Common-PrivateAMIFunctions.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Common-PrivateAMIFunctions Template.
  This creates Lambda Functions related to Private AMIs. This is currently a placeholder for future Private AMI lookup functionality, which will not exist until we finish the Build VPC and Pipelines.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Dependencies
        Parameters:
          - LayersStackName
          - BucketsStackName
          - TopicsStackName
      - Label:
          default: Function Configuration
        Parameters:
          - LogRetention
    ParameterLabels:
      LayersStackName:
        default: Layers Stack Name
      BucketsStackName:
        default: Buckets Stack Name
      TopicsStackName:
        default: Topics Stack Name
      LogRetention:
        default: Log Retention
Parameters:
  LayersStackName:
    Description: Name of the CloudFormation Stack containing Layers
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Layers
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  BucketsStackName:
    Description: Name of the CloudFormation Stack containing Buckets
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Buckets
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  TopicsStackName:
    Description: Name of the CloudFormation Stack containing Topics
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Topics
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  LogRetention:
    Description: Number of days to retain CloudWatch Log Events for all AMI Lookup Lambda Functions
    Type: Number
    Default: 30
    AllowedValues:
      - 1
      - 3
      - 5
      - 7
      - 14
      - 30
      - 60
      - 90
    ConstraintDescription: must be 1, 3, 5, 7, 14, 30, 60 or 90.
Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: DescribeImagesPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeImages
                Resource: '*'
  BaselineAmazonLinuxImageLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/BaselineAmazonLinuxImage
      RetentionInDays: !Ref LogRetention
  BaselineAmazonLinuxImageFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: BaselineAmazonLinuxImage
      Description: A Lambda function that looks up the Baseline Amazon Linux Image for a given OS Variant and Region.
      Role: !GetAtt Role.Arn
      Runtime: nodejs10.x
      Timeout: 30
      Layers:
        - !ImportValue
            Fn::Sub: ${LayersStackName}-AsyncCustomResourceLayerVersionArn
      Handler: index.handler
      Code:
        ZipFile: |
          const response = require('cfn-response-promise');

          const AWS = require('aws-sdk');
          AWS.config.apiVersions = {
            ec2: '2016-11-15'
          };

          const osNameToFilter = {
            'Amazon Linux' : 'Baseline Amazon Linux' // List default first
          };

          exports.handler = async (event, context) => {
            console.info(`Request body:\n${JSON.stringify(event)}`);

            switch (event.RequestType) {
              case 'Create':
              case 'Update':
                try {
                  const accountId = event.ResourceProperties.AccountId || context.invokedFunctionArn.split(':')[4];
                  const region = event.ResourceProperties.Region || process.env.AWS_REGION;
                  const osName = event.ResourceProperties.OSName || Object.keys(osNameToFilter)[0];

                  let amiNameFilter = (! osNameToFilter[osName]) ? osNameToFilter[Object.keys(osNameToFilter)[0]] : osNameToFilter[osName];
                  amiNameFilter += '-*';
                  console.info(`OS: ${osName}`);
                  console.info(`Filter: ${amiNameFilter}`);

                  const ec2 = new AWS.EC2({region: region});

                  console.info(`Calling: DescribeImages...`);
                  const params = {
                    Filters: [{ Name: 'name', Values: [amiNameFilter]}],
                    Owners: [accountId]
                  };
                  const data = await ec2.describeImages(params).promise();

                  if (data.Images.length > 0) {
                    const image = data.Images.sort((x, y) => y.CreationDate.localeCompare(x.CreationDate))[0];
                    const responseData = {
                      Name: image.Name,
                      CreationDate: image.CreationDate
                    };
                    console.info(`Image: ${image.Name} (${image.ImageId})`);
                    await response.send(event, context, response.SUCCESS, responseData, image.ImageId);
                  }
                  else {
                    throw new Error(`Could not find Image(s) matching pattern ${amiNameFilter}`);
                  }
                }
                catch (err) {
                  const responseData = {Error: `${(err.code) ? err.code : 'Error'}: ${err.message}`};
                  console.error(responseData.Error);
                  await response.send(event, context, response.FAILED, responseData);
                }
                break;

              case 'Delete':
                await response.send(event, context, response.SUCCESS);
            }
          };
    DependsOn: BaselineAmazonLinuxImageLogGroup
Outputs:
  BaselineAmazonLinuxImageFunctionArn:
    Description: The BaselineAmazonLinuxImage Lambda Function ARN
    Value: !GetAtt BaselineAmazonLinuxImageFunction.Arn
    Export:
      Name: !Sub ${AWS::StackName}-BaselineAmazonLinuxImageFunctionArn