get rid of aws policy

Author: anthony-nhs

SAMtemplates/lambda_resources.yaml

@@ -20,11 +20,6 @@ Parameters:
     Type: String
     Description: Splunk delivery stream
     Default: none
-  EnableSplunk:
-    Type: String
-    Description: Whether to use splunk
-    Default: false
-    AllowedValues: [true, false]
   LambdaName:
     Type: String
     Description: Name of lambda we are creating for
@@ -62,9 +57,18 @@ Parameters:
       ]
   ExecutePolicyExportName:
     Type: String
+  IncludeAdditionalPolicies:
+    Type: String
+    Default: false
+  AdditionalPolicies:
+    Type: CommaDelimitedList
+    Description: A list of additional policies to attach the lambdas role (comma delimited).
+    Default: none
 
 Conditions:
-  ShouldUseSplunk: !Equals [true, !Ref EnableSplunk]
+  ShouldIncludeAdditionalPolicies: !Equals
+    - true
+    - !Ref IncludeAdditionalPolicies
 
 Resources:
   ExecuteLambdaManagedPolicy:
@@ -89,10 +93,19 @@ Resources:
             Principal:
               Service: "lambda.amazonaws.com"
             Action: "sts:AssumeRole"
-      ManagedPolicyArns:
-        - !ImportValue lambda-resources:LambdaInsightsLogGroupPolicy
-        - !ImportValue account-resources:LambdaEncryptCloudwatchKMSPolicy
-        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
+      ManagedPolicyArns: !Split
+        - ","
+        - !Join
+          - ","
+          - - !Ref LambdaManagedPolicy
+            - !ImportValue lambda-resources:LambdaInsightsLogGroupPolicy
+            - !ImportValue account-resources:CloudwatchEncryptionKMSPolicyArn
+            - !If
+              - ShouldIncludeAdditionalPolicies
+              - !Join
+                - ","
+                - !Ref AdditionalPolicies
+              - !Ref AWS::NoValue
 
   LambdaManagedPolicy:
     Type: AWS::IAM::ManagedPolicy
@@ -122,7 +135,6 @@ Resources:
       KmsKeyId: !Ref CloudWatchKMSKey
 
   LambdaSplunkSubscriptionFilter:
-    Condition: ShouldUseSplunk
     Type: AWS::Logs::SubscriptionFilter
     Properties:
       RoleArn: !Ref SplunkSubscriptionFilterRole

SAMtemplates/main_template.yaml

@@ -54,7 +54,6 @@ Resources:
         CloudWatchKMSKey: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
         SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
         SplunkDeliveryStream: !ImportValue lambda-resources:SplunkDeliveryStream
-        EnableSplunk: "true"
         LambdaName: !Sub "${AWS::StackName}-FHIRValidatorUKCore"
         LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-FHIRValidatorUKCore
         LogRetentionDays: !Ref LogRetentionDays
@@ -102,6 +101,22 @@ Resources:
           IpProtocol: "-1"
       VpcId: !ImportValue vpc-resources:VpcId
 
+  LambdaVPCPolicy:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Action:
+              - ec2:CreateNetworkInterface
+              - ec2:DescribeNetworkInterfaces
+              - ec2:DescribeSubnets
+              - ec2:DeleteNetworkInterface
+              - ec2:AssignPrivateIpAddresses
+              - ec2:UnassignPrivateIpAddresses
+            Resource: "*"
+
   FHIRValidatorNHSDigitalLegacyResources:
     Type: AWS::Serverless::Application
     Properties:
@@ -116,6 +131,8 @@ Resources:
         LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-FHIRValidatorNHSDigitalLegacy
         LogRetentionDays: !Ref LogRetentionDays
         ExecutePolicyExportName: FHIRValidatorNHSDigitalLegacyExecuteLambdaPolicyArn
+        IncludeAdditionalPolicies: true
+        AdditionalPolicies: !Ref LambdaVPCPolicy
 
   FHIRValidatorNHSDigitalLegacy:
     Type: AWS::Serverless::Function
@@ -162,11 +179,12 @@ Resources:
         CloudWatchKMSKey: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
         SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
         SplunkDeliveryStream: !ImportValue lambda-resources:SplunkDeliveryStream
-        EnableSplunk: "true"
         LambdaName: !Sub "${AWS::StackName}-FHIRValidatorNHSDigitalCurrent"
         LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-FHIRValidatorNHSDigitalCurrent
         LogRetentionDays: !Ref LogRetentionDays
         ExecutePolicyExportName: FHIRValidatorNHSDigitalCurrentExecuteLambdaPolicyArn
+        IncludeAdditionalPolicies: true
+        AdditionalPolicies: !Ref LambdaVPCPolicy
 
   FHIRValidatorNHSDigitalCurrent:
     Type: AWS::Serverless::Function