template/master-fullstack-with-lambda-warmers.yaml [935:1256]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Role:
        Fn::GetAtt: [ bookstoreNeptuneLoaderLambdaRole, Arn ]
      Runtime: python3.6
      Timeout: 180
      VpcConfig:
        SecurityGroupIds:
          - Ref: bookstoreNeptuneSecurityGroup
        SubnetIds:
          - Ref: bookstoreSubnet1
          - Ref: bookstoreSubnet2
  bookstoreNeptuneLoaderLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /

# ---------- ROLES FOR DYNAMODB ---------
  DynamoDbRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-DynamoDbLambda'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
      Policies:
        - PolicyName: PutRidePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'dynamodb:PutItem'
                  - 'dynamodb:Query'
                  - 'dynamodb:UpdateTable'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:BatchWriteItem'
                  - 'dynamodb:GetItem'
                  - 'dynamodb:Scan'
                  - 'dynamodb:DeleteItem'
                Resource:
                  - !GetAtt 
                    - TBooks
                    - Arn
                  - !GetAtt 
                    - TOrders
                    - Arn
                  - !GetAtt 
                    - TCart
                    - Arn
                  - !Join 
                    - ''
                    - - !GetAtt 
                        - TBooks
                        - Arn
                      - /*
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 07b29683-0ea5-44bf-a439-fcb89713fd09

# ---------- ROLES FOR NEPTUNE ---------        
  RecommendationsLambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-RecommendationsLambdaRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
        - PolicyName: RecommendationsLambdaRoleEC2
          PolicyDocument:
            Statement:
              - Action:
                  - 'ec2:CreateNetworkInterface'
                  - 'ec2:DescribeNetworkInterfaces'
                  - 'ec2:DeleteNetworkInterface'
                  - 'ec2:DetachNetworkInterface'
                Effect: Allow
                Resource: '*'
            Version: 2012-10-17

# ---------- DYNAMODB TABLES DEFINITIONS ---------
  TBooks:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Books'
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: category
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      GlobalSecondaryIndexes:
        - IndexName: category-index
          KeySchema:
            - AttributeName: category
              KeyType: HASH
          Projection:
            ProjectionType: ALL
          ProvisionedThroughput:
            ReadCapacityUnits: 1
            WriteCapacityUnits: 1
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 9de25578-c943-42f5-9ec7-7a5258c7771a
  TOrders:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Orders'
      AttributeDefinitions:
        - AttributeName: customerId
          AttributeType: S
        - AttributeName: orderId
          AttributeType: S
      KeySchema:
        - AttributeName: customerId
          KeyType: HASH
        - AttributeName: orderId
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES  
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 57fb3162-6a2d-4651-a9c8-7404e82181e8
  TCart:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Cart'
      AttributeDefinitions:
        - AttributeName: customerId
          AttributeType: S
        - AttributeName: bookId
          AttributeType: S
      KeySchema:
        - AttributeName: customerId
          KeyType: HASH
        - AttributeName: bookId
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
    Metadata:
      'AWS::CloudFormation::Designer':
        id: e1a45038-ec76-464d-91b5-6b31bc325fa7
# ---------- ELASTICSEARCH ROLES DEFINITIONS ---------        
  ESSearchRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-ESSearchRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
      Policies:
        - PolicyName: !Sub '${ProjectName}-lambda-policy'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'es:ESHttpPost'
                  - 'es:ESHttpGet'
                Resource: !Join 
                  - ''
                  - - 'arn:aws:es:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':'
                    - domain/
                    - !Ref ElasticsearchDomain
                    - /*
              - Effect: Allow
                Action:
                  - 's3:ListBucket'
                  - 's3:GetObject'
                Resource: !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !FindInMap 
                      - S3Buckets
                      - !Ref 'AWS::Region'
                      - Bucket
                    - /*
              - Effect: Allow
                Action:
                  - 'dynamodb:DescribeStream'
                  - 'dynamodb:GetRecords'
                  - 'dynamodb:GetShardIterator'
                  - 'dynamodb:ListStreams'
                Resource:
                  - !GetAtt 
                    - TBooks
                    - Arn
                  - !Join 
                    - ''
                    - - !GetAtt 
                        - TBooks
                        - Arn
                      - /stream/*
  ElasticsearchDomain:
    Type: 'AWS::Elasticsearch::Domain'
    DependsOn:
      - ESRoleCreator
    Properties:
      DomainName: !Sub '${ProjectName}-domain'
      ElasticsearchVersion: 6.2
      ElasticsearchClusterConfig:
        DedicatedMasterEnabled: 'false'
        InstanceCount: '1'
        ZoneAwarenessEnabled: 'false'
        InstanceType: t2.small.elasticsearch
      VPCOptions:
        SubnetIds:
          - Ref: bookstoreSubnet1
      EBSOptions:
        EBSEnabled: true
        Iops: 0
        VolumeSize: 10
        VolumeType: gp2
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: '*'
            Action:
              - 'es:*'
            Resource: !Join 
              - ''
              - - 'arn:aws:es:'
                - !Ref 'AWS::Region'
                - ':'
                - !Ref 'AWS::AccountId'
                - ':'
                - domain/
                - !Sub '${ProjectName}-domain'
                - /*
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: true

# ---------- ROLES FOR ELASTICACHE ---------  
  RedisRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-RedisRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
        - 'arn:aws:iam::aws:policy/AWSLambdaInvocation-DynamoDB'

# ---------- ELASTICACHE DEFINITIONS ---------         
  ElastiCacheCluster:
    DependsOn: 
     - bookstoreCacheSubnets
     - bookstoreCacheSecurityGroup
    Type: 'AWS::ElastiCache::CacheCluster'
    Properties:
      ClusterName: !Sub '${ProjectName}-cluster'
      CacheNodeType: cache.t2.micro
      NumCacheNodes: '1'
      Engine: redis
      CacheSubnetGroupName: !Ref bookstoreCacheSubnets
      VpcSecurityGroupIds:
        - Fn::GetAtt:
          - bookstoreCacheSecurityGroup
          - 'GroupId'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



template/master-fullstack.yaml [451:772]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Role:
        Fn::GetAtt: [ bookstoreNeptuneLoaderLambdaRole, Arn ]
      Runtime: python3.6
      Timeout: 180
      VpcConfig:
        SecurityGroupIds:
          - Ref: bookstoreNeptuneSecurityGroup
        SubnetIds:
          - Ref: bookstoreSubnet1
          - Ref: bookstoreSubnet2
  bookstoreNeptuneLoaderLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /

# ---------- ROLES FOR DYNAMODB ---------
  DynamoDbRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-DynamoDbLambda'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
      Policies:
        - PolicyName: PutRidePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'dynamodb:PutItem'
                  - 'dynamodb:Query'
                  - 'dynamodb:UpdateTable'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:BatchWriteItem'
                  - 'dynamodb:GetItem'
                  - 'dynamodb:Scan'
                  - 'dynamodb:DeleteItem'
                Resource:
                  - !GetAtt 
                    - TBooks
                    - Arn
                  - !GetAtt 
                    - TOrders
                    - Arn
                  - !GetAtt 
                    - TCart
                    - Arn
                  - !Join 
                    - ''
                    - - !GetAtt 
                        - TBooks
                        - Arn
                      - /*
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 07b29683-0ea5-44bf-a439-fcb89713fd09

# ---------- ROLES FOR NEPTUNE ---------        
  RecommendationsLambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-RecommendationsLambdaRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
        - PolicyName: RecommendationsLambdaRoleEC2
          PolicyDocument:
            Statement:
              - Action:
                  - 'ec2:CreateNetworkInterface'
                  - 'ec2:DescribeNetworkInterfaces'
                  - 'ec2:DeleteNetworkInterface'
                  - 'ec2:DetachNetworkInterface'
                Effect: Allow
                Resource: '*'
            Version: 2012-10-17

# ---------- DYNAMODB TABLES DEFINITIONS ---------
  TBooks:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Books'
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: category
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      GlobalSecondaryIndexes:
        - IndexName: category-index
          KeySchema:
            - AttributeName: category
              KeyType: HASH
          Projection:
            ProjectionType: ALL
          ProvisionedThroughput:
            ReadCapacityUnits: 1
            WriteCapacityUnits: 1
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 9de25578-c943-42f5-9ec7-7a5258c7771a
  TOrders:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Orders'
      AttributeDefinitions:
        - AttributeName: customerId
          AttributeType: S
        - AttributeName: orderId
          AttributeType: S
      KeySchema:
        - AttributeName: customerId
          KeyType: HASH
        - AttributeName: orderId
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES  
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 57fb3162-6a2d-4651-a9c8-7404e82181e8
  TCart:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Cart'
      AttributeDefinitions:
        - AttributeName: customerId
          AttributeType: S
        - AttributeName: bookId
          AttributeType: S
      KeySchema:
        - AttributeName: customerId
          KeyType: HASH
        - AttributeName: bookId
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
    Metadata:
      'AWS::CloudFormation::Designer':
        id: e1a45038-ec76-464d-91b5-6b31bc325fa7
# ---------- ELASTICSEARCH ROLES DEFINITIONS ---------        
  ESSearchRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-ESSearchRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
      Policies:
        - PolicyName: !Sub '${ProjectName}-lambda-policy'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'es:ESHttpPost'
                  - 'es:ESHttpGet'
                Resource: !Join 
                  - ''
                  - - 'arn:aws:es:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':'
                    - domain/
                    - !Ref ElasticsearchDomain
                    - /*
              - Effect: Allow
                Action:
                  - 's3:ListBucket'
                  - 's3:GetObject'
                Resource: !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !FindInMap 
                      - S3Buckets
                      - !Ref 'AWS::Region'
                      - Bucket
                    - /*
              - Effect: Allow
                Action:
                  - 'dynamodb:DescribeStream'
                  - 'dynamodb:GetRecords'
                  - 'dynamodb:GetShardIterator'
                  - 'dynamodb:ListStreams'
                Resource:
                  - !GetAtt 
                    - TBooks
                    - Arn
                  - !Join 
                    - ''
                    - - !GetAtt 
                        - TBooks
                        - Arn
                      - /stream/*
  ElasticsearchDomain:
    Type: 'AWS::Elasticsearch::Domain'
    DependsOn:
      - ESRoleCreator
    Properties:
      DomainName: !Sub '${ProjectName}-domain'
      ElasticsearchVersion: 6.2
      ElasticsearchClusterConfig:
        DedicatedMasterEnabled: 'false'
        InstanceCount: '1'
        ZoneAwarenessEnabled: 'false'
        InstanceType: t2.small.elasticsearch
      VPCOptions:
        SubnetIds:
          - Ref: bookstoreSubnet1
      EBSOptions:
        EBSEnabled: true
        Iops: 0
        VolumeSize: 10
        VolumeType: gp2
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: '*'
            Action:
              - 'es:*'
            Resource: !Join 
              - ''
              - - 'arn:aws:es:'
                - !Ref 'AWS::Region'
                - ':'
                - !Ref 'AWS::AccountId'
                - ':'
                - domain/
                - !Sub '${ProjectName}-domain'
                - /*
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: true

# ---------- ROLES FOR ELASTICACHE ---------  
  RedisRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-RedisRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
        - 'arn:aws:iam::aws:policy/AWSLambdaInvocation-DynamoDB'

# ---------- ELASTICACHE DEFINITIONS ---------         
  ElastiCacheCluster:
    DependsOn: 
     - bookstoreCacheSubnets
     - bookstoreCacheSecurityGroup
    Type: 'AWS::ElastiCache::CacheCluster'
    Properties:
      ClusterName: !Sub '${ProjectName}-cluster'
      CacheNodeType: cache.t2.micro
      NumCacheNodes: '1'
      Engine: redis
      CacheSubnetGroupName: !Ref bookstoreCacheSubnets
      VpcSecurityGroupIds:
        - Fn::GetAtt:
          - bookstoreCacheSecurityGroup
          - 'GroupId'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



