lambda-acm-validate.cfn.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Automatically validate ACM requests from this account

Parameters:
  Bucket:
    Type: String
    Description: The bucket must be in the same region as this stack
  Zip:
    Type: String
    Default: acm.zip
    Description: Full S3 object key for acm.zip, e.g. lambda/acm.zip

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: LogsToBucketPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: acm:DescribeCertificate
                Resource: '*'

  # SNS Topic to which emails will be delivered
  Topic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: lambda-acm-validate
      Subscription:
        - Endpoint: !GetAtt [Function, Arn]
          Protocol: lambda

  Function:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !Ref Bucket
        S3Key: !Ref Zip
      Handler: acm.validate
      MemorySize: 128
      Role: !GetAtt [Role, Arn]
      Runtime: python2.7
      Timeout: 10

  # Grant permission for Topic to invoke Function
  Permission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref Function
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn: !Ref Topic

Outputs:
  Topic:
    Value: !GetAtt [Topic, TopicName]