partner-account.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Allows another account to publish into this account using a named cross-account role

Parameters:
  CustomerAccountParameter:
    Type: String
    Description: Enter the account ID of the customer account
Resources:
  # Rule to take all of the JSON from the customer, add the account ID and operation to it, and send to the Lambda function
  CreateThingEventRule:
    Type: AWS::IoT::TopicRule
    Properties:
      TopicRulePayload:
        RuleDisabled: false
        Sql: !Join [ "", [ "SELECT *, topic(2) AS accountId, topic(3) as operation FROM 'cross_account_hooks/", !Ref CustomerAccountParameter, "/create_thing'" ] ]
        Actions:
          - Lambda:
              FunctionArn: !GetAtt LambdaFunction.Arn
  # The role assumed by the customer that allows them to publish to their cross account hooks topic hierarchy
  PublishFromCustomerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join [ "", [ "publish-from-customer-role-", !Ref CustomerAccountParameter ] ]
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              # The named role in the customer account that can assume this role
              AWS: !Join [ "", [ "arn:aws:iam::", !Ref CustomerAccountParameter, ":role/publish-to-partner-role-", !Ref "AWS::AccountId" ] ]
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - iot:Publish
                # The topic hierarchy for this customer
                Resource: !Join [ "", [ "arn:aws:iot:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":topic/cross_account_hooks/", !Ref CustomerAccountParameter, "/*" ] ]
  # The role that the Lambda function in the partner account will use
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - iot:Publish
                Resource: "*"
              - Effect: Allow
                Action:
                  - logs:*
                Resource: "*"
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code: partner-triggered-on-create-thing.py
      Handler: partner-triggered-on-create-thing.lambda_handler
      Role: !GetAtt LambdaRole.Arn
      Runtime: python2.7
  LambdaFunctionVersion:
    Type: AWS::Lambda::Version
    Properties:
      FunctionName: !GetAtt LambdaFunction.Arn
  # Gives the AWS IoT Rules Engine permission to invoke the Lambda function
  PermissionForRulesEngineToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      SourceArn: !GetAtt CreateThingEventRule.Arn
      Action: lambda:InvokeFunction
      Principal: iot.amazonaws.com
      FunctionName: !GetAtt LambdaFunction.Arn
      SourceAccount: !Ref AWS::AccountId