central-microservices.template

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "(SO0025): CFN CI/CD pipeline central services",
    "Metadata": {
        "AWS::CloudFormation::Interface": {
            "ParameterGroups": [
                {
                    "Label": {
                        "default": "Stack Creation Settings"
                    },
                    "Parameters": [
                        "StackCreationRoleArn"
                    ]
                }
            ],
            "ParameterLabels": {
                "StackCreationRoleArn": {
                    "default": "Create-Stack Role ARN"
                }
            }
        }
    },
    "Parameters": {
        "StackCreationRoleArn": {
            "Description": "Role used to launch CloudFormation stacks",
            "Type": "String"
        }
    },
    "Mappings": {
        "Functions": {
            "AMICheck": {
                "S3Key": "ami_check.zip",
                "Handler": "ami_check"
            },
            "Cleanup": {
                "S3Key": "stack_cleanup.zip",
                "Handler": "stack_cleanup"
            },
            "LintTemplate": {
                "S3Key": "lint_template.zip",
                "ToolVersion": "latest",
                "Handler": "lint_template"
            },
            "CreateStacks": {
                "S3Key": "create_stack.zip",
                "Handler": "create_stack"
            },
            "ValidateTemplate": {
                "S3Key": "validate_template.zip",
                "Handler": "validate_template"
            },
            "TestConnectivity": {
                "S3Key": "tcp_connect.zip",
                "Handler": "tcp_connect"
            },
            "SubnetName": {
                "S3Key": "subnet_name.zip",
                "Handler": "subnet_name"
            },
            "DeployToS3": {
                "S3Key": "deploy_to_s3.zip",
                "Handler": "deploy_to_s3"
            },
            "GenerateReport": {
                "S3Key": "generate_report.zip",
                "Handler": "generate_report"
            },
            "AnonymousReporting": {
                "S3Key": "anon_reporting.zip",
                "Handler": "anon_reporting"
            }
        },
        "General": {
            "CodeRepo": {
                "S3BucketPrefix": "solutions-",
                "S3KeyPrefix": "aws-cloudformation-validation-pipeline/v1.0/"
            },
            "SendAnonymousData": {
                "Enabled": "Yes"
            },
            "AbsoluteBucketName": {
                "Enabled": "No"
            }
        }
    },
    "Conditions": {
        "EnableAnonReporting": {
            "Fn::Equals": [
                {
                    "Fn::FindInMap": [
                        "General",
                        "SendAnonymousData",
                        "Enabled"
                    ]
                },
                "Yes"
            ]
        },
        "UseRelativeBucket": {
            "Fn::Equals": [
                {
                    "Fn::FindInMap": [
                        "General",
                        "AbsoluteBucketName",
                        "Enabled"
                    ]
                },
                "No"
            ]
        }
    },
    "Resources": {
        "AMICheckLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "AMICheck",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Tests that AMI's are at their latest version",
                "FunctionName": "AMI_Check",
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "AMICheck",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "AMICheckRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "300",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "AMICheckRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "AMICheckRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Join": [
                                                "",
                                                [
                                                    "arn:aws:logs:",
                                                    {
                                                        "Ref": "AWS::Region"
                                                    },
                                                    ":",
                                                    {
                                                        "Ref": "AWS::AccountId"
                                                    },
                                                    ":log-group:/aws/lambda/*"
                                                ]
                                            ]
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "ec2:DescribeRegions",
                                        "ec2:DescribeImages"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "LintTemplateLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "LintTemplate",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Start a build using CodeBuild to lint templates with cfn-nag",
                "FunctionName": "Lint_Template",
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "LintTemplate",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "LintTemplateRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "300",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        },
                        "TOOLVERSION": {
                            "Fn::FindInMap": [
                                "Functions",
                                "LintTemplate",
                                "ToolVersion"
                            ]
                        }
                    }
                }
            }
        },
        "LintTemplateRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "LintTemplateRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Join": [
                                                "",
                                                [
                                                    "arn:aws:logs:",
                                                    {
                                                        "Ref": "AWS::Region"
                                                    },
                                                    ":",
                                                    {
                                                        "Ref": "AWS::AccountId"
                                                    },
                                                    ":log-group:/aws/lambda/*"
                                                ]
                                            ]
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject",
                                        "s3:PutObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codebuild:startbuild",
                                        "codebuild:BatchGetBuilds"
                                    ],
                                    "Resource": {
                                        "Fn::Sub": "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/CFN-Lint-*"
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "CreateStacksLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "CreateStacks",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Build action to create stacks using templates, parameters and settings based on the defined ci config",
                "FunctionName": {
                    "Fn::Sub": "Create_Stacks-${AWS::StackName}"
                },
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "CreateStacks",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "CreateStacksRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "300",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "CreateStacksRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "CreateStacksRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Join": [
                                                "",
                                                [
                                                    "arn:aws:logs:",
                                                    {
                                                        "Ref": "AWS::Region"
                                                    },
                                                    ":",
                                                    {
                                                        "Ref": "AWS::AccountId"
                                                    },
                                                    ":log-group:/aws/lambda/*"
                                                ]
                                            ]
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject",
                                        "s3:PutObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "ec2:DescribeRegions",
                                        "ec2:CreateKeyPair",
                                        "ec2:DescribeAvailabilityZones"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:CreateStack",
                                        "cloudformation:DeleteStack",
                                        "cloudformation:DescribeStackEvents",
                                        "cloudformation:ListStackResources"
                                    ],
                                    "Resource": {
                                        "Fn::Sub": "arn:aws:cloudformation:*:${AWS::AccountId}:stack/ci-*"
                                    }
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:DescribeStacks",
                                        "cloudformation:ListStacks"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "iam:PassRole"
                                    ],
                                    "Resource": [
                                        {
                                            "Ref": "StackCreationRoleArn"
                                        }
                                    ]
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "ValidateTemplateLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "ValidateTemplate",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Build action to create stacks using templates, parameters and settings based on the defined ci config",
                "FunctionName": "Validate_Template",
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "ValidateTemplate",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "ValidateTemplateRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "30",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "ValidateTemplateRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "ValidateTemplateRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject",
                                        "s3:PutObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:ValidateTemplate"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "TestConnectivityLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "TestConnectivity",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Build action to create stacks using templates, parameters and settings based on the defined ci config",
                "FunctionName": "Test_Connectivity",
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "TestConnectivity",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "TestConnectivityRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "300",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "TestConnectivityRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "TestConnectivityRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "iam:GetRole",
                                        "iam:CreateRole",
                                        "iam:PutRolePolicy",
                                        "iam:DeleteRole",
                                        "iam:DeleteRolePolicy",
                                        "iam:PassRole"
                                    ],
                                    "Resource": {
                                        "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/test_subnet_*"
                                    }
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "ec2:DescribeSubnets",
                                        "ec2:CreateSecurityGroup",
                                        "ec2:DescribeNetworkInterfaces",
                                        "ec2:DetachNetworkInterface",
                                        "ec2:DeleteNetworkInterface",
                                        "ec2:DeleteSecurityGroup",
                                        "ec2:DescribeSecurityGroups",
                                        "ec2:DescribeVpcs"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "lambda:CreateFunction"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "lambda:InvokeFunction",
                                        "lambda:DeleteFunction"
                                    ],
                                    "Resource": {
                                        "Fn::Sub": "arn:aws:lambda:*:${AWS::AccountId}:function:test_subnet_*"
                                    }
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:DescribeStackResources",
                                        "cloudformation:ListStackResources"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:cloudformation:*:${AWS::AccountId}:stack/ci-*"
                                        },
                                        {
                                            "Fn::Sub": "arn:aws:cloudformation:*:${AWS::AccountId}:stack/SC-${AWS::AccountId}-pp-*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:DescribeStacks"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "SubnetNameLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "SubnetName",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Post create test to test that subnets contain certain strings in their name",
                "FunctionName": "Subnet_Name",
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "SubnetName",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "SubnetNameRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "300",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "SubnetNameRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "SubnetNameRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Join": [
                                                "",
                                                [
                                                    "arn:aws:logs:",
                                                    {
                                                        "Ref": "AWS::Region"
                                                    },
                                                    ":",
                                                    {
                                                        "Ref": "AWS::AccountId"
                                                    },
                                                    ":log-group:/aws/lambda/*"
                                                ]
                                            ]
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "ec2:DescribeSubnets"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:DescribeStackResources",
                                        "cloudformation:ListStackResources"
                                    ],
                                    "Resource": {
                                        "Fn::Sub": "arn:aws:cloudformation:*:${AWS::AccountId}:stack/ci-*"
                                    }
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "cloudformation:DescribeStacks"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "DeployToS3Lambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "DeployToS3",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Deploys template and associated resources to S3",
                "FunctionName": {
                    "Fn::Sub": "Deploy_To_S3-${AWS::StackName}"
                },
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "DeployToS3",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "DeployToS3Role",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "300",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "DeployToS3Role": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "DeployToS3Role",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Join": [
                                                "",
                                                [
                                                    "arn:aws:logs:",
                                                    {
                                                        "Ref": "AWS::Region"
                                                    },
                                                    ":",
                                                    {
                                                        "Ref": "AWS::AccountId"
                                                    },
                                                    ":log-group:/aws/lambda/*"
                                                ]
                                            ]
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:*"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "GenerateReportLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "GenerateReport",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Description": "Generates a report on pipeline execution",
                "FunctionName": {
                    "Fn::Sub": "Generate_Report-${AWS::StackName}"
                },
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "GenerateReport",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "MemorySize": "512",
                "Role": {
                    "Fn::GetAtt": [
                        "GenerateReportRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "30",
                "Environment": {
                    "Variables": {
                        "SEND_ANONYMOUS_DATA": {
                            "Fn::FindInMap": [
                                "General",
                                "SendAnonymousData",
                                "Enabled"
                            ]
                        }
                    }
                }
            }
        },
        "GenerateReportRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "GenerateReportRole",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents",
                                        "logs:FilterLogEvents"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Join": [
                                                "",
                                                [
                                                    "arn:aws:logs:",
                                                    {
                                                        "Ref": "AWS::Region"
                                                    },
                                                    ":",
                                                    {
                                                        "Ref": "AWS::AccountId"
                                                    },
                                                    ":log-group:/aws/lambda/*"
                                                ]
                                            ]
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetPipeline",
                                        "codepipeline:GetPipelineExecution",
                                        "codepipeline:GetPipelineState",
                                        "codepipeline:ListPipelines"
                                    ],
                                    "Resource": [
                                        {
                                            "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*"
                                        }
                                    ]
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codepipeline:GetJobDetails",
                                        "codepipeline:PutJobSuccessResult",
                                        "codepipeline:PutJobFailureResult"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:GetObject",
                                        "s3:PutObject"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Action": [
                                        "sns:Publish"
                                    ],
                                    "Resource": "*",
                                    "Effect": "Allow"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "AnonReporting": {
            "Condition": "EnableAnonReporting",
            "Type": "Custom::LoadLambda",
            "Properties": {
                "ServiceToken": {
                    "Fn::GetAtt": [
                        "AnonReportingLambda",
                        "Arn"
                    ]
                },
                "SolutionID": "SO0025c"
            }
        },
        "AnonReportingRole": {
            "Condition": "EnableAnonReporting",
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "Anon_Reporting_Permissions",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                "arn:aws:logs:",
                                                {
                                                    "Ref": "AWS::Region"
                                                },
                                                ":",
                                                {
                                                    "Ref": "AWS::AccountId"
                                                },
                                                ":log-group:/aws/lambda/*"
                                            ]
                                        ]
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "AnonReportingLambda": {
            "Condition": "EnableAnonReporting",
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Handler": {
                    "Fn::Join": [
                        ".",
                        [
                            {
                                "Fn::FindInMap": [
                                    "Functions",
                                    "AnonymousReporting",
                                    "Handler"
                                ]
                            },
                            "lambda_handler"
                        ]
                    ]
                },
                "Role": {
                    "Fn::GetAtt": [
                        "AnonReportingRole",
                        "Arn"
                    ]
                },
                "Description": "CloudFormation Validation Pipeline: CloudFormation custom resource function invoked during CloudFormation create, update, and delete stack operations.",
                "Code": {
                    "S3Bucket": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3BucketPrefix"
                                    ]
                                },
                                {
                                "Fn::If": [
                                    "UseRelativeBucket",
                                    {
                                        "Ref": "AWS::Region"
                                    },
                                    {
                                        "Ref": "AWS::NoValue"
                                    }
                                ]
                            }
                            ]
                        ]
                    },
                    "S3Key": {
                        "Fn::Join": [
                            "",
                            [
                                {
                                    "Fn::FindInMap": [
                                        "General",
                                        "CodeRepo",
                                        "S3KeyPrefix"
                                    ]
                                },
                                {
                                    "Fn::FindInMap": [
                                        "Functions",
                                        "AnonymousReporting",
                                        "S3Key"
                                    ]
                                }
                            ]
                        ]
                    }
                },
                "Runtime": "python2.7",
                "Timeout": "60"
            }
        }
    },
    "Outputs": {
        "DeployToS3LambdaName": {
            "Value": {
                "Ref": "DeployToS3Lambda"
            },
            "Export": {
                "Name": "DeployToS3LambdaName"
            }
        },
        "GenerateReportLambdaName": {
            "Value": {
                "Ref": "GenerateReportLambda"
            },
            "Export": {
                "Name": "GenerateReportLambdaName"
            }
        },
        "CreateStacksLambdaName": {
            "Value": {
                "Ref": "CreateStacksLambda"
            },
            "Export": {
                "Name": "CreateStacksLambdaName"
            }
        },
        "AMICheckLambdaName": {
            "Value": {
                "Ref": "AMICheckLambda"
            },
            "Export": {
                "Name": "AMICheckLambdaName"
            }
        },
        "LintTemplateLambdaName": {
            "Value": {
                "Ref": "LintTemplateLambda"
            },
            "Export": {
                "Name": "LintTemplateLambdaName"
            }
        },
        "ValidateTemplateLambdaName": {
            "Value": {
                "Ref": "ValidateTemplateLambda"
            },
            "Export": {
                "Name": "ValidateTemplateLambdaName"
            }
        },
        "TestConnectivityLambdaName": {
            "Value": {
                "Ref": "TestConnectivityLambda"
            },
            "Export": {
                "Name": "TestConnectivityLambdaName"
            }
        },
        "SubnetNameLambdaName": {
            "Value": {
                "Ref": "SubnetNameLambda"
            },
            "Export": {
                "Name": "SubnetNameLambdaName"
            }
        }
    }
}