aws-cloudformation/centralized_architecture/CentralizedArchitectureTgw.yaml [357:435]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !GetAtt TgwApplianceModeLogGroup.Arn
              - Effect: Allow
                Action:
                  - ec2:ModifyTransitGatewayVpcAttachment
                  - ec2:DescribeTransitGatewayVpcAttachments
                Resource: "*"

# Enable Transit Gateway Appliance Mode Lambda Custom Resource:
  TgwApplianceModeLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
        LogGroupName: !Sub /aws/lambda/${AWS::StackName}-tgw-appliancemode
        RetentionInDays: 1

  TgwApplianceMode:
    Type: AWS::Lambda::Function
    DependsOn: TgwApplianceModeLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-tgw-appliancemode
      Handler: "index.handler"
      Role: !GetAtt TgwLambdaExecutionRole.Arn
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import json
          import logging

          def handler(event, context):
              logger = logging.getLogger()
              logger.setLevel(logging.INFO)
              responseData = {}
              responseStatus = cfnresponse.FAILED
              logger.info('Received event: {}'.format(json.dumps(event)))
              if event["RequestType"] == "Delete":
                  responseStatus = cfnresponse.SUCCESS
                  cfnresponse.send(event, context, responseStatus, responseData)
              if event["RequestType"] == "Create":
                  try:
                      TgwInspectionVpcAttachmentId = event["ResourceProperties"]["TgwInspectionVpcAttachmentId"]
                      ApplianceMode = event["ResourceProperties"]["ApplianceMode"]
                  except Exception as e:
                      logger.info('Key retrieval failure: {}'.format(e))
                  try:
                      ec2 = boto3.client('ec2')
                  except Exception as e:
                      logger.info('boto3.client failure: {}'.format(e))
                  try:
                      ec2.modify_transit_gateway_vpc_attachment(
                          TransitGatewayAttachmentId = TgwInspectionVpcAttachmentId,
                          Options = {'ApplianceModeSupport': ApplianceMode}
                      )
                      TgwResponse = ec2.describe_transit_gateway_vpc_attachments(
                          TransitGatewayAttachmentIds=[TgwInspectionVpcAttachmentId]
                      )
                      ApplianceModeStatus = TgwResponse['TransitGatewayVpcAttachments'][0]['Options']['ApplianceModeSupport']
                  except Exception as e:
                      logger.info('ec2.modify/describe_transit_gateway_vpc_attachment: {}'.format(e))

                  responseData['ApplianceModeStatus'] = ApplianceModeStatus
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-cloudformation/centralized_architecture/nested-stack/Tgw.yaml [356:434]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !GetAtt TgwApplianceModeLogGroup.Arn
              - Effect: Allow
                Action:
                  - ec2:ModifyTransitGatewayVpcAttachment
                  - ec2:DescribeTransitGatewayVpcAttachments
                Resource: "*"

# Enable Transit Gateway Appliance Mode Lambda Custom Resource:
  TgwApplianceModeLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
        LogGroupName: !Sub /aws/lambda/${AWS::StackName}-tgw-appliancemode
        RetentionInDays: 1

  TgwApplianceMode:
    Type: AWS::Lambda::Function
    DependsOn: TgwApplianceModeLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-tgw-appliancemode
      Handler: "index.handler"
      Role: !GetAtt TgwLambdaExecutionRole.Arn
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import json
          import logging

          def handler(event, context):
              logger = logging.getLogger()
              logger.setLevel(logging.INFO)
              responseData = {}
              responseStatus = cfnresponse.FAILED
              logger.info('Received event: {}'.format(json.dumps(event)))
              if event["RequestType"] == "Delete":
                  responseStatus = cfnresponse.SUCCESS
                  cfnresponse.send(event, context, responseStatus, responseData)
              if event["RequestType"] == "Create":
                  try:
                      TgwInspectionVpcAttachmentId = event["ResourceProperties"]["TgwInspectionVpcAttachmentId"]
                      ApplianceMode = event["ResourceProperties"]["ApplianceMode"]
                  except Exception as e:
                      logger.info('Key retrieval failure: {}'.format(e))
                  try:
                      ec2 = boto3.client('ec2')
                  except Exception as e:
                      logger.info('boto3.client failure: {}'.format(e))
                  try:
                      ec2.modify_transit_gateway_vpc_attachment(
                          TransitGatewayAttachmentId = TgwInspectionVpcAttachmentId,
                          Options = {'ApplianceModeSupport': ApplianceMode}
                      )
                      TgwResponse = ec2.describe_transit_gateway_vpc_attachments(
                          TransitGatewayAttachmentIds=[TgwInspectionVpcAttachmentId]
                      )
                      ApplianceModeStatus = TgwResponse['TransitGatewayVpcAttachments'][0]['Options']['ApplianceModeSupport']
                  except Exception as e:
                      logger.info('ec2.modify/describe_transit_gateway_vpc_attachment: {}'.format(e))

                  responseData['ApplianceModeStatus'] = ApplianceModeStatus
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



