deploy.yaml

#This is deploy.yaml V 0.9.1
#This file will set up most of what is needed to configure the Lambda Redshift database 
#loader
#It will not create the KMS key required for encrypting the database password
#The user will need to create that key and assign it the alias "LambdaRedshiftLoaderKey" 
#The config script will use the key by its alias
#
#Parameters and notes


AWSTemplateFormatVersion: "2010-09-09" 
Parameters:  
 KmsKeyArn:
   Description: "The KMS Key to use for Encryption"
   Type: String
        
Resources: 
  RedshiftLoaderIamPolicy: 
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "RedshiftLambdaLoaderPolicy"
      Roles:
          - !Ref LambdaTriggerRole
      PolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - Effect: "Allow"
            Action: 
                - "dynamodb:CreateTable"
                - "dynamodb:PutItem"
                - "dynamodb:DeleteItem"
                - "dynamodb:GetItem"
                - "dynamodb:Scan"
                - "dynamodb:Query"
                - "dynamodb:UpdateItem"
                - "dynamodb:DeleteTable"
                - "dynamodb:UpdateTable"
                - "dynamodb:GetRecords"
            Resource:
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftBatches
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftBatchLoadConfig
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftProcessedFiles 
          - Effect: "Allow"
            Action: 
                - "lambda:CreateFunction"
                - "lambda:AddPermission"
                - "lambda:InvokeFunction"
                - "lambda:GetFunction"
                - "lambda:GetFunctionConfiguration"
                - "lambda:DeleteFunction"
                - "lambda:GetPolicy"
            Resource: 
              'Fn::GetAtt':
                - LambdaTriggerFunction
                - Arn
          - Effect: "Allow"
            Action:
                - "dynamodb:ListTables"
                - "lambda:ListFunctions"                
                - "s3:List*" 
                - "s3:GetObject"
                - "s3:PutObject"
                - "logs:CreateLogStream"
                - "logs:PutLogEvents"
            Resource: "*"
          - Effect: "Allow"
            Action:     
                - "kms:Encrypt"
                - "kms:Decrypt"
                - "kms:ReEncrypt*"
                - "kms:GenerateDataKey*"
                - "kms:DescribeKey"
            Resource: !Ref KmsKeyArn             
        
  LambdaTriggerRole: 
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"      
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - 
            Effect: "Allow"
            Principal: 
              Service: 
                - lambda.amazonaws.com
            Action: 
              - sts:AssumeRole
        
  LambdaTriggerFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: 'LambdaRedshiftLoader'
      Handler: index.handler
      Role:
        'Fn::GetAtt':
          - LambdaTriggerRole
          - Arn
      Code:
        S3Bucket: !Sub awslabs-code-${AWS::Region}
        S3Key: 'LambdaRedshiftLoader/AWSLambdaRedshiftLoader-2.8.3.zip'
      Runtime: nodejs12.x