Common-DomainFunctions.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Common-DomainFunctions Template.
  This creates Lambda Functions related to Route53 Domains and HostedZones. There are direct Functions to make the
  changes within the same Account, and corresponding proxy Functions to make the changes in another Account.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Dependencies
        Parameters:
          - LayersStackName
          - BucketsStackName
          - TopicsStackName
      - Label:
          default: Function Configuration
        Parameters:
          - DomainNameServersFunctionKey
          - DomainNameServersFunctionObjectVersion
          - DomainNameServersLogRetention
          - HostedZoneDelegationFunctionKey
          - HostedZoneDelegationFunctionObjectVersion
          - HostedZoneDelegationLogRetention
          - DomainNameServersProxyFunctionKey
          - DomainNameServersProxyFunctionObjectVersion
          - DomainNameServersProxyLogRetention
          - HostedZoneDelegationProxyFunctionKey
          - HostedZoneDelegationProxyFunctionObjectVersion
          - HostedZoneDelegationProxyLogRetention
    ParameterLabels:
      LayersStackName:
        default: Layers Stack Name
      BucketsStackName:
        default: Buckets Stack Name
      TopicsStackName:
        default: Topics Stack Name
      DomainNameServersFunctionKey:
        default: DomainNameServers Function S3 Key
      DomainNameServersFunctionObjectVersion:
        default: DomainNameServers Function S3 Object Version
      DomainNameServersLogRetention:
        default: DomainNameServers Log Retention
      HostedZoneDelegationFunctionKey:
        default: HostedZoneDelegation Function S3 Key
      HostedZoneDelegationFunctionObjectVersion:
        default: HostedZoneDelegation Function S3 Object Version
      HostedZoneDelegationLogRetention:
        default: HostedZoneDelegation Log Retention
      DomainNameServersProxyFunctionKey:
        default: DomainNameServersProxy Function S3 Key
      DomainNameServersProxyFunctionObjectVersion:
        default: DomainNameServersProxy Function S3 Object Version
      DomainNameServersProxyLogRetention:
        default: DomainNameServersProxy Log Retention
      HostedZoneDelegationProxyFunctionKey:
        default: HostedZoneDelegationProxy Function S3 Key
      HostedZoneDelegationProxyFunctionObjectVersion:
        default: HostedZoneDelegationProxy Function S3 Object Version
      HostedZoneDelegationProxyLogRetention:
        default: HostedZoneDelegationProxy Log Retention
Parameters:
  LayersStackName:
    Description: Name of the CloudFormation Stack containing Layers
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Layers
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  BucketsStackName:
    Description: Name of the CloudFormation Stack containing Buckets
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Buckets
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  TopicsStackName:
    Description: Name of the CloudFormation Stack containing Topics
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Topics
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  DomainNameServersFunctionKey:
    Description: Key of Object within the S3 Bucket containing the DomainNameServers Lambda Function zipfile
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: DomainNameServers.zip
    AllowedPattern: ^[-_.a-zA-Z0-9]*\.zip$
    ConstraintDescription: must be a valid zipfilename, not containing slashes.
  DomainNameServersFunctionObjectVersion:
    Description: Version of Object within the S3 Bucket containing the DomainNameServers Lambda Function zipfile
    Type: String
    MaxLength: 32
    Default: ''
    ConstraintDescription: must be a valid S3 Object Version.
  DomainNameServersLogRetention:
    Description: Number of days to retain CloudWatch Log Events for the DomainNameServers Lambda Function
    Type: Number
    Default: 30
    AllowedValues:
      - 1
      - 3
      - 5
      - 7
      - 14
      - 30
      - 60
      - 90
    ConstraintDescription: must be 1, 3, 5, 7, 14, 30, 60 or 90.
  HostedZoneDelegationFunctionKey:
    Description: Key of Object within the S3 Bucket containing the HostedZoneDelegation Lambda Function zipfile
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: HostedZoneDelegation.zip
    AllowedPattern: ^[-_.a-zA-Z0-9]*\.zip$
    ConstraintDescription: must be a valid zipfilename, not containing slashes.
  HostedZoneDelegationFunctionObjectVersion:
    Description: Version of Object within the S3 Bucket containing the HostedZoneDelegation Lambda Function zipfile
    Type: String
    MaxLength: 32
    Default: ''
    ConstraintDescription: must be a valid S3 Object Version.
  HostedZoneDelegationLogRetention:
    Description: Number of days to retain CloudWatch Log Events for the HostedZoneDelegation Lambda Function
    Type: Number
    Default: 30
    AllowedValues:
      - 1
      - 3
      - 5
      - 7
      - 14
      - 30
      - 60
      - 90
    ConstraintDescription: must be 1, 3, 5, 7, 14, 30, 60 or 90.
  DomainNameServersProxyFunctionKey:
    Description: Key of Object within the S3 Bucket containing the DomainNameServersProxy Lambda Function zipfile
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: DomainNameServersProxy.zip
    AllowedPattern: ^[-_.a-zA-Z0-9]*\.zip$
    ConstraintDescription: must be a valid zipfilename, not containing slashes.
  DomainNameServersProxyFunctionObjectVersion:
    Description: Version of Object within the S3 Bucket containing the DomainNameServersProxy Lambda Function zipfile
    Type: String
    MaxLength: 32
    Default: ''
    ConstraintDescription: must be a valid S3 Object Version.
  DomainNameServersProxyLogRetention:
    Description: Number of days to retain CloudWatch Log Events for the DomainNameServersProxy Lambda Function
    Type: Number
    Default: 30
    AllowedValues:
      - 1
      - 3
      - 5
      - 7
      - 14
      - 30
      - 60
      - 90
    ConstraintDescription: must be 1, 3, 5, 7, 14, 30, 60 or 90.
  HostedZoneDelegationProxyFunctionKey:
    Description: Key of Object within the S3 Bucket containing the HostedZoneDelegationProxy Lambda Function zipfile
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: HostedZoneDelegationProxy.zip
    AllowedPattern: ^[-_.a-zA-Z0-9]*\.zip$
    ConstraintDescription: must be a valid zipfilename, not containing slashes.
  HostedZoneDelegationProxyFunctionObjectVersion:
    Description: Version of Object within the S3 Bucket containing the HostedZoneDelegationProxy Lambda Function zipfile
    Type: String
    MaxLength: 32
    Default: ''
    ConstraintDescription: must be a valid S3 Object Version.
  HostedZoneDelegationProxyLogRetention:
    Description: Number of days to retain CloudWatch Log Events for the HostedZoneDelegationProxy Lambda Function
    Type: Number
    Default: 30
    AllowedValues:
      - 1
      - 3
      - 5
      - 7
      - 14
      - 30
      - 60
      - 90
    ConstraintDescription: must be 1, 3, 5, 7, 14, 30, 60 or 90.
Conditions:
  ConfigureDomainNameServersFunctionObjectVersion: !Not [ !Equals [ !Ref DomainNameServersFunctionObjectVersion, '' ]]
  ConfigureHostedZoneDelegationFunctionObjectVersion: !Not [ !Equals [ !Ref HostedZoneDelegationFunctionObjectVersion, '' ]]
  ConfigureDomainNameServersProxyFunctionObjectVersion: !Not [ !Equals [ !Ref DomainNameServersProxyFunctionObjectVersion, '' ]]
  ConfigureHostedZoneDelegationProxyFunctionObjectVersion: !Not [ !Equals [ !Ref HostedZoneDelegationProxyFunctionObjectVersion, '' ]]
Resources:
  DomainNameServersRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: DomainNameServersPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: AllowGetDomainInfo
                Effect: Allow
                Action:
                  - route53domains:ListDomains
                  - route53domains:GetDomainDetail
                Resource: '*'
              - Sid: AllowUpdateDomainNameservers
                Effect: Allow
                Action:
                  - route53domains:UpdateDomainNameservers
                Resource: '*'
  DomainNameServersLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/DomainNameServers
      RetentionInDays: !Ref DomainNameServersLogRetention
  DomainNameServersFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: DomainNameServers
      Description: A Lambda function that updates NameServers for a Route53 Domain.
      Role: !GetAtt DomainNameServersRole.Arn
      Runtime: nodejs10.x
      Timeout: 30
      Layers:
        - !ImportValue
            Fn::Sub: ${LayersStackName}-AsyncCustomResourceLayerVersionArn
      Handler: DomainNameServers.handler
      Code:
        S3Bucket: !ImportValue
          Fn::Sub: ${BucketsStackName}-FunctionsBucket
        S3Key: !Ref DomainNameServersFunctionKey
        S3ObjectVersion: !If [ ConfigureDomainNameServersFunctionObjectVersion, !Ref DomainNameServersFunctionObjectVersion, !Ref 'AWS::NoValue' ]
    DependsOn: DomainNameServersLogGroup
  HostedZoneDelegationRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: HostedZoneDelegationPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: AllowGetHostedZoneInfo
                Effect: Allow
                Action:
                  - route53:ListHostedZonesByName
                  - route53:GetHostedZone
                  - route53:ListResourceRecordSets
                  - route53:GetChange
                Resource: '*'
              - Sid: AllowChangeResourceRecordSets
                Effect: Allow
                Action:
                  - route53:ChangeResourceRecordSets
                Resource: '*'
  HostedZoneDelegationLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/HostedZoneDelegation
      RetentionInDays: !Ref HostedZoneDelegationLogRetention
  HostedZoneDelegationFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: HostedZoneDelegation
      Description: A Lambda function that manages a sub-domain delegation in a HostedZone.
      Role: !GetAtt HostedZoneDelegationRole.Arn
      Runtime: nodejs10.x
      Timeout: 120 # Confirmation can take 30 to 60 seconds
      Layers:
        - !ImportValue
            Fn::Sub: ${LayersStackName}-AsyncCustomResourceLayerVersionArn
      Handler: HostedZoneDelegation.handler
      Code:
        S3Bucket: !ImportValue
          Fn::Sub: ${BucketsStackName}-FunctionsBucket
        S3Key: !Ref HostedZoneDelegationFunctionKey
        S3ObjectVersion: !If [ ConfigureHostedZoneDelegationFunctionObjectVersion, !Ref HostedZoneDelegationFunctionObjectVersion, !Ref 'AWS::NoValue' ]
    DependsOn: HostedZoneDelegationLogGroup
  DomainNameServersProxyRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AssumeDomainNameServersProxyRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub arn:aws:iam::*:role/DomainNameServersProxyRole
  DomainNameServersProxyLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/DomainNameServersProxy
      RetentionInDays: !Ref DomainNameServersProxyLogRetention
  DomainNameServersProxyFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: DomainNameServersProxy
      Description: A Lambda proxy function that calls another Lambda management function to update NameServers in a Route53 Domain in another Account.
      Role: !GetAtt DomainNameServersProxyRole.Arn
      Runtime: nodejs10.x
      Timeout: 120
      Layers:
        - !ImportValue
            Fn::Sub: ${LayersStackName}-AsyncCustomResourceLayerVersionArn
      Handler: DomainNameServersProxy.handler
      Code:
        S3Bucket: !ImportValue
          Fn::Sub: ${BucketsStackName}-FunctionsBucket
        S3Key: !Ref DomainNameServersProxyFunctionKey
        S3ObjectVersion: !If [ ConfigureDomainNameServersProxyFunctionObjectVersion, !Ref DomainNameServersProxyFunctionObjectVersion, !Ref 'AWS::NoValue' ]
    DependsOn: DomainNameServersProxyLogGroup
  HostedZoneDelegationProxyRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AssumeHostedZoneDelegationProxyRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub arn:aws:iam::*:role/HostedZoneDelegationProxyRole
  HostedZoneDelegationProxyLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/HostedZoneDelegationProxy
      RetentionInDays: !Ref HostedZoneDelegationProxyLogRetention
  HostedZoneDelegationProxyFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: HostedZoneDelegationProxy
      Description: A Lambda proxy function that calls another Lambda management function to create Sub-Domain delegation records in a Route53 HostedZone in another Account.
      Role: !GetAtt HostedZoneDelegationProxyRole.Arn
      Runtime: nodejs10.x
      Timeout: 120
      Layers:
        - !ImportValue
            Fn::Sub: ${LayersStackName}-AsyncCustomResourceLayerVersionArn
      Handler: HostedZoneDelegationProxy.handler
      Code:
        S3Bucket: !ImportValue
          Fn::Sub: ${BucketsStackName}-FunctionsBucket
        S3Key: !Ref HostedZoneDelegationProxyFunctionKey
        S3ObjectVersion: !If [ ConfigureHostedZoneDelegationProxyFunctionObjectVersion, !Ref HostedZoneDelegationProxyFunctionObjectVersion, !Ref 'AWS::NoValue' ]
    DependsOn: HostedZoneDelegationProxyLogGroup
Outputs:
  DomainNameServersFunctionArn:
    Description: The DomainNameServers Lambda Function ARN
    Value: !GetAtt DomainNameServersFunction.Arn
    Export:
      Name: !Sub ${AWS::StackName}-DomainNameServersFunctionArn
  HostedZoneDelegationFunctionArn:
    Description: The HostedZoneDelegation Lambda Function ARN
    Value: !GetAtt HostedZoneDelegationFunction.Arn
    Export:
      Name: !Sub ${AWS::StackName}-HostedZoneDelegationFunctionArn
  DomainNameServersProxyFunctionArn:
    Description: The DomainNameServersProxy Lambda Function ARN
    Value: !GetAtt DomainNameServersProxyFunction.Arn
    Export:
      Name: !Sub ${AWS::StackName}-DomainNameServersProxyFunctionArn
  HostedZoneDelegationProxyFunctionArn:
    Description: The HostedZoneDelegationProxy Lambda Function ARN
    Value: !GetAtt HostedZoneDelegationProxyFunction.Arn
    Export:
      Name: !Sub ${AWS::StackName}-HostedZoneDelegationProxyFunctionArn