aws/ddns_lambda.cf.yml

   1 # inspired by https://aws.amazon.com/blogs/compute/building-a-dynamic-dns-for-route-53-using-cloudwatch-events-and-lambda/
   2
   3 AWSTemplateFormatVersion: 2010-09-09
   4 Parameters:
   5   TagChanges:
   6     Description: Update DNS on instance Tag changes? (requires CloudTrail)
   7     Type: String
   8     AllowedValues:
   9       - yes
  10       - no
  11     Default: no
  12     ConstraintDescription: yes or no
  13
  14 Conditions:
  15   TagChanges: !Equals [ !Ref TagChanges, yes ]
  16
  17 Resources:
  18   StateEvent:
  19     Type: "AWS::Events::Rule"
  20     Properties:
  21       Name: ec2_state_lambda_ddns
  22       Description: Invoke lambda DDNS handler on instance start/stop events
  23       EventPattern:
  24         source:
  25           - "aws.ec2"
  26         detail-type:
  27           - "EC2 Instance State-change Notification"
  28         detail:
  29           state:
  30             - "running"
  31             - "stopped"
  32             - "terminated"
  33       State: ENABLED
  34       Targets:
  35         -
  36           Arn:
  37             Fn::GetAtt:
  38               - "LambdaFunction"
  39               - "Arn"
  40           Id: ddns_lambda
  41
  42   TagEvent:
  43     Type: "AWS::Events::Rule"
  44     Condition: TagChanges
  45     Properties:
  46       Name: ec2_tag_lambda_ddns
  47       Description: Invoke lambda DDNS handler on changing tags on instances (requires CloudTrail)
  48       EventPattern:
  49         detail-type:
  50           - "AWS API Call via CloudTrail"
  51         detail:
  52           eventSource:
  53             - "ec2.amazonaws.com"
  54           eventName:
  55             - "CreateTags"
  56             - "DeleteTags"
  57       State: ENABLED
  58       Targets:
  59         -
  60           Arn:
  61             Fn::GetAtt:
  62               - "LambdaFunction"
  63               - "Arn"
  64           Id: ddns_lambda
  65
  66   PermInvokeLambdaStateEvent:
  67     Type: "AWS::Lambda::Permission"
  68     Properties:
  69       FunctionName:
  70         Ref: LambdaFunction
  71       Action: lambda:InvokeFunction
  72       Principal: events.amazonaws.com
  73       SourceArn:
  74         Fn::GetAtt:
  75           - "StateEvent"
  76           - "Arn"
  77
  78   PermInvokeLambdaTagEvent:
  79     Type: "AWS::Lambda::Permission"
  80     Properties:
  81       FunctionName:
  82         Ref: LambdaFunction
  83       Action: lambda:InvokeFunction
  84       Principal: events.amazonaws.com
  85       SourceArn:
  86         Fn::GetAtt:
  87           - "TagEvent"
  88           - "Arn"
  89
  90   LambdaFunction:
  91     Type: "AWS::Lambda::Function"
  92     Properties:
  93       FunctionName: ddns_lambda
  94       Handler: index.lambda_handler
  95       MemorySize: 128
  96       Role:
  97         Fn::GetAtt:
  98           - "LambdaRole"
  99           - "Arn"
 100       Runtime: python2.7
 101       Timeout: 60
 102       Code:
 103         ZipFile: |
 104           import bz2, base64
 105           exec(bz2.decompress(base64.b64decode('QlpoOTFBWSZTWfDnaDMABo7fgHASUu97Ez9t/1q/7//6YAgfd4YqmnbPo217265pJOtTsAl4ZSepkSNiJ6mnkaNAjR6jQZpoBNpNA2oOYAjBMQDAJgmjIaGATBGJhKCZKjRoD1DQGQD1ADQAAAASaklPEmk81J6mNT0QMQGg0A0AAGgRSIT1U/Smn6aNT1T0jJ6Q9A0QeiPUNAAAEiIgaTJMKaTxMJqfpI2kyAMIBoAqkBVJJLivXm3EDRA7MltDkj/pS+499LqIkqFFRcBBMw8mK46KHs0wr0KnvDhHcww+CFa6KvoubKcLX+DWJEgcBkHrsuJYQTTIBSSAb8JIwQVVRgqgiIiCoxBdQSaDOfnkPHaZY2KwOg+1vlfmul5wHxyMTpPnRgL9E0S1nc3dFTQF/EOJhMw/e1+GV+mhYqoFHurMjDFQea4vmoxtotfe1iycqkwsFosYbuMrqX5MfxggyR8LXrJRBSLk6QXDBlKUpettidjFhdFMXGOzKczaMfuYtp3bR3mjHYmJEOgEsG2BsnZlAwQCp2gt3wLpziaAyfUT2a7AwyPExDLLl68zW6pKLGZgWHkimZxa93c/DZxyE7xM7Aqw0F2DL2ZhXeLSrMriyvba64CAo5cwjDuaRmMIYotEjOdpQ1vLjFdTbX8eYg2Mrn/kIhnl3dtFBl7DeszKub44DLapXWYbE32i0cv1iavFYLzOzEMRT9Z0WYupRvO4wvkLky8DyC6QgNChU8TyGNBuzKp+jSTA0iYKhDJL0yZDcYhZKpHyhVF9VfQphPq0USkz+nZ50FQUO5QFcGkvvdo6lYSxsokMKLaLS1toyMeYYjNqWUZaqwlpqAkSMJ83GEFQULxf4DBYLt3BodZDaZQl4SQTvfB67aXXlY5p2YuhSpLrcYSpbL+8pf4HMveG4LUyNFBQ9bL/pChmUPGD6VZTJYbN1bk9KmRes2rcZ9UmIoGuDehmSIZDS2UocnUsjuSgnP8xrCjC1Rj6DLeQbfbunEeKgq4t+wrW/PO/7NTcIztgMGwfuXyHYFX8fSMPaZIbHzoyDLYwzHCkI3mrlKSiuRwrWl3Vz6ClGqzwNQyQwmxdNwvWPNGIcdeGXcZEkcHJyCSdnVJKVDeWhoDLCfGEOv2G4J2wibQgTYFiT2IYaa0DwGAoH4I3U3g6JEIZXkYWE38ZfNmvqrOJhShR0pyP3Q2F7teYiEUURSLIoowVRYmOaAG4Hnsh95m0HGcItA4YIQKhSRJkjiI6CP2ol7IFCaZTQ5gWXQOK4xAkCkPaJJla6D2mtg6c93ZgzCf4z3KmoAuB4cyNv1Bol23lFuR98BQm9FE1VgoYQhghJpMIEJsLLkTVpPhlwHgSowjHFl0ucsukmF69vTIbrfNSos2di6q5hm/eVeojNo1AliVamVaxxXFm64WlT5JKXZUrloIbKwQNDMgwmXZyJ5axbG+pjfdWMXNLoG85iUuN2DAZDAqUXSgogjBGJrSVDAzhkk6IMCMGTEDdkKlmR4T3mQX9WHlWhKuGcmiISIWwRlfKCwZQtpoa4DbHdoYsQ0c3wReFUrGllWywSOW5buljBo5M4Y/z9pvw42IJFGHVngmIGZ5Wd00FHI49fjZTJlctiGAX3gbDKLE5OcoTHVafra39knDD73DaSGNH2FFwyFDIYenRLlqjaVbQW4bCdvUy3Hw+B5XBE85JRmB7eCsBqLvGkxqJRXcbOA4DA+wCIG6XTW6ZSVEIRZdd53g4llcgiYPAm8JU6xvRopXaiEHbbnlGowbAGwE2C5DqWKBRjV8FLC0FKlEtLJ1AtATKaeBTegfQcTqniPua1QBubTDYtgIDUJS7K6JcbjIHwE5sxFJBHbggJIXEjM3onFPT24UeHX2DYZzJknTtn+GqVSCCIjSEqQFk2sXyFkAUAmIMvQFv+DZmHWljWrQareDzwDfk2fP8fUkXBQp2QR6ugRPcMpcair1LViIYohBcad/ckrhAt66bhVffB6JDlOskOGubkBBsPCCG24JT5V33DYuu86wPPzbkjjxAzxNTniP3Atij4K+SwHYes6G+zxkLjiEBJffWa69xQ67yqJh4FUUl3xEi+iaK0fMsxqZOhU3ykqDJMEAa1OZFBeMrrOnRdJbpxYNvgQ4VIzNgNNiLqQfgwvtBRh5M+uQJxHuRBeuhQlQEFl5km3Lb2URuxQoCEMrVUoLChuemgK8lpG9LaOiAoGG+klJPHVqucvuhLW8wGId03MnjzNkK3qUkMTLgZ7wUaYNYHHBrIKAMgL9vcGbaO8p7HxIYpOo6ud0BnmPkPPBWmdbh5BQgMINdoIXBj/F3JFOFCQ8OdoMw')))
 106
 107   LambdaRole:
 108     Type: "AWS::IAM::Role"
 109     Properties:
 110       RoleName: lambda-ddns
 111       AssumeRolePolicyDocument:
 112         Version: 2012-10-17
 113         Statement:
 114           -
 115             Effect: Allow
 116             Principal:
 117               Service:
 118                 - "lambda.amazonaws.com"
 119             Action:
 120               - "sts:AssumeRole"
 121
 122   LambdaPolicy:
 123     Type: "AWS::IAM::Policy"
 124     Properties:
 125       PolicyName: lambda-ddns
 126       PolicyDocument:
 127         Version: 2012-10-17
 128         Statement:
 129           -
 130             Effect: Allow
 131             Action: "ec2:Describe*"
 132             Resource: "*"
 133           -
 134             Effect: Allow
 135             Action:
 136               - "logs:CreateLogGroup"
 137               - "logs:CreateLogStream"
 138               - "logs:PutLogEvents"
 139             Resource: "*"
 140           -
 141             Effect: Allow
 142             Action: "route53:*"
 143             Resource: "*"
 144       Roles:
 145         -
 146           Ref: LambdaRole