awsblog-building-resilient-applications/multi-region/3-lambda-stackset/stack-lambdas.yml [135:234]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Outputs:
  DashboardLambdaUrl:
    Description: URL for Dashboard Lambda
    Value: !GetAtt DashboardLambdaAlb.DNSName

Resources:
  DashboardLambdaAlb:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties: 
      Name: !Sub ${ProjectId}-DashboardLambdaAlb
      IpAddressType: ipv4
      Scheme: internet-facing
      SecurityGroups:
        - !Ref DashboardLambdaAlbSG
      Subnets: 
        - !ImportValue stack-network-PublicSubnet1A #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
        - !ImportValue stack-network-PublicSubnet1B #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
        - !ImportValue stack-network-PublicSubnet1C #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
      Type: application

  DashboardLambdaAlbTG:
    DependsOn: DashboardLambdaPermission
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${ProjectId}-DashboardLambdaAlbTG
      TargetType: lambda
      Targets:
        - Id: !GetAtt DashboardLambda.Arn

  DashboardLambdaAlbListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties: 
      DefaultActions: 
        - Type: forward
          TargetGroupArn: !Ref DashboardLambdaAlbTG
      LoadBalancerArn: !Ref DashboardLambdaAlb
      Port: 80
      Protocol: HTTP

  DashboardLambdaAlbSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Dashboard Lambda ALB
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !FindInMap [StaticParameters, StaticParameters, LambdaAccessCidrIp]
          Description: Allow inbound access to Lambda for HTTP requests. WARNING this access should be restricted in a production environment.
      SecurityGroupEgress:
        - !Ref AWS::NoValue
      VpcId: !ImportValue stack-network-VpcID #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
      Tags:
        - Key: Name
          Value: !Sub '${ProjectId}-DashboardLambdaAlbSG'

  DashboardLambdaSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Dashboard Lambda
      SecurityGroupIngress:
        - !Ref AWS::NoValue
      SecurityGroupEgress:
        - !Ref AWS::NoValue
      VpcId: !ImportValue stack-network-VpcID #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
      Tags:
        - Key: Name
          Value: !Sub '${ProjectId}-DashboardLambdaSG'

  DashboardLambdaRole:
    Condition: PrimaryRegion
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Sid: ''
      Policies:
        - PolicyName: !Sub ${ProjectId}-DashboardLambdaPolicy
          PolicyDocument:
            Statement:
            - Action:
              - ec2:CreateNetworkInterface
              - ec2:DeleteNetworkInterface
              - ec2:DescribeNetworkInterfaces
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              Effect: Allow
              Resource:
              - !Sub 
                - 'arn:aws:logs:${Region1}:${AWS::AccountId}:log-group:/aws/lambda/${ProjectId}-Dashboard:*'
                - Region1: !FindInMap [StaticParameters, StaticParameters, Region1]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



awsblog-building-resilient-applications/single-region/3-lambda-stack/stack-lambdas.yml [67:166]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Outputs:
  DashboardLambdaUrl:
    Description: URL for Dashboard Lambda
    Value: !GetAtt DashboardLambdaAlb.DNSName

Resources:
  DashboardLambdaAlb:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties: 
      Name: !Sub ${ProjectId}-DashboardLambdaAlb
      IpAddressType: ipv4
      Scheme: internet-facing
      SecurityGroups:
        - !Ref DashboardLambdaAlbSG
      Subnets: 
        - !ImportValue stack-network-PublicSubnet1A #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
        - !ImportValue stack-network-PublicSubnet1B #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
        - !ImportValue stack-network-PublicSubnet1C #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
      Type: application

  DashboardLambdaAlbTG:
    DependsOn: DashboardLambdaPermission
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${ProjectId}-DashboardLambdaAlbTG
      TargetType: lambda
      Targets:
        - Id: !GetAtt DashboardLambda.Arn

  DashboardLambdaAlbListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties: 
      DefaultActions: 
        - Type: forward
          TargetGroupArn: !Ref DashboardLambdaAlbTG
      LoadBalancerArn: !Ref DashboardLambdaAlb
      Port: 80
      Protocol: HTTP

  DashboardLambdaAlbSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Dashboard Lambda ALB
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !FindInMap [StaticParameters, StaticParameters, LambdaAccessCidrIp]
          Description: Allow inbound access to Lambda for HTTP requests. WARNING this access should be restricted in a production environment.
      SecurityGroupEgress:
        - !Ref AWS::NoValue
      VpcId: !ImportValue stack-network-VpcID #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
      Tags:
        - Key: Name
          Value: !Sub '${ProjectId}-DashboardLambdaAlbSG'

  DashboardLambdaSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Dashboard Lambda
      SecurityGroupIngress:
        - !Ref AWS::NoValue
      SecurityGroupEgress:
        - !Ref AWS::NoValue
      VpcId: !ImportValue stack-network-VpcID #THIS IMPORT DEPENDS ON THE DEPLOYMENT OF THE APPLICATION STACK
      Tags:
        - Key: Name
          Value: !Sub '${ProjectId}-DashboardLambdaSG'

  DashboardLambdaRole:
    Condition: PrimaryRegion
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Sid: ''
      Policies:
        - PolicyName: !Sub ${ProjectId}-DashboardLambdaPolicy
          PolicyDocument:
            Statement:
            - Action:
              - ec2:CreateNetworkInterface
              - ec2:DeleteNetworkInterface
              - ec2:DescribeNetworkInterfaces
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              Effect: Allow
              Resource:
              - !Sub 
                - 'arn:aws:logs:${Region1}:${AWS::AccountId}:log-group:/aws/lambda/${ProjectId}-Dashboard:*'
                - Region1: !FindInMap [StaticParameters, StaticParameters, Region1]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



