lambda_config.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Creates a lambda function with roles to read EC2 instances and create Cloudwatch logs"
Parameters:
  ITGlueAPIURL:
    Default: https://api.itglue.com
    Description: The url of the IT Glue API
    Type: String
  ITGlueAPIKey:
    NoEcho: true
    Description: The IT Glue API Key
    Type: String
    MinLength: 1
  ITGlueOrganization:
    Description: The name or ID of the IT Glue Organization
    Type: String
    MinLength: 1

Resources:
  LambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"

  CloudWatchLogAccessPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "cloud_watch_logs_access"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "logs:*"
            Resource: "*"
      Roles:
        -
          Ref: "LambdaExecutionRole"

  EC2ReadPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "ec2_read_access"
      Roles:
        -
          Ref: "LambdaExecutionRole"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Resource: "*"
            Action:
              - "ec2:GetHostReservationPurchasePreview"
              - "ec2:GetConsoleScreenshot"
              - "ec2:GetLaunchTemplateData"
              - "ec2:GetReservedInstancesExchangeQuote"
              - "ec2:GetPasswordData"
              - "ec2:GetConsoleOutput"
              - "ec2:Describe*"

  EC2SyncFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      FunctionName: "ITGlueEC2SyncFunction"
      Handler: "lambda_handler.handler"
      Role: !GetAtt [ LambdaExecutionRole, Arn ]
      Code:
        ZipFile: fileb://lambda_handler.zip
      Environment:
        Variables:
          ITGLUE_API_KEY:
            Ref: ITGlueAPIKey
          ITGLUE_API_URL:
            Ref: ITGlueAPIURL
          ORGANIZATION:
            Ref: ITGlueOrganization
      Runtime: "python3.6"
      Timeout: "60"

  EC2StateEventRule:
    Type: "AWS::Events::Rule"
    Properties:
      Description: "EC2StateEventRule"
      EventPattern:
        source:
          - "aws.ec2"
        detail-type:
          - "EC2 Instance State-change Notification"
      Targets:
        -
          Arn:
            Fn::GetAtt:
              - "EC2SyncFunction"
              - "Arn"
          Id: "ITGlueEC2SyncFunction"

  PermissionForEventsToInvokeLambda:
    Type: "AWS::Lambda::Permission"
    Properties:
      FunctionName:
        Ref: "EC2SyncFunction"
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn:
        Fn::GetAtt:
          - "EC2StateEventRule"
          - "Arn"