deploy-function-and-schedule.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Parameters:
  UtilityName:
    Default: AnalyzeVacuumUtility
    Description: Utility to run with this instance of the Scheduled Event
    Type: String
    AllowedValues:
      - Analyze
      - Vacuum
      - AnalyzeVacuumUtility
      - ColumnEncodingUtility
      - Monitoring
      - SystemTablePersistence
  SecurityGroups:
    Default: mygroup1, mygroup2
    Description: Security Groups as CSV list to use for the deployed function (may be required for Redshift security policy)
    Type: CommaDelimitedList
  SubnetIds:
    Default: subnet1, subnet2, subnet3
    Description: List of private Subnets in VPC in which the function will egress network connections
    Type: CommaDelimitedList
  S3ConfigPath:
    Default: s3://my-bucket/prefix/config-file.json
    Description: Configuration File for this Utility instance
    Type: String
    AllowedPattern: ^s3:\/\/([A-z\-]+)\/(.*)$
  CronExpression:
    Default: 0 0 * * ? *
    Description: Cron expression indicating how frequently to run the specified utility (default is once a day at midnight)
    Type: String
    AllowedPattern: ^([0-5]?[0-9]|\*|\,|\-|\/) ([ 01]?[0-9]|2[0-3]|\*|\,|\-|\/) ([ 012]?[1-9]|3[01]|JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC|\*|\,|\-|\/|\?|L|W) ([0]?[1-9]|1[0-2]|\*|\,|\-|\/) ([1-7]|MON|TUE|WED|THU|FRI|SAT|SUN|\*|\,|\-|\/|\?|L|\#) (19[7-9][0-9]|2[01][0-9][0-9]|\*|\,|\-|\/)$
Resources:
  LambdaRedshiftAutomation:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.event_handler
      Runtime: python2.7
      CodeUri:         
        Bucket: !Sub awslabs-code-${AWS::Region}
        Key: LambdaRedshiftRunner/lambda-redshift-util-runner-1.4.zip
      MemorySize: 192
      Timeout: 300
      Tags:
        Name: LambdaRedshiftRunner
      Role: !GetAtt RedshiftAutomationIAMRole.Arn
      VpcConfig:
        SecurityGroupIds:
          !Ref SecurityGroups
        SubnetIds:
          !Ref SubnetIds
      Events:
        Timer:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CronExpression})
            Input: 
              !Sub | 
                {
                  "ExecuteUtility":"${UtilityName}",
                  "ConfigLocation":"${S3ConfigPath}"
                }
  RedshiftAutomationIAMRole:
    Type: "AWS::IAM::Role"
    Properties:
        RoleName: "LambdaRedshiftRunnerRole"
        Path: "/"
        ManagedPolicyArns:
            - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
            - "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            -
              Sid: "AllowLambdaServiceToAssumeRole"
              Effect: "Allow"
              Action:
                - "sts:AssumeRole"
              Principal:
                Service:
                  - "lambda.amazonaws.com"
        Policies:
          -
            PolicyName: "LambdaRedshiftRunnerPolicy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                -
                  Effect: "Allow"
                  Action:
                    - "s3:GetObject"
                    - "kms:Decrypt"
                    - "cloudwatch:PutMetricData"
                    - "redshift:ModifyClusterParameterGroup"
                  Resource: "*"