s3-sftp-bridge-deploy-to-vpc.template

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "BucketName": {
      "Type": "String",
      "Description": "The S3 bucket where you will sync to and from SFTP. This must not already exist."
    },
    "Subnets": {
      "Type": "List<AWS::EC2::Subnet::Id>",
      "Default": "",
      "Description": "Choose the subnets in which the Lambda function should run. Must all be in the same VPC."
    },
    "SecurityGroups": {
      "Type": "List<AWS::EC2::SecurityGroup::Id>",
      "Default": "",
      "Description": "Choose the security groups in which the Lambda function should run."
    }
  },
  "Resources": {
    "BridgeRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version" : "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [ "lambda.amazonaws.com" ]
              },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        },
        "Policies": [
          {
            "PolicyName": "LogWriter",
            "PolicyDocument": {
              "Version" : "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": "arn:aws:logs:*:*:*"
                }
              ]
            }
          },
          {
            "PolicyName": "ConfigReader",
            "PolicyDocument": {
              "Version" : "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:GetObject"
                  ],
                  "Resource": { "Fn::Join":  [ "", [ "arn:aws:s3:::aws.lambda.", { "Ref": "AWS::Region" }, ".", { "Ref": "AWS::AccountId" } , ".config/*" ] ] }
                }
              ]
            }
          },
          {
            "PolicyName": "FileSyncher",
            "PolicyDocument": {
              "Version" : "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:CopyObject",
                    "s3:GetObject",
                    "s3:ListObjects",
                    "s3:PutObject"
                  ],
                  "Resource": [
                    { "Fn::Join":  [ "", [ "arn:aws:s3:::", { "Ref": "BucketName" } ] ] },
                    { "Fn::Join":  [ "", [ "arn:aws:s3:::", { "Ref": "BucketName" } , "/*" ] ] }
                  ]
                }
              ]
            }
          },
          {
            "PolicyName": "VpcMember",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ec2:CreateNetworkInterface",
                    "ec2:DescribeNetworkInterfaces",
                    "ec2:DetachNetworkInterface",
                    "ec2:DeleteNetworkInterface"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }
        ]
      }
    },
    "BridgeFunction": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "S3Bucket": "com.gilt.public.backoffice",
          "S3Key": "lambda_functions/s3-sftp-bridge.zip"
        },
        "Description": "Used sync files between S3 and SFTP servers.",
        "Handler": "main.handle",
        "Role": { "Fn::GetAtt" : [ "BridgeRole", "Arn" ] },
        "Runtime": "nodejs4.3",
        "Timeout": 300,
        "VpcConfig": {
          "SecurityGroupIds": { "Ref": "SecurityGroups" },
          "SubnetIds": { "Ref": "Subnets" }
        }
      },
      "DependsOn": [
        "BridgeRole"
      ]
    },
    "BridgeResourcePolicy": {
      "Type": "AWS::Lambda::Permission",
      "Properties": {
        "Action": "lambda:InvokeFunction",
        "FunctionName": { "Fn::GetAtt": [ "BridgeFunction", "Arn" ] },
        "Principal": "s3.amazonaws.com",
        "SourceAccount": { "Ref": "AWS::AccountId" },
        "SourceArn": { "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "BucketName" } ] ] }
      },
      "DependsOn": [
        "BridgeFunction"
      ]
    },
    "BridgeBucket": {
      "Type" : "AWS::S3::Bucket",
      "Properties": {
        "BucketName": { "Ref": "BucketName" },
        "NotificationConfiguration": {
          "LambdaConfigurations": [
            {
              "Event": "s3:ObjectCreated:*",
              "Function": { "Fn::GetAtt": [ "BridgeFunction", "Arn" ] }
            }
          ]
        }
      },
      "DependsOn": [
        "BridgeResourcePolicy"
      ]
    }
  },
  "Outputs": {
    "BridgeFunctionArn": {
      "Description": "The ARN of the function that moves files between S3 and SFTP.",
      "Value": { "Fn::GetAtt": [ "BridgeFunction", "Arn" ] }
    },
    "BridgeFunctionName": {
      "Description": "The ARN of the function that moves files between S3 and SFTP.",
      "Value": { "Ref": "BridgeFunction" }
    },
    "BridgeFunctionRole": {
      "Description": "The role used by the generated Lambda function, to be added to any KMS keys.",
      "Value": { "Ref": "BridgeRole" }
    }
  }
}