lambda-support/ggp-config-for-cross-account-usage.yaml [119:195]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  ServiceRoleDetection:
    Type: Custom::ServiceRoleDetectionLambda
    Properties:
      ServiceToken: !GetAtt ServiceRoleDetectionLambda.Arn
      RoleArn: !GetAtt GreengrassServiceRole.Arn
  ServiceRoleDetectionLambda:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt ServiceRoleDetectionAndAssociationLambdaRole.Arn
      Code:
        ZipFile: |
          import boto3
          import botocore
          import sys
          import logging
          import cfnresponse

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          def lambda_handler(event, context):
            role_arn = event['ResourceProperties'].get('RoleArn')

            response_data = {}
            response_data['role_arn'] = role_arn

            try:
              greengrass_client = boto3.client('greengrass')
              service_role_response = greengrass_client.get_service_role_for_account()
              role_arn = service_role_response['RoleArn']
              response_data['role_arn'] = role_arn
              logger.info('Service role already associated with account [{}]'.format(role_arn))
            except botocore.exceptions.ClientError as e:
              if e.response['Error']['Code'] == '404':
                logger.info('Service role not associated with account, will associate a role later')
              else:
                raise

            cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data, role_arn)
      Handler: index.lambda_handler
      Timeout: 30
      Runtime: python3.6
  ServiceRoleAssociation:
    Type: Custom::ServiceRoleAssociationLambda
    Properties:
      ServiceToken: !GetAtt ServiceRoleAssociationLambda.Arn
      NewRoleArn: !GetAtt GreengrassServiceRole.Arn
      RoleArn: !Ref ServiceRoleDetection
  ServiceRoleAssociationLambda:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt ServiceRoleDetectionAndAssociationLambdaRole.Arn
      Code:
        ZipFile: |
          import boto3
          import botocore
          import sys
          import logging
          import cfnresponse

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          def lambda_handler(event, context):
            request_type = event['RequestType']

            account_id = event['ResourceProperties'].get('AccountId')
            role_arn = event['ResourceProperties'].get('RoleArn')
            new_role_arn = event['ResourceProperties'].get('NewRoleArn')

            response_data = {}
            response_data['role_arn'] = role_arn

            greengrass_client = boto3.client('greengrass')

            if request_type == 'Create':
              if role_arn == new_role_arn:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



lambda-support/lambda-stack-for-ggp.yaml [160:236]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  ServiceRoleDetection:
    Type: Custom::ServiceRoleDetectionLambda
    Properties:
      ServiceToken: !GetAtt ServiceRoleDetectionLambda.Arn
      RoleArn: !GetAtt GreengrassServiceRole.Arn
  ServiceRoleDetectionLambda:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt ServiceRoleDetectionAndAssociationLambdaRole.Arn
      Code:
        ZipFile: |
          import boto3
          import botocore
          import sys
          import logging
          import cfnresponse

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          def lambda_handler(event, context):
            role_arn = event['ResourceProperties'].get('RoleArn')

            response_data = {}
            response_data['role_arn'] = role_arn

            try:
              greengrass_client = boto3.client('greengrass')
              service_role_response = greengrass_client.get_service_role_for_account()
              role_arn = service_role_response['RoleArn']
              response_data['role_arn'] = role_arn
              logger.info('Service role already associated with account [{}]'.format(role_arn))
            except botocore.exceptions.ClientError as e:
              if e.response['Error']['Code'] == '404':
                logger.info('Service role not associated with account, will associate a role later')
              else:
                raise

            cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data, role_arn)
      Handler: index.lambda_handler
      Timeout: 30
      Runtime: python3.6
  ServiceRoleAssociation:
    Type: Custom::ServiceRoleAssociationLambda
    Properties:
      ServiceToken: !GetAtt ServiceRoleAssociationLambda.Arn
      NewRoleArn: !GetAtt GreengrassServiceRole.Arn
      RoleArn: !Ref ServiceRoleDetection
  ServiceRoleAssociationLambda:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt ServiceRoleDetectionAndAssociationLambdaRole.Arn
      Code:
        ZipFile: |
          import boto3
          import botocore
          import sys
          import logging
          import cfnresponse

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          def lambda_handler(event, context):
            request_type = event['RequestType']

            account_id = event['ResourceProperties'].get('AccountId')
            role_arn = event['ResourceProperties'].get('RoleArn')
            new_role_arn = event['ResourceProperties'].get('NewRoleArn')

            response_data = {}
            response_data['role_arn'] = role_arn

            greengrass_client = boto3.client('greengrass')

            if request_type == 'Create':
              if role_arn == new_role_arn:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



