solution.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: VPC Lattice Automation - Deployment Templates

Parameters:
  VPCLatticeAssociation:
    Type: String
    Description: Which VPC Lattice association to automate (from changes in tag "stage")
    AllowedValues:
      - VPC
      - SERVICE
      - BOTH
      - NONE
  ShareAutomation:
    Type: String
    Description: Which VPC Lattice resource you want to share (from changes in tag "stage")
    AllowedValues:
      - SERVICE_NETWORK
      - SERVICE
      - BOTH
      - NONE
  ShareAutomationAllowedAccounts:
    Type: String
    Description: (If automating VPC Lattice RAM share) Provide list of AWS Accounts to share your resources, divided by comma (Account1,Account2)
  ShareAutomationAllowedStages:
    Type: String
    Description: (If automating VPC Lattice RAM share) Provide list of stages allowed to share, divided by comma (stage1,stage2)
  AcceptShareAutomation:
    Type: String
    Description: Which VPC Lattice resource (shared with you) you want to accept.
    AllowedValues:
      - SERVICE_NETWORK
      - SERVICE
      - BOTH
      - NONE
  AcceptShareAutomationAllowedAccounts:
    Type: String
    Description: (If automating RAM share acceptance) Provide list of AWS Accounts to accept resources shared, divided by comma (Account1,Account2)
  AcceptShareAutomationAllowedStages:
    Type: String
    Description: (If automating RAM share acceptance) Provide list of stages allowed to accept shared resources, divided by comma (stage1,stage2)

Conditions:
  VPCAssociation: !Or
    - !Equals
      - !Ref VPCLatticeAssociation
      - VPC
    - !Equals
      - !Ref VPCLatticeAssociation
      - BOTH
  ServiceAssociation: !Or
    - !Equals
      - !Ref VPCLatticeAssociation
      - SERVICE
    - !Equals
      - !Ref VPCLatticeAssociation
      - BOTH
  ShareService: !Or
    - !Equals
      - !Ref ShareAutomation
      - SERVICE
    - !Equals
      - !Ref ShareAutomation
      - BOTH
  ShareServiceNetwork: !Or
    - !Equals
      - !Ref ShareAutomation
      - SERVICE_NETWORK
    - !Equals
      - !Ref ShareAutomation
      - BOTH
  AcceptSharedService: !Or
    - !Equals
      - !Ref AcceptShareAutomation
      - SERVICE
    - !Equals
      - !Ref AcceptShareAutomation
      - BOTH

Resources:
  # ---------- MOVE PYTHON CODE TO S3 (ZIP FILES) ----------
  CodeBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub 
        - lambda-code-${AWS::Region}-${AWS::AccountId}-${RandomizedValue}
        - RandomizedValue:
            Fn::Select: [0, Fn::Split: [-, Fn::Select: [2, Fn::Split: [/, !Ref AWS::StackId ]]]] # Takes the first part of the random GUID in the cloudformation stacks arn.
      AccessControl: Private

  GitRepoToS3CustomResource:
    Type: Custom::GitRepoToS3
    Properties:
      ServiceToken: !GetAtt GitRepoToS3Lambda.Arn

  GitRepoToS3LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                Resource: !Sub ${CodeBucket.Arn}/lambdacode/*
          PolicyName: PutS3Object

  GitRepoToS3Lambda:
    Type: AWS::Lambda::Function
    Properties: 
      Description: Lambda to be triggered by Cloudformation Custom resource to copy GitHub repo to S3 bucket.
      Code: 
        ZipFile: |
          import boto3
          import logging
          import os
          import shutil
          import cfnresponse
          s3 = boto3.client('s3')
          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          # Getting Repository link and S3 Bucket
          repo = os.environ['GitRepo']
          s3Bucket = os.environ['s3Bucket']

          path = '/tmp/repo' 

          s3ObjectNames = ['vpc_association', 'service_association', 'share_service', 'share_service_network', 'accept_shared_service', 'disassociate_unshared_service']
          s3ObjectExtension = 'zip'

          def lambda_handler(event, context):
              response_data = {}
              try:
                  logger.info('Create path and change working directory to: %s' % (path))
                  os.mkdir(path)
                  os.chdir(path)
                  logger.info('Clone the repository: %s to: %s' % (repo, path))
                  os.system('git clone ' + repo + ' cloned-repo')
                  shutil.rmtree('cloned-repo/.git')
                  logger.info('Clone complete. Files in working directory:')
                  logger.info(os.listdir(os.getcwd()))
                  
                  logger.info('Create Zip from repo')
                  for i in s3ObjectNames:
                    dir = './' + i +'.py'
                    s3ObjectFullName = i + '.' + s3ObjectExtension
                    shutil.make_archive(i, s3ObjectExtension,'cloned-repo/lambda_code',dir)
                    #shutil.make_archive(vpcAssociations3ObjectName, s3ObjectExtension,'cloned-repo','./lambda_code/vpc-association.py')
                    logger.info('Created zip from repo. Files in working directory:')
                    logger.info(os.listdir(os.getcwd()))
                    logger.info('Uploading %s to S3://%s/%s' % (s3ObjectFullName, s3Bucket, 'lambdacode/'+s3ObjectFullName))
                    s3.upload_file(os.getcwd() + '/' + s3ObjectFullName, s3Bucket, 'lambdacode/'+s3ObjectFullName)
                  
                  logger.info('Upload Complete. Cleaning directory')
                  shutil.rmtree(path)
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
              except Exception as e:
                  logger.error('Execution failed...')
                  logger.error(str(e))
                  response_data['Data'] = str(e)
                  cfnresponse.send(event, context, cfnresponse.FAILED, response_data)
      Environment: 
        Variables:
          GitRepo: https://github.com/aws-samples/automated-associations-amazon-vpc-lattice
          s3Bucket: !Ref CodeBucket
      Handler: index.lambda_handler
      Runtime: python3.8
      Layers: 
        - !Sub arn:aws:lambda:${AWS::Region}:553035198032:layer:git-lambda2:8 # https://github.com/lambci/git-lambda-layer
      MemorySize: 1024
      Role: !GetAtt GitRepoToS3LambdaRole.Arn

  # ---------- VPC ASSOCIATION ----------
  # EventBridge Rule
  VPCAssociationEventBridgeRule:
    Type: AWS::Events::Rule
    Condition: VPCAssociation
    Properties:
      Name: "vpc-tags"
      Description: "Capture Changes in VPC Tags."
      EventPattern: "{\"source\":[\"aws.ec2\"],\"detail-type\":[\"AWS API Call via CloudTrail\"],\"detail\":{\"eventSource\":[\"ec2.amazonaws.com\"],\"eventName\":[\"CreateTags\",\"DeleteTags\"],\"requestParameters\":{\"resourcesSet\":{\"items\":{\"resourceId\":[{\"prefix\":\"vpc-\"}]}},\"tagSet\":{\"items\":{\"key\":[{\"equals-ignore-case\":\"stage\"}]}}}}}"
      Targets:
        - Arn: !GetAtt VPCAssociationFunction.Arn
          Id: "LambdaFunction"
  
  # Lambda permission (for the EventBridge rule)
  VPCAssociationEventBridgeLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: VPCAssociation
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref VPCAssociationFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt VPCAssociationEventBridgeRule.Arn

  # Lambda Function: IAM Role
  VPCAssociationLambdaFuntionRole:
    Type: AWS::IAM::Role
    Condition: VPCAssociation
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AllowLatticeActions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - vpc-lattice:ListServiceNetworks
                  - vpc-lattice:ListServiceNetworkVpcAssociations
                  - vpc-lattice:GetServiceNetworkVpcAssociation
                  - vpc-lattice:CreateServiceNetworkVpcAssociation
                  - vpc-lattice:DeleteServiceNetworkVpcAssociation
                  - vpc-lattice:ListTagsForResource
                  - ec2:DescribeVpcs
                  - ram:ListResources
                  - ram:GetResourceShares
                Resource:
                  - "*"
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # CloudWatch Log Group
  VPCAssociationLambdaFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: Encryption not required for this log group
    Type: AWS::Logs::LogGroup
    Condition: VPCAssociation
    Properties: 
      LogGroupName: !Sub /aws/lambda/${VPCAssociationFunction}
      RetentionInDays: 7

  # Function
  VPCAssociationFunction:
    DependsOn: GitRepoToS3CustomResource
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CWL permissions granted by use of AWSLambdaBasicExecutionRole
          - id: W89
            reason: No requirement for this function to be in a VPC
          - id: W92
            reason: No requirement to limit simultaneous executions
    Type: AWS::Lambda::Function
    Condition: VPCAssociation
    Properties:
      Description: Automates VPC Lattice VPC associations
      Runtime: python3.10
      Timeout: 90
      Role: !GetAtt VPCAssociationLambdaFuntionRole.Arn
      Handler: vpc_association.lambda_handler
      Environment:
        Variables:
          MY_ACCOUNT: !Ref AWS::AccountId
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambdacode/vpc_association.zip

  # ---------- VPC LATTICE SERVICE ASSOCIATION ----------
  # EventBridge Rule
  ServiceAssociationEventBridgeRule:
    Type: AWS::Events::Rule
    Condition: ServiceAssociation
    Properties:
      Name: "vpclattice-service-tags"
      Description: "Capture Changes VPC Lattice Service Tags."
      EventPattern:
        source:
          - aws.tag
        detail-type: 
          - "Tag Change on Resource"
        detail:
          changed-tag-keys:
            - equals-ignore-case: stage
          service:
            - vpc-lattice
          resource-type:
            - service
      Targets:
        - Arn: !GetAtt ServiceAssociationFunction.Arn
          Id: "LambdaFunction"
  
  # Lambda permission (for the EventBridge rule)
  ServiceAssociationEventBridgeLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: ServiceAssociation
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ServiceAssociationFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ServiceAssociationEventBridgeRule.Arn

  # IAM Role (Lambda Function)
  ServiceAssociationLambdaFuntionRole:
    Type: AWS::IAM::Role
    Condition: ServiceAssociation
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AllowLatticeActions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - vpc-lattice:ListServiceNetworks
                  - vpc-lattice:ListServiceNetworkServiceAssociations
                  - vpc-lattice:CreateServiceNetworkServiceAssociation
                  - vpc-lattice:DeleteServiceNetworkServiceAssociation
                  - vpc-lattice:ListTagsForResource
                  - ssm:GetParameter
                  - ssm:PutParameter
                  - ram:ListResources
                  - ram:GetResourceShares
                Resource:
                  - "*"
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # CloudWatch Log Group
  ServiceAssociationLambdaFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: Encryption not required for this log group
    Type: AWS::Logs::LogGroup
    Condition: ServiceAssociation
    Properties: 
      LogGroupName: !Sub /aws/lambda/${ServiceAssociationFunction}
      RetentionInDays: 7

  # Systems Manager Parameter (StageList)
  ServiceAssociationStageListParameter:
    Type: AWS::SSM::Parameter
    Condition: ServiceAssociation
    Properties:
      Name: 'service-association-current-stages'
      Description: Current stages in the VPC Lattice service association automation
      Type: String
      Value: ' '
  
  # Function
  ServiceAssociationFunction:
    DependsOn: GitRepoToS3CustomResource
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CWL permissions granted by use of AWSLambdaBasicExecutionRole
          - id: W89
            reason: No requirement for this function to be in a VPC
          - id: W92
            reason: No requirement to limit simultaneous executions
    Type: AWS::Lambda::Function
    Condition: ServiceAssociation
    Properties:
      Description: Automates VPC Lattice service associations
      Runtime: python3.10
      Timeout: 30
      Role: !GetAtt ServiceAssociationLambdaFuntionRole.Arn
      Handler: service_association.lambda_handler
      Environment:
        Variables:
          PARAMETER_STAGES: 'service-association-current-stages'
          MY_ACCOUNT: !Ref AWS::AccountId
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambdacode/service_association.zip

  # ---------- SHARE VPC LATTICE SERVICES (TO ALLOWED AWS ACCOUNTS) ----------
  # EventBridge Rule
  ShareServiceEventBridgeRule:
    Type: AWS::Events::Rule
    Condition: ShareService
    Properties:
      Name: "vpclattice-new-service"
      Description: "Captures changes in VPC Lattice service tags."
      EventPattern:
        source:
          - aws.tag
        detail-type: 
          - "Tag Change on Resource"
        detail:
          changed-tag-keys:
            - equals-ignore-case: stage
          service:
            - vpc-lattice
          resource-type:
            - service
      Targets:
        - Arn: !GetAtt ShareServiceFunction.Arn
          Id: "LambdaFunction"
  
  # Lambda permission (for the EventBridge rule)
  ShareServiceEventBridgeLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: ShareService
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ShareServiceFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ShareServiceEventBridgeRule.Arn

  # IAM Role (Lambda function)
  ShareServiceLambdaFuntionRole:
    Type: AWS::IAM::Role
    Condition: ShareService
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AllowLatticeActions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ram:GetResourceShares
                  - ram:CreateResourceShare
                  - ram:DeleteResourceShare
                  - ram:TagResource
                  - vpc-lattice:PutResourcePolicy
                Resource:
                  - "*"
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # CloudWatch Log Group
  ShareServiceLambdaFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: Encryption not required for this log group
    Type: AWS::Logs::LogGroup
    Condition: ShareService
    Properties: 
      LogGroupName: !Sub /aws/lambda/${ShareServiceFunction}
      RetentionInDays: 7

  # Function
  ShareServiceFunction:
    DependsOn: GitRepoToS3CustomResource
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CWL permissions granted by use of AWSLambdaBasicExecutionRole
          - id: W89
            reason: No requirement for this function to be in a VPC
          - id: W92
            reason: No requirement to limit simultaneous executions
    Type: AWS::Lambda::Function
    Condition: ShareService
    Properties:
      Description: Share VPC Lattice services.
      Runtime: python3.10
      Timeout: 30
      Role: !GetAtt ShareServiceLambdaFuntionRole.Arn
      Handler: share_service.lambda_handler
      Environment:
        Variables:
          ALLOWED_ACCOUNTS: !Ref ShareAutomationAllowedAccounts
          STAGE_NAMES: !Ref ShareAutomationAllowedStages
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambdacode/share_service.zip

  # ---------- SHARE VPC LATTICE SERVICE NETWORKS (TO ALLOWED AWS ACCOUNTS) ----------
  # EventBridge Rule
  ShareServiceNetworkEventBridgeRule:
    Type: AWS::Events::Rule
    Condition: ShareServiceNetwork
    Properties:
      Name: "vpclattice-new-service-network"
      Description: "Captures changes in VPC Lattice service tags."
      EventPattern:
        source:
          - aws.tag
        detail-type: 
          - "Tag Change on Resource"
        detail:
          changed-tag-keys:
            - equals-ignore-case: stage
          service:
            - vpc-lattice
          resource-type:
            - service-network
      Targets:
        - Arn: !GetAtt ShareServiceNetworkFunction.Arn
          Id: "LambdaFunction"
  
  # Lambda permission (for the EventBridge rule)
  ShareServiceNetworkEventBridgeLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: ShareServiceNetwork
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ShareServiceNetworkFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ShareServiceNetworkEventBridgeRule.Arn

  # IAM Role (Lambda function)
  ShareServiceNetworkLambdaFuntionRole:
    Type: AWS::IAM::Role
    Condition: ShareServiceNetwork
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AllowLatticeActions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ram:GetResourceShares
                  - ram:CreateResourceShare
                  - ram:DeleteResourceShare
                  - ram:TagResource
                  - vpc-lattice:PutResourcePolicy
                Resource:
                  - "*"
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # CloudWatch Log Group
  ShareServiceNetworkLambdaFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: Encryption not required for this log group
    Type: AWS::Logs::LogGroup
    Condition: ShareServiceNetwork
    Properties: 
      LogGroupName: !Sub /aws/lambda/${ShareServiceNetworkFunction}
      RetentionInDays: 7

  # Function
  ShareServiceNetworkFunction:
    DependsOn: GitRepoToS3CustomResource
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CWL permissions granted by use of AWSLambdaBasicExecutionRole
          - id: W89
            reason: No requirement for this function to be in a VPC
          - id: W92
            reason: No requirement to limit simultaneous executions
    Type: AWS::Lambda::Function
    Condition: ShareServiceNetwork
    Properties:
      Description: Share VPC Lattice services.
      Runtime: python3.10
      Timeout: 30
      Role: !GetAtt ShareServiceNetworkLambdaFuntionRole.Arn
      Handler: share_service_network.lambda_handler
      Environment:
        Variables:
          ALLOWED_ACCOUNTS: !Ref ShareAutomationAllowedAccounts
          STAGE_NAMES: !Ref ShareAutomationAllowedStages
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambdacode/share_service_network.zip

  # ---------- ACCEPT SHARED VPC LATTICE SERVICES ----------
  # EventBridge Scheduler
  AcceptSharedServiceScheduler:
    Type: AWS::Scheduler::Schedule
    Condition: AcceptSharedService
    Properties:
      Name: "accept-shared-services"
      FlexibleTimeWindow:
        Mode: "OFF"
      ScheduleExpression: "rate(1 minute)"
      Target:
        Arn: !GetAtt AcceptSharedServiceFunction.Arn
        RoleArn: !GetAtt AcceptSharedServiceSchedulerRole.Arn

  AcceptSharedServiceSchedulerRole:
    Type: AWS::IAM::Role
    Condition: AcceptSharedService
    Properties:
      Description: "EventBridge Scheduler - IAM Role (AcceptSharedService)"
      RoleName: accept-scheduler-shared-services
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - scheduler.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: accept-scheduler-shared-services
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "lambda:InvokeFunction"
                Resource: !GetAtt AcceptSharedServiceFunction.Arn

  # IAM Roles (Lambda function)
  AcceptSharedServiceLambdaFuntionRole:
    Type: AWS::IAM::Role
    Condition: AcceptSharedService
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AllowLatticeActions-Associate
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ram:AcceptResourceShareInvitation
                  - ram:GetResourceShareInvitations
                  - ram:GetResourceShares
                  - ram:ListResources
                  - vpc-lattice:ListServiceNetworks
                  - vpc-lattice:CreateServiceNetworkServiceAssociation
                  - vpc-lattice:ListServiceNetworkServiceAssociations
                  - vpc-lattice:ListTagsForResource
                  - ssm:GetParameter
                  - ssm:PutParameter
                Resource:
                  - "*"
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # CloudWatch Log Group
  AcceptSharedServiceLambdaFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: Encryption not required for this log group
    Type: AWS::Logs::LogGroup
    Condition: AcceptSharedService
    Properties: 
      LogGroupName: !Sub /aws/lambda/${AcceptSharedServiceFunction}
      RetentionInDays: 7

  # Systems Manager Parameter
  AcceptSharedServiceParameter:
    Type: AWS::SSM::Parameter
    Condition: AcceptSharedService
    Properties:
      Name: 'map-service-network-stage'
      Description: Map of VPC Lattice service networks (mapped to their stage)
      Type: String
      Value: ' '

  # Function
  AcceptSharedServiceFunction:
    DependsOn: GitRepoToS3CustomResource
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CWL permissions granted by use of AWSLambdaBasicExecutionRole
          - id: W89
            reason: No requirement for this function to be in a VPC
          - id: W92
            reason: No requirement to limit simultaneous executions
    Type: AWS::Lambda::Function
    Condition: AcceptSharedService
    Properties:
      Description: Associate shared VPC Lattice services to the service network.
      Runtime: python3.10
      Timeout: 30
      Role: !GetAtt AcceptSharedServiceLambdaFuntionRole.Arn
      Handler: accept_shared_service.lambda_handler
      Environment:
        Variables:
          ALLOWED_ACCOUNTS: !Ref AcceptShareAutomationAllowedAccounts
          STAGE_NAMES: !Ref AcceptShareAutomationAllowedStages
          MY_ACCOUNT: !Ref AWS::AccountId
          PARAMETER_NAME: !Ref AcceptSharedServiceParameter
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambdacode/accept_shared_service.zip
  
  # ---------- DISASSOCIATE UNSHARED VPC LATTICE SERVICES ----------
  # EventBridge Scheduler
  DisassociateUnsharedServiceScheduler:
    Type: AWS::Scheduler::Schedule
    Condition: AcceptSharedService
    Properties:
      Name: "disassociate-unshared-services"
      Description: "Checking VPC Lattice services unshared with the Account."
      FlexibleTimeWindow:
        Mode: "OFF"
      ScheduleExpression: "rate(2 minute)"
      Target:
        Arn: !GetAtt DisassociateUnsharedServiceFunction.Arn
        RoleArn: !GetAtt DisassociateUnsharedServiceSchedulerRole.Arn

  DisassociateUnsharedServiceSchedulerRole:
      Type: AWS::IAM::Role
      Condition: AcceptSharedService
      Properties:
        Description: "EventBridge Scheduler - IAM Role (Disassociated Shared Services)"
        RoleName: disassociate-shared-services
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - scheduler.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: disassociate-shared-services
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action: "lambda:InvokeFunction"
                  Resource: !GetAtt DisassociateUnsharedServiceFunction.Arn

  # IAM Role (Lambda function)
  DisassociateUnsharedServiceLambdaFuntionRole:
    Type: AWS::IAM::Role
    Condition: AcceptSharedService
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AllowLatticeActions-Disassociate
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - vpc-lattice:ListServiceNetworkServiceAssociations
                  - vpc-lattice:DeleteServiceNetworkServiceAssociation
                  - ram:ListResources
                  - ssm:GetParameter
                Resource:
                  - "*"
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # CloudWatch Log Group
  DisassociateUnsharedServiceLambdaFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: Encryption not required for this log group
    Type: AWS::Logs::LogGroup
    Condition: AcceptSharedService
    Properties: 
      LogGroupName: !Sub /aws/lambda/${DisassociateUnsharedServiceFunction}
      RetentionInDays: 7

  # Function
  DisassociateUnsharedServiceFunction:
    DependsOn: GitRepoToS3CustomResource
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CWL permissions granted by use of AWSLambdaBasicExecutionRole
          - id: W89
            reason: No requirement for this function to be in a VPC
          - id: W92
            reason: No requirement to limit simultaneous executions
    Type: AWS::Lambda::Function
    Condition: AcceptSharedService
    Properties:
      Description: Disassociate VPC Lattice services to the service network.
      Runtime: python3.10
      Timeout: 30
      Role: !GetAtt DisassociateUnsharedServiceLambdaFuntionRole.Arn
      Handler: disassociate_unshared_service.lambda_handler
      Environment:
        Variables:
          PARAMETER_NAME: !Ref AcceptSharedServiceParameter
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambdacode/disassociate_unshared_service.zip