templates/rocketcx-cloudformation.yml [1:429]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: 2010-09-09

Description: RocketCX Enterprise Connector for ServiceNow Quickstart. (qs-1qji34a8u)

Transform: AWS::Serverless-2016-10-31

Metadata:

  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Amazon Connect configuration
        Parameters:
          - AmazonConnectInstanceID
      - Label:
          default: ServiceNow configuration
        Parameters:
          - ServiceNowHostURL
          - ServiceNowUserName
          - ServiceNowPassword
      - Label:
          default: Security configuration (optional)
        Parameters:     
          - IAMUserName
          - CallRecordingS3BucketName
    ParameterLabels:
      AmazonConnectInstanceID:
        default: "Amazon Connect ID"
      ServiceNowHostURL:
        default: "ServiceNow URL"
      ServiceNowUserName:
        default: "ServiceNow user name"
      ServiceNowPassword:
        default: "ServiceNow user password"
      IAMUserName:
        default: "Amazon Connect user name"
      CallRecordingS3BucketName:
        default: "Amazon Connect S3 bucket"
      

Parameters:

  AmazonConnectInstanceID:
    Description: Amazon Connect instance ID for integration with ServiceNow (maximum of 36 alphanumeric characters). This
                 ID is different from the Amazon Resource Name (ARN) ID.
    Type: String

  ServiceNowHostURL:
    AllowedPattern: ^https[://]+[a-zA-Z0-9-.]+[.]service-now.com/$
    ConstraintDescription: Endpoint must be a valid ServiceNow API Host URI.
    Description: Sample ServiceNow instance URL for Lambda data dip (https://example.service-now.com/).
    Type: String
    
  ServiceNowUserName:
    Description: ServiceNow user name for Lambda data dip. The user must have API-invoke access permissions for the ServiceNow instance.
    Type: String

  ServiceNowPassword:
    Description: ServiceNow password for Lambda data dip. The user must have API-invoke access permissions for the ServiceNow instance.
    NoEcho: true
    Type: String

  IAMUserName:
    Description: (Optional) Name of IAM user for accessing Amazon Connect statistics and call recordings.
    Type: String

  CallRecordingS3BucketName:
    Description: (Optional) Name of S3 bucket that stores Amazon Connect call recordings.
    Type: String


Globals:

  Function:
    Runtime: python3.7
    Timeout: 15


Conditions: 

  cCallRecordingS3BucketName: !Not [!Equals [!Ref CallRecordingS3BucketName, ""]]
  cIAMUserName: !Not [!Equals [!Ref IAMUserName, ""]]
  cPolicyDeployment: !And
    - !Condition cCallRecordingS3BucketName
    - !Condition cIAMUserName

    
Resources:

  rLambdaZipsBucket:
    Type: AWS::S3::Bucket

  rCopyZips:
    Type: Custom::CopyZips
    Properties:
      ServiceToken: !GetAtt 'rCopyZipsFunction.Arn'
      DestBucket: !Ref 'rLambdaZipsBucket'
      SourceBucket: 'rocketcx-resources'
      Objects:
        - EnterpriseConnectorServiceNow/lambda/Package/get_caller.zip
        - EnterpriseConnectorServiceNow/lambda/Package/get_records.zip
        - EnterpriseConnectorServiceNow/lambda/Package/search_record.zip
        - EnterpriseConnectorServiceNow/lambda/Package/survey_feedback.zip

  rCopyZipsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Path: /
      Policies:
        - PolicyName: lambda-copier
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::rocketcx-resources*'
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${rLambdaZipsBucket}*'

  rCopyZipsFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Copies objects from a source S3 bucket to a destination
      Handler: index.handler
      Runtime: python3.7
      Role: !GetAtt 'rCopyZipsRole.Arn'
      Timeout: 240
      Code:
        ZipFile: |
          import json
          import logging
          import threading
          import boto3
          import cfnresponse
          def copy_objects(source_bucket, dest_bucket, objects):
              s3 = boto3.client('s3')
              for o in objects:
                  copy_source = {
                      'Bucket': source_bucket,
                      'Key': o
                  }
                  print('copy_source: %s' % copy_source)
                  print('dest_bucket = %s'%dest_bucket)
                  print('object = %s' %o)
                  s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                        Key=o)
          def delete_objects(bucket, objects):
              s3 = boto3.client('s3')
              objects = {'Objects': [{'Key': o} for o in objects]}
              s3.delete_objects(Bucket=bucket, Delete=objects)
          def timeout(event, context):
              logging.error('Execution is about to time out, sending failure response to CloudFormation')
              cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)
          def handler(event, context):
              # make sure we send a failure to CloudFormation if the function
              # is going to timeout
              timer = threading.Timer((context.get_remaining_time_in_millis()
                        / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()
              print('Received event: %s' % json.dumps(event))
              status = cfnresponse.SUCCESS
              try:
                  source_bucket = event['ResourceProperties']['SourceBucket']
                  dest_bucket = event['ResourceProperties']['DestBucket']
                  objects = event['ResourceProperties']['Objects']
                  if event['RequestType'] == 'Delete':
                      delete_objects(dest_bucket, objects)
                  else:
                      copy_objects(source_bucket, dest_bucket, objects)
              except Exception as e:
                  logging.error('Exception: %s' % e, exc_info=True)
                  status = cfnresponse.FAILED
              finally:
                  timer.cancel()
                  cfnresponse.send(event, context, status, {}, None)

  rLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  rGetCallerLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: get_caller
      Description: Lambda funciton to get caller details from ServiceNow DB.
      Handler: lambda_function.lambda_handler
      Environment:
        Variables:
          SERVICENOW_HOST: !Ref ServiceNowHostURL
          SERVICENOW_USER: !Ref ServiceNowUserName
          SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/get_caller.zip
      Role: !GetAtt rLambdaExecutionRole.Arn
      
  rGetCallerLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rGetCallerLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rGetRecordsLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: get_records
      Description: Lambda function to get record details from ServiceNow.
      Handler: lambda_function.lambda_handler
      Environment:
        Variables:
          SERVICENOW_HOST: !Ref ServiceNowHostURL
          SERVICENOW_USER: !Ref ServiceNowUserName
          SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/get_records.zip
      Role: !GetAtt rLambdaExecutionRole.Arn

  rGetRecordsLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rGetRecordsLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rSearchRecordLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: search_record
      Description: Lambda function to search record details in ServiceNow.
      Handler: lambda_function.lambda_handler
      Environment:
        Variables:
          SERVICENOW_HOST: !Ref ServiceNowHostURL
          SERVICENOW_USER: !Ref ServiceNowUserName
          SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/search_record.zip
      Role: !GetAtt rLambdaExecutionRole.Arn  
 
  rSearchRecordLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rSearchRecordLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rSurveyFeebbackLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: survey_feedback
      Description: Lambda function to update SNOW DB with collected feedback from customer
      Handler: lambda_function.lambda_handler
      Environment:
          Variables:
            SERVICENOW_HOST: !Ref ServiceNowHostURL
            SERVICENOW_USER: !Ref ServiceNowUserName
            SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/survey_feedback.zip
      Role: !GetAtt rLambdaExecutionRole.Arn  
 
  rSurveyFeebbackLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rSurveyFeebbackLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rS3APIPolicy:
    Type: AWS::IAM::Policy
    Condition: cPolicyDeployment
    Properties: 
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:ListBucket'
            Resource:
              - !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref CallRecordingS3BucketName
              - !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref CallRecordingS3BucketName
                    - '/*'
      PolicyName: !Join
                  - ''
                  - - 'cti_s3_api-'
                    - !Ref 'AWS::Region' 
      Users: 
        - !Ref 'IAMUserName'

  rConnectPolicy:
    Type: AWS::IAM::Policy
    Condition: cPolicyDeployment
    Properties: 
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'connect:GetMetricData'
              - 'connect:GetCurrentMetricData'
              - 'connect:UpdateContactAttributes'
              - 'connect:GetContactAttributes'
            Resource: !Ref 'AmazonConnectInstanceID'
      PolicyName: !Join
                  - ''
                  - - 'cti_connect_api-'
                    - !Ref 'AWS::Region' 
      Users: 
        - !Ref 'IAMUserName'

  rSTSPolicy:
    Type: AWS::IAM::Policy
    Condition: cPolicyDeployment
    Properties: 
      PolicyDocument:    
        Version: 2012-10-17
        Statement:
          - Effect: 'Allow'
            Action: 'sts:GetFederationToken'
            Resource: !Ref 'IAMUserName'
      PolicyName: !Join
                  - ''
                  - - 'cti_sts_api-'
                    - !Ref 'AWS::Region'
      Users: 
        - !Ref 'IAMUserName'

Outputs:

  GetCallerLambdaArn:
    Description: ARN for get_caller lambda.
    Value: !GetAtt rGetCallerLambda.Arn

  GetRecordsLambdaArn:
    Description: ARN for get_records lambda.
    Value: !GetAtt rGetRecordsLambda.Arn

  SearchRecordLambdaArn:
    Description: ARN for search_record lambda.
    Value: !GetAtt rSearchRecordLambda.Arn

  SurveyFeebbackLambdaArn:
    Description: ARN for survey_feedback lambda.
    Value: !GetAtt rSurveyFeebbackLambda.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/rocketcx.template.yaml [1:429]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: 2010-09-09

Description: RocketCX Enterprise Connector for ServiceNow Quickstart. (qs-1qji34a8u)

Transform: AWS::Serverless-2016-10-31

Metadata:

  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Amazon Connect configuration
        Parameters:
          - AmazonConnectInstanceID
      - Label:
          default: ServiceNow configuration
        Parameters:
          - ServiceNowHostURL
          - ServiceNowUserName
          - ServiceNowPassword
      - Label:
          default: Security configuration (optional)
        Parameters:     
          - IAMUserName
          - CallRecordingS3BucketName
    ParameterLabels:
      AmazonConnectInstanceID:
        default: "Amazon Connect ID"
      ServiceNowHostURL:
        default: "ServiceNow URL"
      ServiceNowUserName:
        default: "ServiceNow user name"
      ServiceNowPassword:
        default: "ServiceNow user password"
      IAMUserName:
        default: "Amazon Connect user name"
      CallRecordingS3BucketName:
        default: "Amazon Connect S3 bucket"
      

Parameters:

  AmazonConnectInstanceID:
    Description: Amazon Connect instance ID for integration with ServiceNow (maximum of 36 alphanumeric characters). This
                 ID is different from the Amazon Resource Name (ARN) ID.
    Type: String

  ServiceNowHostURL:
    AllowedPattern: ^https[://]+[a-zA-Z0-9-.]+[.]service-now.com/$
    ConstraintDescription: Endpoint must be a valid ServiceNow API Host URI.
    Description: Sample ServiceNow instance URL for Lambda data dip (https://example.service-now.com/).
    Type: String
    
  ServiceNowUserName:
    Description: ServiceNow user name for Lambda data dip. The user must have API-invoke access permissions for the ServiceNow instance.
    Type: String

  ServiceNowPassword:
    Description: ServiceNow password for Lambda data dip. The user must have API-invoke access permissions for the ServiceNow instance.
    NoEcho: true
    Type: String

  IAMUserName:
    Description: (Optional) Name of IAM user for accessing Amazon Connect statistics and call recordings.
    Type: String

  CallRecordingS3BucketName:
    Description: (Optional) Name of S3 bucket that stores Amazon Connect call recordings.
    Type: String


Globals:

  Function:
    Runtime: python3.7
    Timeout: 15


Conditions: 

  cCallRecordingS3BucketName: !Not [!Equals [!Ref CallRecordingS3BucketName, ""]]
  cIAMUserName: !Not [!Equals [!Ref IAMUserName, ""]]
  cPolicyDeployment: !And
    - !Condition cCallRecordingS3BucketName
    - !Condition cIAMUserName

    
Resources:

  rLambdaZipsBucket:
    Type: AWS::S3::Bucket

  rCopyZips:
    Type: Custom::CopyZips
    Properties:
      ServiceToken: !GetAtt 'rCopyZipsFunction.Arn'
      DestBucket: !Ref 'rLambdaZipsBucket'
      SourceBucket: 'rocketcx-resources'
      Objects:
        - EnterpriseConnectorServiceNow/lambda/Package/get_caller.zip
        - EnterpriseConnectorServiceNow/lambda/Package/get_records.zip
        - EnterpriseConnectorServiceNow/lambda/Package/search_record.zip
        - EnterpriseConnectorServiceNow/lambda/Package/survey_feedback.zip

  rCopyZipsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns: 
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Path: /
      Policies:
        - PolicyName: lambda-copier
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::rocketcx-resources*'
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${rLambdaZipsBucket}*'

  rCopyZipsFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Copies objects from a source S3 bucket to a destination
      Handler: index.handler
      Runtime: python3.7
      Role: !GetAtt 'rCopyZipsRole.Arn'
      Timeout: 240
      Code:
        ZipFile: |
          import json
          import logging
          import threading
          import boto3
          import cfnresponse
          def copy_objects(source_bucket, dest_bucket, objects):
              s3 = boto3.client('s3')
              for o in objects:
                  copy_source = {
                      'Bucket': source_bucket,
                      'Key': o
                  }
                  print('copy_source: %s' % copy_source)
                  print('dest_bucket = %s'%dest_bucket)
                  print('object = %s' %o)
                  s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                        Key=o)
          def delete_objects(bucket, objects):
              s3 = boto3.client('s3')
              objects = {'Objects': [{'Key': o} for o in objects]}
              s3.delete_objects(Bucket=bucket, Delete=objects)
          def timeout(event, context):
              logging.error('Execution is about to time out, sending failure response to CloudFormation')
              cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)
          def handler(event, context):
              # make sure we send a failure to CloudFormation if the function
              # is going to timeout
              timer = threading.Timer((context.get_remaining_time_in_millis()
                        / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()
              print('Received event: %s' % json.dumps(event))
              status = cfnresponse.SUCCESS
              try:
                  source_bucket = event['ResourceProperties']['SourceBucket']
                  dest_bucket = event['ResourceProperties']['DestBucket']
                  objects = event['ResourceProperties']['Objects']
                  if event['RequestType'] == 'Delete':
                      delete_objects(dest_bucket, objects)
                  else:
                      copy_objects(source_bucket, dest_bucket, objects)
              except Exception as e:
                  logging.error('Exception: %s' % e, exc_info=True)
                  status = cfnresponse.FAILED
              finally:
                  timer.cancel()
                  cfnresponse.send(event, context, status, {}, None)

  rLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  rGetCallerLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: get_caller
      Description: Lambda funciton to get caller details from ServiceNow DB.
      Handler: lambda_function.lambda_handler
      Environment:
        Variables:
          SERVICENOW_HOST: !Ref ServiceNowHostURL
          SERVICENOW_USER: !Ref ServiceNowUserName
          SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/get_caller.zip
      Role: !GetAtt rLambdaExecutionRole.Arn
      
  rGetCallerLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rGetCallerLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rGetRecordsLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: get_records
      Description: Lambda function to get record details from ServiceNow.
      Handler: lambda_function.lambda_handler
      Environment:
        Variables:
          SERVICENOW_HOST: !Ref ServiceNowHostURL
          SERVICENOW_USER: !Ref ServiceNowUserName
          SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/get_records.zip
      Role: !GetAtt rLambdaExecutionRole.Arn

  rGetRecordsLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rGetRecordsLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rSearchRecordLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: search_record
      Description: Lambda function to search record details in ServiceNow.
      Handler: lambda_function.lambda_handler
      Environment:
        Variables:
          SERVICENOW_HOST: !Ref ServiceNowHostURL
          SERVICENOW_USER: !Ref ServiceNowUserName
          SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/search_record.zip
      Role: !GetAtt rLambdaExecutionRole.Arn  
 
  rSearchRecordLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rSearchRecordLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rSurveyFeebbackLambda:
    DependsOn: rCopyZips
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: survey_feedback
      Description: Lambda function to update SNOW DB with collected feedback from customer
      Handler: lambda_function.lambda_handler
      Environment:
          Variables:
            SERVICENOW_HOST: !Ref ServiceNowHostURL
            SERVICENOW_USER: !Ref ServiceNowUserName
            SERVICENOW_PASSWORD: !Ref ServiceNowPassword
      CodeUri:
        Bucket: !Ref rLambdaZipsBucket
        Key: EnterpriseConnectorServiceNow/lambda/Package/survey_feedback.zip
      Role: !GetAtt rLambdaExecutionRole.Arn  
 
  rSurveyFeebbackLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rSurveyFeebbackLambda.Arn
      Action: 'lambda:InvokeFunction'
      Principal: connect.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: 
        !Join
          - ''
          - - 'arn:aws:connect:'
            - !Ref 'AWS::Region'
            - ':'
            - !Ref 'AWS::AccountId'
            - ':'
            - 'instance/'
            - !Ref 'AmazonConnectInstanceID'

  rS3APIPolicy:
    Type: AWS::IAM::Policy
    Condition: cPolicyDeployment
    Properties: 
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:ListBucket'
            Resource:
              - !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref CallRecordingS3BucketName
              - !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref CallRecordingS3BucketName
                    - '/*'
      PolicyName: !Join
                  - ''
                  - - 'cti_s3_api-'
                    - !Ref 'AWS::Region' 
      Users: 
        - !Ref 'IAMUserName'

  rConnectPolicy:
    Type: AWS::IAM::Policy
    Condition: cPolicyDeployment
    Properties: 
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'connect:GetMetricData'
              - 'connect:GetCurrentMetricData'
              - 'connect:UpdateContactAttributes'
              - 'connect:GetContactAttributes'
            Resource: !Ref 'AmazonConnectInstanceID'
      PolicyName: !Join
                  - ''
                  - - 'cti_connect_api-'
                    - !Ref 'AWS::Region' 
      Users: 
        - !Ref 'IAMUserName'

  rSTSPolicy:
    Type: AWS::IAM::Policy
    Condition: cPolicyDeployment
    Properties: 
      PolicyDocument:    
        Version: 2012-10-17
        Statement:
          - Effect: 'Allow'
            Action: 'sts:GetFederationToken'
            Resource: !Ref 'IAMUserName'
      PolicyName: !Join
                  - ''
                  - - 'cti_sts_api-'
                    - !Ref 'AWS::Region'
      Users: 
        - !Ref 'IAMUserName'

Outputs:

  GetCallerLambdaArn:
    Description: ARN for get_caller lambda.
    Value: !GetAtt rGetCallerLambda.Arn

  GetRecordsLambdaArn:
    Description: ARN for get_records lambda.
    Value: !GetAtt rGetRecordsLambda.Arn

  SearchRecordLambdaArn:
    Description: ARN for search_record lambda.
    Value: !GetAtt rSearchRecordLambda.Arn

  SurveyFeebbackLambdaArn:
    Description: ARN for survey_feedback lambda.
    Value: !GetAtt rSurveyFeebbackLambda.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



