template.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: "Resources for the Terraform-to-CloudFormation custom type handler"

Parameters:
    AllowAWSActions:
        Description: If true, AWS actions will be permitted to execute through an administrative role (required for TF::AWS::* resources)
        Type: String
        Default: 'true'
        AllowedValues:
          - "true"
          - "false"
    
    S3Bucket:
        Description: The name of the bucket that contains the Lambda source (leave blank to use latest)
        Type: String
        Default: ''
    
    S3Key:
        Description: The key of the ZIP package within the bucket (leave blank to use latest)
        Type: String
        Default: ''

Metadata: 
    AWS::CloudFormation::Interface: 
        ParameterGroups: 
          - Label: 
                default: "General Settings"
            Parameters: 
              - AllowAWSActions
          - Label: 
                default: "Advanced Configuration"
            Parameters: 
              - S3Bucket
              - S3Key
        ParameterLabels: 
            AllowAWSActions: 
                default: "Allow All AWS Actions"
            S3Bucket: 
                default: "Executor Lambda Code S3 Bucket"
            S3Key: 
                default: "Executor Lambda Code S3 Key"

Mappings:
    RegionMap:
        us-east-1:
            bucketname: ianmckay-us-east-1
        us-east-2:
            bucketname: ianmckay-us-east-2
        us-west-1:
            bucketname: ianmckay-us-west-1
        us-west-2:
            bucketname: ianmckay-us-west-2
        ap-south-1:
            bucketname: ianmckay-ap-south-1
        ap-northeast-2:
            bucketname: ianmckay-ap-northeast-2
        ap-southeast-1:
            bucketname: ianmckay-ap-southeast-1
        ap-southeast-2:
            bucketname: ianmckay-ap-southeast-2
        ap-northeast-1:
            bucketname: ianmckay-ap-northeast-1
        ca-central-1:
            bucketname: ianmckay-ca-central-1
        eu-central-1:
            bucketname: ianmckay-eu-central-1
        eu-west-1:
            bucketname: ianmckay-eu-west-1
        eu-west-2:
            bucketname: ianmckay-eu-west-2
        eu-west-3:
            bucketname: ianmckay-eu-west-3
        eu-north-1:
            bucketname: ianmckay-eu-north-1
        sa-east-1:
            bucketname: ianmckay-sa-east-1
        af-south-1:
            bucketname: ianmckay-af-south-1
        ap-east-1:
            bucketname: ianmckay-ap-east-1
        ap-northeast-3:
            bucketname: ianmckay-ap-northeast-3
        eu-south-1:
            bucketname: ianmckay-eu-south-1
        me-south-1:
            bucketname: ianmckay-me-south-1

Conditions:
    S3Defined: !Not [ !Equals [ '', !Ref S3Bucket ] ]
    AllowAWS: !Equals [ 'true', !Ref AllowAWSActions ]

Resources:
    StateS3Bucket:
        Type: AWS::S3::Bucket
        Properties:
            BucketName: !Sub "cfntf-${AWS::Region}-${AWS::AccountId}"
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                  - ServerSideEncryptionByDefault:
                        SSEAlgorithm: AES256
            PublicAccessBlockConfiguration:
                BlockPublicAcls: true
                BlockPublicPolicy: true
                IgnorePublicAcls: true
                RestrictPublicBuckets: true

    ExecutorLambdaServiceRole:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Principal:
                        Service: lambda.amazonaws.com
                    Action: sts:AssumeRole
            Path: /
            Policies:
              - PolicyName: CoreFunctionality
                PolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Action:
                          - logs:CreateLogGroup
                          - logs:CreateLogStream
                          - logs:PutLogEvents
                        Resource: "*"
                      - Effect: Allow
                        Action: secretsmanager:GetSecretValue
                        Resource: !Sub "arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:terraform/*"
                      - Effect: Allow
                        Action:
                          - s3:GetObject
                          - s3:PutObject
                          - s3:DeleteObject
                        Resource: !Sub "${StateS3Bucket.Arn}/*"
              - !If
                  - "AllowAWS"
                  - PolicyName: AWSActions
                    PolicyDocument:
                        Version: '2012-10-17'
                        Statement:
                          - Effect: Allow
                            Action: '*'
                            Resource: '*'
                  - !Ref "AWS::NoValue"

    ExecutorLambdaLogGroup:
        Type: AWS::Logs::LogGroup
        Properties:
            LogGroupName: "/aws/lambda/cfntf-executor"
            RetentionInDays: 14

    ExecutorLambdaFunction:
        Type: AWS::Lambda::Function
        Properties:
            FunctionName: cfntf-executor
            Handler: index.handler
            Role: !GetAtt ExecutorLambdaServiceRole.Arn
            Environment:
                Variables:
                    BUCKET: !Ref StateS3Bucket
            Code:
                S3Bucket: !If
                  - S3Defined
                  - !Ref S3Bucket
                  - Fn::FindInMap:
                      - RegionMap
                      - !Ref AWS::Region
                      - bucketname
                S3Key: !If
                  - S3Defined
                  - !Ref S3Key
                  - cfn-tf-custom-types/app.zip
            Runtime: python3.8
            MemorySize: 1024
            Timeout: 900
    
    ExecutorLambdaInvokeConfig:
        Type: AWS::Lambda::EventInvokeConfig
        Properties:
            FunctionName: !Ref ExecutorLambdaFunction
            MaximumRetryAttempts: 1
            Qualifier: "$LATEST"

    ExecutionRole:
        Type: AWS::IAM::Role
        Properties:
            MaxSessionDuration: 8400
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Principal:
                        Service: resources.cloudformation.amazonaws.com
                    Action: sts:AssumeRole
            Path: "/"
            Policies:
              - PolicyName: ResourceTypePolicy
                PolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Action:
                          - "lambda:InvokeFunction"
                          - "s3:DeleteObject"
                          - "s3:GetObject"
                          - "s3:ListBucket"
                        Resource: "*"

Outputs:

    ExecutionRoleARN:
        Description: The execution role ARN to use for registered types
        Value: !GetAtt ExecutionRole.Arn