template/master-fullstack-with-lambda-warmers.yaml [591:812]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  bookstoreVPCRouteTable:  
    Type: AWS::EC2::RouteTable
    Properties: 
      VpcId: !Ref bookstoreVPC
  
  bookstoreVPCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: 
      RouteTableId: !Ref bookstoreVPCRouteTable
      SubnetId: !Ref bookstoreSubnet1

  bookstoreVPCRouteTableAssociationTwo:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: 
      RouteTableId: !Ref bookstoreVPCRouteTable
      SubnetId: !Ref bookstoreSubnet2    
    
  bookstoreNeptuneSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Security group for Neptune DB within book store app."
      SecurityGroupIngress:
        -
          CidrIp: "0.0.0.0/0"
          FromPort: 8182
          ToPort: 8182
          IpProtocol: tcp
      VpcId:
        Ref: bookstoreVPC

  bookstoreNeptuneSubnetGroup:
    Type: "AWS::Neptune::DBSubnetGroup"
    Properties:
      DBSubnetGroupDescription: "Subnet group for Neptune DB within book store app."
      SubnetIds:
        - !Ref bookstoreSubnet1
        - !Ref bookstoreSubnet2

  redisLambdaSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId:
        Ref: bookstoreVPC
      GroupDescription: "A component security group allowing access only to redis"  

  bookstoreCacheSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Elasticache security group
      SecurityGroupIngress:
        -
          IpProtocol: "tcp"
          FromPort: "6379"
          ToPort: "6379"
          SourceSecurityGroupId:
            Ref: redisLambdaSecurityGroup
      VpcId: !Ref bookstoreVPC

  bookstoreCacheSubnets:
    Type: 'AWS::ElastiCache::SubnetGroup'
    Properties:
      Description: Subnets for ElastiCache
      SubnetIds:
        - Ref: bookstoreSubnet1        
  
  # ---------- NEPTUNE CLUSTER DEFINITION ---------

  bookstoreNeptuneCluster:
    Type: "AWS::Neptune::DBCluster"
    Properties:
      IamAuthEnabled : false
      DBSubnetGroupName:
        Ref: bookstoreNeptuneSubnetGroup
      VpcSecurityGroupIds: [ !GetAtt bookstoreNeptuneSecurityGroup.GroupId ]
  bookstoreNeptuneDB:
    Type: "AWS::Neptune::DBInstance"
    Properties:
      DBClusterIdentifier: !Ref bookstoreNeptuneCluster
      DBInstanceClass: "db.r4.large"

# ---------- IAM ROLE ATTACH FOR S3 BULK LOAD ------------

  bookstoreNeptuneLoaderS3ReadPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - s3:Get*
          - s3:List*
          Effect: Allow
          Resource: "*"
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderS3ReadPolicy
      Roles:
      - Ref: bookstoreNeptuneLoaderS3ReadRole
  bookstoreNeptuneLoaderS3ReadRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - rds.amazonaws.com
        Version: '2012-10-17'
      Path: /

  # ---------- CUSTOM CLOUDFORMATION RESOURCE FOR ATTACHING S3 READ ROLE TO NEPTUNE CLUSTER ---------

  bookstoreNeptuneIAMAttach:
    DependsOn: 
      - bookstoreNeptuneIAMAttachLambdaRoleCloudWatchStream
      - bookstoreNeptuneIAMAttachLambdaRoleCloudWatchGroup
      - bookstoreNeptuneIAMAttachLambdaRoleEC2
      - bookstoreNeptuneIAMAttachLambdaRoleRDS
      - bookstoreNeptuneIAMAttachLambdaRole
      - bookstoreNeptuneIAMAttachLambda
      - bookstoreNeptuneLoaderS3ReadPolicy
      - bookstoreNeptuneLoaderS3ReadRole
    Type: Custom::NeptuneIAMAttach
    Properties: 
      ServiceToken:
        Fn::GetAtt: [ bookstoreNeptuneIAMAttachLambda, Arn ]
      NeptuneDB: !Ref bookstoreNeptuneCluster
      IAMRole: 
        Fn::GetAtt: [ bookstoreNeptuneLoaderS3ReadRole, Arn ]
      Region: !Ref 'AWS::Region'
  bookstoreNeptuneIAMAttachLambdaRoleCloudWatchStream:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":log-group:/aws/lambda/",  !Ref bookstoreNeptuneIAMAttachLambda, ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleCloudWatchStream
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRoleCloudWatchGroup:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogGroup
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleCloudWatchGroup
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRoleEC2:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - ec2:CreateNetworkInterface
          - ec2:DescribeNetworkInterfaces
          - ec2:DeleteNetworkInterface
          - ec2:DetachNetworkInterface
          Effect: Allow
          Resource: "*"
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleEC2
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRoleRDS:
    DependsOn: bookstoreNeptuneDB
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - 
            Action:
              - rds:AddRoleToDBCluster
              - rds:DescribeDBClusters
            Effect: Allow
            Resource:
              - "*"
          - 
            Action:
              - iam:PassRole
            Effect: Allow
            Resource:
              - Fn::GetAtt: [ bookstoreNeptuneLoaderS3ReadRole, Arn ]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleRDS
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /
  bookstoreNeptuneIAMAttachLambda:
    Type: AWS::Lambda::Function
    DependsOn: bookstoreNeptuneDB
    Properties:
      Code:
        S3Bucket: !FindInMap 
                    - S3Buckets
                    - !Ref 'AWS::Region'
                    - Bucket
        S3Key: !FindInMap 
                 - Constants
                 - S3Keys
                 - NeptuneIAMCode
      Description: 'Lambda function to add an IAM policy to a Neptune cluster to allow for bulk load.'
      Handler: lambda_function.lambda_handler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



template/master-fullstack.yaml [101:322]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  bookstoreVPCRouteTable:  
    Type: AWS::EC2::RouteTable
    Properties: 
      VpcId: !Ref bookstoreVPC
  
  bookstoreVPCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: 
      RouteTableId: !Ref bookstoreVPCRouteTable
      SubnetId: !Ref bookstoreSubnet1

  bookstoreVPCRouteTableAssociationTwo:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: 
      RouteTableId: !Ref bookstoreVPCRouteTable
      SubnetId: !Ref bookstoreSubnet2    
    
  bookstoreNeptuneSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Security group for Neptune DB within book store app."
      SecurityGroupIngress:
        -
          CidrIp: "0.0.0.0/0"
          FromPort: 8182
          ToPort: 8182
          IpProtocol: tcp
      VpcId:
        Ref: bookstoreVPC

  bookstoreNeptuneSubnetGroup:
    Type: "AWS::Neptune::DBSubnetGroup"
    Properties:
      DBSubnetGroupDescription: "Subnet group for Neptune DB within book store app."
      SubnetIds:
        - !Ref bookstoreSubnet1
        - !Ref bookstoreSubnet2

  redisLambdaSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId:
        Ref: bookstoreVPC
      GroupDescription: "A component security group allowing access only to redis"  

  bookstoreCacheSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Elasticache security group
      SecurityGroupIngress:
        -
          IpProtocol: "tcp"
          FromPort: "6379"
          ToPort: "6379"
          SourceSecurityGroupId:
            Ref: redisLambdaSecurityGroup
      VpcId: !Ref bookstoreVPC

  bookstoreCacheSubnets:
    Type: 'AWS::ElastiCache::SubnetGroup'
    Properties:
      Description: Subnets for ElastiCache
      SubnetIds:
        - Ref: bookstoreSubnet1        
  
  # ---------- NEPTUNE CLUSTER DEFINITION ---------

  bookstoreNeptuneCluster:
    Type: "AWS::Neptune::DBCluster"
    Properties:
      IamAuthEnabled : false
      DBSubnetGroupName:
        Ref: bookstoreNeptuneSubnetGroup
      VpcSecurityGroupIds: [ !GetAtt bookstoreNeptuneSecurityGroup.GroupId ]
  bookstoreNeptuneDB:
    Type: "AWS::Neptune::DBInstance"
    Properties:
      DBClusterIdentifier: !Ref bookstoreNeptuneCluster
      DBInstanceClass: "db.r4.large"

# ---------- IAM ROLE ATTACH FOR S3 BULK LOAD ------------

  bookstoreNeptuneLoaderS3ReadPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - s3:Get*
          - s3:List*
          Effect: Allow
          Resource: "*"
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderS3ReadPolicy
      Roles:
      - Ref: bookstoreNeptuneLoaderS3ReadRole
  bookstoreNeptuneLoaderS3ReadRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - rds.amazonaws.com
        Version: '2012-10-17'
      Path: /

  # ---------- CUSTOM CLOUDFORMATION RESOURCE FOR ATTACHING S3 READ ROLE TO NEPTUNE CLUSTER ---------

  bookstoreNeptuneIAMAttach:
    DependsOn: 
      - bookstoreNeptuneIAMAttachLambdaRoleCloudWatchStream
      - bookstoreNeptuneIAMAttachLambdaRoleCloudWatchGroup
      - bookstoreNeptuneIAMAttachLambdaRoleEC2
      - bookstoreNeptuneIAMAttachLambdaRoleRDS
      - bookstoreNeptuneIAMAttachLambdaRole
      - bookstoreNeptuneIAMAttachLambda
      - bookstoreNeptuneLoaderS3ReadPolicy
      - bookstoreNeptuneLoaderS3ReadRole
    Type: Custom::NeptuneIAMAttach
    Properties: 
      ServiceToken:
        Fn::GetAtt: [ bookstoreNeptuneIAMAttachLambda, Arn ]
      NeptuneDB: !Ref bookstoreNeptuneCluster
      IAMRole: 
        Fn::GetAtt: [ bookstoreNeptuneLoaderS3ReadRole, Arn ]
      Region: !Ref 'AWS::Region'
  bookstoreNeptuneIAMAttachLambdaRoleCloudWatchStream:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":log-group:/aws/lambda/",  !Ref bookstoreNeptuneIAMAttachLambda, ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleCloudWatchStream
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRoleCloudWatchGroup:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogGroup
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleCloudWatchGroup
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRoleEC2:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - ec2:CreateNetworkInterface
          - ec2:DescribeNetworkInterfaces
          - ec2:DeleteNetworkInterface
          - ec2:DetachNetworkInterface
          Effect: Allow
          Resource: "*"
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleEC2
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRoleRDS:
    DependsOn: bookstoreNeptuneDB
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - 
            Action:
              - rds:AddRoleToDBCluster
              - rds:DescribeDBClusters
            Effect: Allow
            Resource:
              - "*"
          - 
            Action:
              - iam:PassRole
            Effect: Allow
            Resource:
              - Fn::GetAtt: [ bookstoreNeptuneLoaderS3ReadRole, Arn ]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneIAMAttachLambdaRoleRDS
      Roles:
      - Ref: bookstoreNeptuneIAMAttachLambdaRole
  bookstoreNeptuneIAMAttachLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /
  bookstoreNeptuneIAMAttachLambda:
    Type: AWS::Lambda::Function
    DependsOn: bookstoreNeptuneDB
    Properties:
      Code:
        S3Bucket: !FindInMap 
                    - S3Buckets
                    - !Ref 'AWS::Region'
                    - Bucket
        S3Key: !FindInMap 
                 - Constants
                 - S3Keys
                 - NeptuneIAMCode
      Description: 'Lambda function to add an IAM policy to a Neptune cluster to allow for bulk load.'
      Handler: lambda_function.lambda_handler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



