aws-lambda.packaged.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Parameters:
  BucketName:
    Type: String
    Default: unique-bucket-name
Resources:
  LambdaBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName:
        Ref: BucketName
      NotificationConfiguration:
        LambdaConfigurations:
        - Event: s3:ObjectCreated:*
          Filter:
            S3Key:
              Rules:
              - Name: prefix
                Value: load/
              - Name: suffix
                Value: .json
          Function:
            Fn::GetAtt:
            - S3ToESFunction
            - Arn
  S3ToESFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: S3ToElasticSearch
      Description: Function to Stream AquaSec Logs to ES.
      Handler: s3-to-es.handler
      Runtime: python3.7
      CodeUri: s3://...
      Role:
        Fn::GetAtt:
        - LambdaRole
        - Arn
  S3InvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Ref: S3ToESFunction
      Principal: s3.amazonaws.com
      SourceArn:
        Fn::Sub: arn:aws:s3:::${BucketName}
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            - es:ESHttpPost
            - es:ESHttpPut
            Resource: '*'
      - PolicyName: s3
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - s3:Get*
            Resource:
            - Fn::Sub: arn:aws:s3:::${BucketName}
            - Fn::Sub: arn:aws:s3:::${BucketName}/*