template/master-fullstack-with-lambda-warmers.yaml [813:901]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      MemorySize: 128
      Role:
        Fn::GetAtt: [ bookstoreNeptuneIAMAttachLambdaRole, Arn ]
      Runtime: python3.6
      Timeout: 30


# ---------- VPC ENDPOINT FOR NEPTUNE BULK LOADER ACCESS TO S3 ---------

  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: '*'
            Action:
              - 's3:Get*'
              - 's3:PutObject'
              - 's3:List*'
            Resource:
              - '*'
      RouteTableIds:
        - !Ref bookstoreVPCRouteTable
      ServiceName: !Join [ "" , [ "com.amazonaws.", !Ref "AWS::Region", ".s3"]]
      VpcId: !Ref bookstoreVPC

# ---------- CUSTOM RESOURCE TO INITIATE NEPTUNE BULK LOAD PROCESS ---------
  bookstoreNeptuneLoader: 
    DependsOn:
      - bookstoreNeptuneLoaderLambdaRoleCloudWatchStream
      - bookstoreNeptuneLoaderLambdaRoleCloudWatchGroup
      - bookstoreNeptuneLoaderLambdaRoleEC2
      - bookstoreNeptuneLoaderLambdaRole      
      - bookstoreNeptuneLoaderLambda
      - bookstoreNeptuneLoaderS3ReadPolicy
      - bookstoreNeptuneLoaderS3ReadRole
      - S3Endpoint
    Type: "Custom::NeptuneLoader"
    Properties: 
      ServiceToken:
        Fn::GetAtt: [ bookstoreNeptuneLoaderLambda, Arn]

  bookstoreNeptuneLoaderLambdaRoleCloudWatchStream:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":log-group:/aws/lambda/",  !Ref bookstoreNeptuneLoaderLambda, ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderLambdaRoleCloudWatchStream
      Roles:
      - Ref: bookstoreNeptuneLoaderLambdaRole
  bookstoreNeptuneLoaderLambdaRoleCloudWatchGroup:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogGroup
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderLambdaRoleCloudWatchGroup
      Roles:
      - Ref: bookstoreNeptuneLoaderLambdaRole
  bookstoreNeptuneLoaderLambdaRoleEC2:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - ec2:CreateNetworkInterface
          - ec2:DescribeNetworkInterfaces
          - ec2:DeleteNetworkInterface
          - ec2:DetachNetworkInterface          
          Effect: Allow
          Resource: "*"
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderLambdaRoleEC2
      Roles:
      - Ref: bookstoreNeptuneLoaderLambdaRole
  bookstoreNeptuneLoaderLambda:
    Type: AWS::Lambda::Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



template/master-fullstack.yaml [325:413]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      MemorySize: 128
      Role:
        Fn::GetAtt: [ bookstoreNeptuneIAMAttachLambdaRole, Arn ]
      Runtime: python3.6
      Timeout: 30


# ---------- VPC ENDPOINT FOR NEPTUNE BULK LOADER ACCESS TO S3 ---------

  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: '*'
            Action:
              - 's3:Get*'
              - 's3:PutObject'
              - 's3:List*'
            Resource:
              - '*'
      RouteTableIds:
        - !Ref bookstoreVPCRouteTable
      ServiceName: !Join [ "" , [ "com.amazonaws.", !Ref "AWS::Region", ".s3"]]
      VpcId: !Ref bookstoreVPC

# ---------- CUSTOM RESOURCE TO INITIATE NEPTUNE BULK LOAD PROCESS ---------
  bookstoreNeptuneLoader: 
    DependsOn:
      - bookstoreNeptuneLoaderLambdaRoleCloudWatchStream
      - bookstoreNeptuneLoaderLambdaRoleCloudWatchGroup
      - bookstoreNeptuneLoaderLambdaRoleEC2
      - bookstoreNeptuneLoaderLambdaRole      
      - bookstoreNeptuneLoaderLambda
      - bookstoreNeptuneLoaderS3ReadPolicy
      - bookstoreNeptuneLoaderS3ReadRole
      - S3Endpoint
    Type: "Custom::NeptuneLoader"
    Properties: 
      ServiceToken:
        Fn::GetAtt: [ bookstoreNeptuneLoaderLambda, Arn]

  bookstoreNeptuneLoaderLambdaRoleCloudWatchStream:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":log-group:/aws/lambda/",  !Ref bookstoreNeptuneLoaderLambda, ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderLambdaRoleCloudWatchStream
      Roles:
      - Ref: bookstoreNeptuneLoaderLambdaRole
  bookstoreNeptuneLoaderLambdaRoleCloudWatchGroup:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogGroup
          Effect: Allow
          Resource: !Join [ "", [ "arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId" , ":*" ]]
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderLambdaRoleCloudWatchGroup
      Roles:
      - Ref: bookstoreNeptuneLoaderLambdaRole
  bookstoreNeptuneLoaderLambdaRoleEC2:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - ec2:CreateNetworkInterface
          - ec2:DescribeNetworkInterfaces
          - ec2:DeleteNetworkInterface
          - ec2:DetachNetworkInterface          
          Effect: Allow
          Resource: "*"
        Version: '2012-10-17'
      PolicyName: bookstoreNeptuneLoaderLambdaRoleEC2
      Roles:
      - Ref: bookstoreNeptuneLoaderLambdaRole
  bookstoreNeptuneLoaderLambda:
    Type: AWS::Lambda::Function
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



