION_CLUSTER: !Ref BastionCluster
          BASTION_SUBNETS: !Ref BastionSubnets
          BASTION_VPC: !Ref BastionVpc
      Events:
        CreateBastion:
          Type: Api
          Properties:
            Path: /
            Method: post
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DescribeSecurityGroups'
                - 'ec2:AuthorizeSecurityGroupIngress'
                - 'ec2:CreateSecurityGroup'
              Resource: '*'
            - Effect: Allow
              Action:
                - 'ecs:RunTask'
                - 'ecs:ListTask*'
                - 'ecs:DescribeTask*'
              Resource: '*'
              Condition:
                ArnEquals:
                  "ecs:cluster": !Join
                    - ''
                    - - 'arn:aws:ecs:'
                      - !Ref "AWS::Region"
                      - ':'
                      - !Ref "AWS::AccountId"
                      - ':cluster/'
                      - !Ref BastionCluster
            - Effect: Allow
              Action:
                - 'iam:PassRole'
              Resource: '*'
  DeleteBastionTrigger:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python2.7
      CodeUri: ./delete-bastion-trigger
      Description: Trigger function for deleting a bastion server
      Timeout: 30
      Environment:
        Variables:
          DELETE_FUNCTION: !Ref DeleteBastion
      Events:
        DeleteBastion:
          Type: Api
          Properties:
            Path: /
            Method: delete
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'lambda:InvokeFunction'
              Resource:
                - !GetAtt DeleteBastion.Arn
  DeleteBastion:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python2.7
      CodeUri: ./delete-bastion
      Description: Function that actually deletes the bastion server
      Timeout: 120
      Environment:
        Variables:
          BASTION_CLUSTER: !Ref BastionCluster
          BASTION_VPC: !Ref BastionVpc
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'ec2:DeleteSecurityGroup'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DescribeSecurityGroups'
              Resource: '*'
            - Effect: Allow
              Action:
                - 'ecs:StopTask'
                - 'ecs:ListTask*'
                - 'ecs:DescribeTask*'
              Resource: '*'
              Condition:
                ArnEquals:
                  "ecs:cluster": !Join
                    - ''
                    - - 'arn:aws:ecs:'
                      - !Ref "AWS::Region"
                      - ':'
                      - !Ref "AWS::AccountId"
                      - ':cluster/'
                      - !Ref BastionCluster
  DeleteAllBastions:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python2.7
      CodeUri: ./delete-all-bastions
      Description: Function that deletes all bastions
      Timeout: 120
      Environment:
        Variables:
          BASTION_CLUSTER: !Ref BastionCluster
          BASTION_VPC: !Ref BastionVpc
      Events:
        CleanupTrigger:
          Type: Schedule
          Properties:
            Schedule: !Ref CleanupSchedule
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'ec2:DeleteSecurityGroup'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DescribeSecurityGroups'
              Resource: '*'
            - Effect: Allow
              Action:
                - 'ecs:StopTask'
                - 'ecs:ListTask*'
                - 'ecs:DescribeTask*'
              Resource: '*'
              Condition:
                ArnEquals:
                  "ecs:cluster": !Join
                    - ''
                    - - 'arn:aws:ecs:'
                      - !Ref "AWS::Region"
                      - ':'
                      - !Ref "AWS::AccountId"
                      - ':cluster/'
                      - !Ref BastionCluster