aws-serverless/template.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: An AWS Lambda application that sends an email when files appear in S3
Parameters:
  S3Bucket:
    Type: String
  SesSendingIdentityArn:
    Type: String
  SesDestinationIdentityArn:
    Type: String
    Default: ''
  MailFrom:
    Type: String
  MailTo:
    Type: String
Conditions:
  NoSesDestinationIdentityArn: !Equals [!Ref SesDestinationIdentityArn, '']
Resources:
  Template:
    Type: AWS::SES::Template
    Properties:
      Template:
        TemplateName: !Join ['-', [!Ref AWS::StackName, sestemplate]]
        SubjectPart: '{{Subject}}'
        TextPart: |
          New files:
          {{#each Files}}
          {{Url}}
          {{/each}}
        HtmlPart: |
          <html><body><h1>New files:</h1>
          <ul>
          {{#each Files}}
          <li><a href="{{Url}}">{{FileName}}</a></li>
          {{/each}}
          </ul>
          </body>
          </html>
  IAMUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Join ['-', [!Ref AWS::StackName, !Ref AWS::Region, iam-user]]
      Policies:
        - PolicyName: !Join ['-', [!Ref AWS::StackName, policy]]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowS3
                Effect: Allow
                Resource:
                  - !Join ['', ['arn:aws:s3:::', !Ref S3Bucket]]
                  - !Join ['', ['arn:aws:s3:::', !Ref S3Bucket, /*]]
                Action:
                  - s3:GetObject
                  # - s3:GetBucketLocation
                  # - s3:ListBucket
  IAMKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref IAMUser
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['', [/aws/lambda/, !Ref Function]]
      RetentionInDays: '14'
  Function:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Join ['-', [!Ref AWS::StackName, lambda]]
      Handler: bootstrap
      Runtime: provided.al2
      Architectures:
        - arm64
      CodeUri: ./bootstrap.zip
      Description: Send an email when files appear in S3
      Timeout: 60
      MemorySize: 128
      Environment:
        Variables:
          APP_S3PRESIGNAWSKEYID: !Ref IAMKey
          APP_S3PRESIGNAWSSECRET: !GetAtt IAMKey.SecretAccessKey
          APP_SESSOURCEARN: !Ref SesSendingIdentityArn
          APP_TEMPLATE: !Ref Template
          APP_MAILFROM: !Ref MailFrom
          APP_MAILTO: !Ref MailTo
      Policies:
        - AWSLambdaBasicExecutionRole
        - Statement:
            - Sid: AllowSesSend
              Effect: Allow
              Resource:
                - !Ref SesSendingIdentityArn
                - !If [NoSesDestinationIdentityArn, Ref: AWS::NoValue, Ref: SesDestinationIdentityArn]
                - !Join ['', ['arn:aws:ses:', !Ref AWS::Region, ':', !Ref 'AWS::AccountId', ':template/', !Ref Template]]
              Action:
                - ses:SendTemplatedEmail
  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt Function.Arn
      Action: lambda:InvokeFunction
      Principal: s3.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: !Sub 'arn:aws:s3:::${S3Bucket}'
Outputs:
  LambdaARN:
    Description: ARN of Lambda Function
    Value: !GetAtt Function.Arn