# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of
# this software and associated documentation files (the "Software"), to deal in
# the Software without restriction, including without limitation the rights to
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
# the Software, and to permit persons to whom the Software is furnished to do so.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
# COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
# IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

AWSTemplateFormatVersion: '2010-09-09'
Description: Lambda template

Resources:
  GetPrefixListIDFunction:
    Type: AWS::Lambda::Function
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - W3002
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function is used as cloudformation custom resource, not as application service. No need to deploy into a VPC."
          - id: W92
            reason: "This lambda function is used as cloudformation custom resource, not as application service. No need to specify reserved concurrency."
          - id: W58
            reason: "Permission to write cloudwatch logs is defined in the FunctionPolicy resource"
    Properties:
      FunctionName: get_pl
      Handler: lambda_function.handler
      Runtime: python3.8
      Description: function to get prefix list ID
      Code: ../function/
      MemorySize: 128
      Timeout: 60
      Role: !GetAtt GetPrefixListIDFunctionRole.Arn

  GetPrefixListIDFunctionRole:
      Type: AWS::IAM::Role
      Metadata:
        cfn_nag:
          rules_to_suppress:
            - id: W12
              reason: "Resource * is required for the action."
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            -
              Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: lambda-get-pl-policy
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - ec2:DescribePrefixLists
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
        Path: /

Outputs:
  GetPrefixListIDFunction:
    Description: Lambda Function Arn
    Value: !GetAtt GetPrefixListIDFunction.Arn