anghammarad.template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Anghammarad Lambda and SNS topic

Parameters:
  ArtifactBucket:
    Description: S3 bucket containing the Lambda's artifact
    Type: String
  ArtifactLocation:
    Description: S3 path to the Lambda's artifact
    Type: String
  ConfigBucket:
    Description: S3 bucket containing the configuration
    Type: String
  Stage:
    Description: Application stage (e.g. PROD, CODE)
    Type: String
    AllowedValues:
    - PROD
    - CODE
    - DEV
  AllowedAWSAccountIDs:
    Description: List of whitelisted account ids
    Type: CommaDelimitedList

Mappings:
  Constants:
    Stack:
      Value: deploy
    App:
      Value: anghammarad

Resources:
  ProcessorFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub anghammarad-${Stage}
      Description: !Sub Process Anghammarad ${Stage} notifications
      Policies:
      - Statement:
          - Effect: Allow
            Action:
            - ses:SendEmail
            Resource: "*"
      - Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub arn:aws:s3:::${ConfigBucket}/*
      Handler: com.gu.anghammarad.Lambda::handleRequest
      Runtime: java8
      MemorySize: 512
      Timeout: 30
      CodeUri:
        Bucket: !Ref ArtifactBucket
        Key: !Ref ArtifactLocation
      Events:
        Notification:
          Type: SNS
          Properties:
            Topic: !Ref NotificationTopic
      Environment:
        Variables:
          Stage: !Ref Stage
      Tags:
        Stack: !FindInMap [ Constants, Stack, Value ]
        App: !FindInMap [ Constants, App, Value ]
        Stage: !Ref Stage

  NotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub Anghammarad ${Stage} notification topic

  NotificationTopicPolicy:
    Type: "AWS::SNS::TopicPolicy"
    Properties:
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - SNS:Publish
          Principal:
            AWS: !Ref AllowedAWSAccountIDs
          Resource: "*"
      Topics:
      - !Ref NotificationTopic

Outputs:
  TopicName:
    Value: !GetAtt NotificationTopic.TopicName