archiver.yml

AWSTemplateFormatVersion: "2010-09-09"
Description:
  This script create the resources for the Lambda function deployment
Parameters:
  InvoiceBucketName:
    Type: String
    Description: Bucket name where the invoices will be stored
  EnvType:
    Type: String
    Description: Environment Type
    Default: prod
    AllowedValues:
    - prod
    - test
    ConstraintDescription: You must specify prod or test
Conditions:
  IsProdEnv: !Equals [!Ref EnvType, prod]
Resources:
  InvoiceSenderTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: sender
          AttributeType: S
      KeySchema:
        - AttributeName: sender
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: "2"
        WriteCapacityUnits: "2"
      TableName: WhitelistSender
  CompanyNameTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: "2"
        WriteCapacityUnits: "2"
      TableName: Company
  InvoiceBucket:
    Type: AWS::S3::Bucket
    Condition: IsProdEnv
    Properties:
      BucketName: !Ref InvoiceBucketName
  InvoiceRole:
    Type: AWS::IAM::Role
    DependsOn: "InvoiceSenderTable"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Principal:
            Service: 
            - lambda.amazonaws.com
            - events.amazonaws.com
          Action: "sts:AssumeRole"
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: Allow
            Action:
            - "logs:*"
            Resource: "arn:aws:logs:*:*:*"
          - Effect: Allow
            Action:
            - "lambda:InvokeFunction"
            Resource: "*"
          - Effect: Allow
            Action:
            - "s3:*"
            Resource: "*"
          - Effect: Allow
            Action:
            - "kms:Decrypt"
            Resource: "*"
          - Effect: Allow
            Action:
            - "dynamodb:DescribeTable"
            - "dynamodb:BatchGetItem"
            - "dynamodb:DescribeTable"
            - "dynamodb:GetItem"
            - "dynamodb:ListTables"
            - "dynamodb:Query"
            - "dynamodb:Scan"
            - "dynamodb:DescribeReservedCapacity"
            - "dynamodb:DescribeReservedCapacityOfferings"
            - "dynamodb:ListTagsOfResource"
            - "dynamodb:DescribeTimeToLive"
            - "dynamodb:DescribeLimits"
            Resource: "*"
      Path: /
      RoleName: InvoiceArchiverRole
Outputs:
  InvoiceRoleArn:
    Value: !GetAtt InvoiceRole.Arn
    Description: Arn for Zappa Role