AWSTemplateFormatVersion: 2010-09-09
Description: Kinesis cross account lambda consumer deployment

Parameters:
  KinesisStreamArn:
    Description: ARN of Kinesis Data Stream
    Type: String
  KinesisStreamEFOConsumerArn:
    Description: ARN of Kinesis Data Stream EFO Consumer
    Type: String
  KMSKeyArn:
    Description: ARN of KMS key
    Type: String

Resources:

  ConsumerLambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'kds-cross-account-stream-consumer-lambda-execution-role'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'kinesis:DescribeStream'
                  - 'kinesis:DescribeStreamSummary'
                  - 'kinesis:GetRecords'
                  - 'kinesis:GetShardIterator'
                  - 'kinesis:ListShards'
                  - 'kinesis:SubscribeToShard'
                Resource:
                  - !Ref KinesisStreamArn
                  - !Ref KinesisStreamEFOConsumerArn
              - Effect: Allow
                Action:
                  - 'kms:Decrypt'
                  - 'kms:GenerateDataKey*'
                  - 'kms:DescribeKey'
                Resource:
                  - !Ref KMSKeyArn
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: 'arn:aws:logs:*:*:*'
              - Effect: Allow
                Action:
                  - 'kinesis:ListStreams'
                Resource: '*'

  ConsumerLambda:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: kds-cross-account-stream-efo-consumer
      Code:
        ZipFile: |
          import json

          def lambda_handler(event, context):
              print("Received event: " + json.dumps(event, indent=2))
      Handler: index.lambda_handler
      Runtime: python3.9
      Timeout: 60
      Role: !GetAtt ConsumerLambdaExecutionRole.Arn

Outputs:
  KinesisStreamCreateResourcePolicyCommand:
    Description: AWS CLI command to create Kinesis Stream resource policy
    Value: !Sub
      - 'aws kinesis put-resource-policy --resource-arn ${KinesisStreamARN} --policy ${KinesisStreamResourcePolicy}'
      - KinesisStreamARN: !Ref KinesisStreamArn
        KinesisStreamResourcePolicy: !Sub
          - '"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"StreamEFOReadStatementID\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"${ConsumerExecutionRole}\"]},\"Action\":[\"kinesis:DescribeStreamSummary\",\"kinesis:ListShards\",\"kinesis:DescribeStream\",\"kinesis:GetRecords\",\"kinesis:GetShardIterator\"],\"Resource\":\"${KinesisStreamARN}\"}]}"'
          - KinesisStreamARN: !Ref KinesisStreamArn
            ConsumerExecutionRole: !GetAtt ConsumerLambdaExecutionRole.Arn
  KinesisStreamEFOConsumerCreateResourcePolicyCommand:
    Description: AWS CLI command to create Kinesis Stream EFO Consumer resource policy
    Value: !Sub
      - 'aws kinesis put-resource-policy --resource-arn ${KinesisStreamEFOConsumerARN} --policy ${KinesisStreamEFOConsumerResourcePolicy}'
      - KinesisStreamEFOConsumerARN: !Ref KinesisStreamEFOConsumerArn
        KinesisStreamEFOConsumerResourcePolicy: !Sub
          - '"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"ConsumerEFOReadStatementID\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"${ConsumerExecutionRole}\"]},\"Action\":[\"kinesis:DescribeStreamConsumer\",\"kinesis:SubscribeToShard\"],\"Resource\":\"${KinesisStreamEFOConsumerARN}\"}]}"'
          - KinesisStreamEFOConsumerARN: !Ref KinesisStreamEFOConsumerArn
            ConsumerExecutionRole: !GetAtt ConsumerLambdaExecutionRole.Arn