cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'EBS Snapshot Cleanup Scheduler'

Parameters:
  S3Bucket:
    Type: String
    Description: 'S3 Bucket with deployment package'
  S3Key:
    Type: String
    Description: 'S3 Key to deployment package (no leading "/")'
    Default: 'aws-snapshot/dist.zip'
  ScheduleExpression:
    Type: String
    Description: 'Valid CloudWatch Events schedule expression http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html'
    Default: 'cron(1 * * * ? *)'

Resources:
  SnapshotScheduler:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Ref AWS::StackName
      Description: EBS Snapshot Cleanup Scheduler
      Handler: lambda_function.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
      Runtime: python2.7
      Timeout: 60

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Ref AWS::StackName
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                # TODO: review
                Action:
                  - ec2:DescribeSnapshots
                  - ec2:DeleteSnapshot
                Resource: '*'
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: 'arn:aws:logs:*:*:*'

  ScheduledRule:
    Type: AWS::Events::Rule
    Properties:
      Description: !Ref AWS::StackName
      ScheduleExpression: !Ref ScheduleExpression
      State: ENABLED
      Targets:
        - Arn: !GetAtt SnapshotScheduler.Arn
          Id: !Ref AWS::StackName

  PermissionForEventsToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref SnapshotScheduler
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ScheduledRule.Arn

Outputs:
  SnapshotScheduler:
    Value: !GetAtt SnapshotScheduler.Arn