lambda.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:

  LambdaBucketName:
    Type: String
    Description: The name of the S3 bucket that has the code

  S3FunctionCodeVersion:
    Type: String
    Description: The S3ObjectVersion for the function code

  SesRegion:
    Type: String
    Default: us-east-1

  SesSenderEmail:
    Type: String
    Description: >-
      Email address to display as the sender of notifications.
      Address or Domain must be verified in SES.

  SesRecieverEmail:
    Type: String
    Description: >-
      Email address to send notifications to.
      Address or Domain must be verified in SES.

Resources:

  AktionBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  ScheduledRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: cron(00 09 ? * MON *)
      State: ENABLED
      Targets:
        - Arn: !GetAtt Lambda.Arn
          Id: !Ref Lambda

  ScheduledEventPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref Lambda
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ScheduledRule.Arn

  Lambda:
    Type:                           AWS::Lambda::Function
    Properties:
      FunctionName:                 aktion
      Handler:                      aktion.lambda_handler
      Timeout:                      60
      Role:                         !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          BUCKET_NAME: !Ref AktionBucket
          SENDER_EMAIL: !Ref SesSenderEmail
          RECEIVER_EMAIL: !Ref SesRecieverEmail
          SES_REGION: !Ref SesRegion
      Code:
        S3Bucket:                   !Ref LambdaBucketName
        S3Key:                      code.zip
        S3ObjectVersion:            !Ref S3FunctionCodeVersion
      Runtime:                      python3.7

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: aktion-lambda
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: aktion-lambda
        PolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action: ses:SendEmail
              Resource:
                - !Sub arn:aws:ses:${SesRegion}:${AWS::AccountId}:identity/${SesSenderEmail}
                - !Sub arn:aws:ses:${SesRegion}:${AWS::AccountId}:identity/${SesRecieverEmail}
            - Effect: Allow
              Action:
                - s3:GetObject*
                - s3:PutObject*
              Resource:
                - !Sub arn:aws:s3:::${AktionBucket}/*
                - !Sub arn:aws:s3:::${AktionBucket}
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: arn:aws:logs:*:*:*