tgw-attach.yaml

# (c) 2019 Amazon Web Services, Inc. or its affiliates. All Rights Reserved. This AWS Content is provided subject to the terms of the AWS Customer
# Agreement available at https://aws.amazon.com/agreement/ or other written agreement between Customer and Amazon Web Services, Inc.
AWSTemplateFormatVersion: '2010-09-09'
Description: Deploys an AWS Lambda Function that performs a Transit Gateway Attachment and Route creation to a centralized AWS Transit Gateway (RCS-1463)
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: 'Parameter Settings'
      Parameters:
        - pVpcTag
        - pTransitGatewayId
        - pRoute
        - pSecVpcId
        - pInetVpdId
        - pSecTgwAttachSubnets
        - pInetTgwAttachSubnets
    - Label:
        default: 'S3 tempalte and Lambda storage'
      Parameters:
        - 3Bucket
        - LambdaS3Key
    ParameterLabels:
      pVpcTag:
        default: VPC Tag
      pTransitGatewayId:
        default: Transit Gateway Id
      pRoute:
        default: Route Destination CIDR
      pSecVpcId:
        default: Security VPC Id
      pInetVpcId:
        default: Internet VPC Id
      pSecTgwAttachSubnets:
        default: List of TGW Attach Subnets for Security VPC
      pInetTgwAttachSubnets:
        default: List of TGW Attach Subnets for Internet VPC
      S3Bucket:
        default: S3 Bucket
      LambdaS3Key:
        default: S3 Key


Parameters:
  pVpcTag:
    Description: VPC Tags that you would like to associate with the Transit Gateway (Comma Separated)
    Type: String
    Default: 'test-tag'
  pTransitGatewayId:
    Description: The ID of the Central Account Transit Gateway
    Type: String
  pRoute:
    Description: Destination Route for traffic to the Central Account Transit Gateway
    Type: String
    Default: '0.0.0.0/0'
  pSecVpcId:
    Description: Security VPC Id
    Type: String
  pInetVpcId:
    Description: Internet VPC Id
    Type: String
  pSecTgwAttachSubnets:
    Description : Select at least 2 TGW Attach Subnets for Security VPC
    Type: List<AWS::EC2::Subnet::Id>
    MinLength: 2
  pInetTgwAttachSubnets:
    Description: Select at least 2 TGW Attach Subnets for Internet VPC
    Type: List<AWS::EC2::Subnet::Id>
    MinLength: 2
  S3Bucket:
    Description: S3 Bucket for Transit Gateway Attachment Lambda Code
    Type: String
    AllowedPattern: "^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$"
  LambdaS3Key:
    Description: The Key location of the Lambda zip for Transit Gateway Attachment.
    Type: String
    AllowedPattern: ^[a-zA-Z0-9[\\].\/()!:=?#,@+&;{}$-_]*


Resources:
  rGetVpcLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: TransitGatewayAttachments
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
          - Effect: Allow
            Action:
            - ec2:*
            - iam:ListRoles
            - iam:CreateServiceLinkedRole
            Resource: "*"
  rGetVpcLambda:
    Type: AWS::Lambda::Function
    DependsOn:
      - rGetVpcLambdaRole
    Properties:
      FunctionName: !Sub TransitGatewayAttachmentsAndRoute
      Role: !GetAtt rGetVpcLambdaRole.Arn
      Description: Captures VPC metadata for Transit Gateway Attachments
      Handler: index.lambda_handler
      Runtime: python3.8
      Timeout: 900
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref LambdaS3Key

  rGetVpcLambdaCustomInvoke:
    Type: Custom::GetVPCLambdaInvoke
    DependsOn: rGetVpcLambda
    Properties:
      ServiceToken: !GetAtt [ rGetVpcLambda, Arn ]
      Vpc_Tags: !Ref pVpcTag
      Account: !Sub ${AWS::AccountId}
      Region: !Sub ${AWS::Region}
      CIDR: !Ref pRoute
      tgw_id: !Ref pTransitGatewayId
      sec_vpc_id: !Ref pSecVpcId
      inet_vpc_id: !Ref pInetVpcId
      sec_subnets: !Ref pSecTgwAttachSubnets
      inet_subnets: !Ref pInetTgwAttachSubnets

  # Lambda permission - event rule can trigger evaluation
  rLambdaPermission:
    Type: AWS::Lambda::Permission
    DependsOn: rGetVpcLambda
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt 'rGetVpcLambda.Arn'
      Principal: events.amazonaws.com