【第42回】AWS CloudFormationを用いた基盤自動化(22)継続的インテグレーション環境の構築(3)¶

AWSTemplateFormatVersion: '2010-09-09'

Description: Lambda for create user in RDS template with YAML - Depends On base/1-vpc-cfn.yml, base/2-sg-cfn.yml.

// omit

Resources:
  LambdaForCreatingTableInRds:
    Type: AWS::Lambda::Function                                              # (A)
    Properties:
      Code:
        S3Bucket:
          Fn::ImportValue: !Sub ${VPCName}-Lambda-S3Bucket                   # (B)
      S3Key: mynavi-sample-sonarqube-initdb-0.0.1-SNAPSHOT-aws.jar           # (C)
      Handler: org.debugroom.mynavi.sample.sonarqube.initdb.app.handler.LambdaTriggerHandler::handleRequest
                                                                             # (D)
      FunctionName: mynavi-sonarqube-cfn-rds-dbinit-function
      Environment:
        Variables:
          FUNCTION_NAME: initDBFunction                                      # (E)
      MemorySize: 1024                                                       # (F)
      Runtime: java8
      Timeout: 120
      VpcConfig:                                                             # (G)
        SecurityGroupIds:
          - Fn::ImportValue: !Sub ${VPCName}-SecurityGroupLambda             # (H)
        SubnetIds:                                                           # (I)
          - Fn::ImportValue: !Sub ${VPCName}-PrivateSubnet1
          - Fn::ImportValue: !Sub ${VPCName}-PrivateSubnet2
      Role: !GetAtt LambdaRDSAccessRole.Arn                                  # (J)

  LambdaRDSAccessRole:                                                       # (K)
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
                                                                             # (L)

  CloudFormationAccessPolicy:                                                # (M)
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ma-Lambda-CloudFormationAccessPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - "cloudformation:*"
            Resource: "*"
      Roles:
        - !Ref LambdaRDSAccessRole

  SSMAccessPolicy:                                                           # (N)
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ma-lambda-SSMAccessPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
            - "cloudwatch:PutMetricData"
            # omit
      Roles:
        - !Ref LambdaRDSAccessRole

Outputs:                                                                     # (O)
  LambdaForCreateUserInRdsArn:
    Description: Lambda function for creating table in rds
    Value: !GetAtt LambdaForCreatingTableInRds.Arn
    Export:
      Name: !Sub ${VPCName}-LamdaForCreateUserInRdsArn

# omit

Resources:
  LambdaTrigger:
    Type: Custom::LambdaTrigger
    Properties:
      ServiceToken:
        Fn::ImportValue: !Sub ${VPCName}-LamdaForCreateUserInRdsArn
       Region: !Ref "AWS::Region"