template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  lambda-demo-scripts

  SAM Template for AWS lambda

Globals:
  Function:
    Timeout: 3

Parameters:
  SSMDocumentPath:
    Type: String
    Default: /dev/tokens

Resources:
  ScriptsStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: workflows/workflow.json
      DefinitionSubstitutions:
        AWSLambdaFunction: !GetAtt AWSLambdaFunction.Arn

      Policies: # Find out more about SAM policy templates: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-policy-templates.html

        - LambdaInvokePolicy:
            FunctionName: !Ref AWSLambdaFunction

  AWSLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambdas/
      Handler: lambda_demo.lambda_handler
      ReservedConcurrentExecutions: 2
      Runtime: python3.8
      Timeout: 900
      Role: !GetAtt AWSLambdaFunctionRole.Arn
      Environment:
        Variables:
          SSMPATH: !Ref SSMDocumentPath

  AWSStepLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambdas/
      Handler: lambda_with_step_function.lambda_handler
      ReservedConcurrentExecutions: 2
      Runtime: python3.8
      Timeout: 900
      Role: !GetAtt AWSLambdaFunctionRole.Arn
      Environment:
        Variables:
          SSMPATH: !Ref SSMDocumentPath
          STEP_FUNCTION_ARN: !GetAtt ScriptsStateMachine.Arn

  AWSLambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - ssm:Get*
            - ssm:List*
            - ssm:Describe*
            Effect: Allow
            Resource:
              "*"
          Version: '2012-10-17'
        PolicyName: ScrpitsParameterStoreAccess
      - PolicyDocument:
          Statement:
          - Action:
            - states:*
            Effect: Allow
            Resource:
              "*"
          Version: '2012-10-17'
        PolicyName: ScriptsStatemachineRole
      - PolicyDocument:
          Statement:
          - Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
            Effect: Allow
            Resource:
              "*"
          Version: '2012-10-17'
        PolicyName: CloudWatchLogs

Outputs:
  AWSLambdaFunction:
    Description: "Hello World Lambda Function ARN"
    Value: !GetAtt AWSLambdaFunction.Arn
  AWSLambdaFunctionIamRole:
    Description: "Implicit IAM Role created for Hello World function"
    Value: !GetAtt AWSLambdaFunction.Arn
  AWSStepLambdaFunction:
    Description: "Hello World Lambda Function ARN"
    Value: !GetAtt AWSStepLambdaFunction.Arn
  AWSStepLambdaFunctionIamRole:
    Description: "Implicit IAM Role created for Hello World function"
    Value: !GetAtt AWSStepLambdaFunction.Arn