{ "Description": "Integration Test for aws-lambda-dynamodb", "Resources": { "Vpc8378EB38": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "10.0.0.0/16", "EnableDnsHostnames": true, "EnableDnsSupport": true, "InstanceTenancy": "default", "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc" } ] } }, "VpcPublicSubnet1Subnet5C2D37C4": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 0, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.0.0/18", "MapPublicIpOnLaunch": true, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "Public" }, { "Key": "aws-cdk:subnet-type", "Value": "Public" }, { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet1" } ], "VpcId": { "Ref": "Vpc8378EB38" } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W33", "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" } ] } } }, "VpcPublicSubnet1RouteTable6C95E38E": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet1" } ], "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcPublicSubnet1RouteTableAssociation97140677": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "VpcPublicSubnet1RouteTable6C95E38E" }, "SubnetId": { "Ref": "VpcPublicSubnet1Subnet5C2D37C4" } } }, "VpcPublicSubnet1DefaultRoute3DA9E72A": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": { "Ref": "VpcIGWD7BA715C" }, "RouteTableId": { "Ref": "VpcPublicSubnet1RouteTable6C95E38E" } }, "DependsOn": [ "VpcVPCGWBF912B6E" ] }, "VpcPublicSubnet1EIPD7E02669": { "Type": "AWS::EC2::EIP", "Properties": { "Domain": "vpc", "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet1" } ] } }, "VpcPublicSubnet1NATGateway4D7517AA": { "Type": "AWS::EC2::NatGateway", "Properties": { "AllocationId": { "Fn::GetAtt": [ "VpcPublicSubnet1EIPD7E02669", "AllocationId" ] }, "SubnetId": { "Ref": "VpcPublicSubnet1Subnet5C2D37C4" }, "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet1" } ] }, "DependsOn": [ "VpcPublicSubnet1DefaultRoute3DA9E72A", "VpcPublicSubnet1RouteTableAssociation97140677" ] }, "VpcPublicSubnet2Subnet691E08A3": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 1, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.64.0/18", "MapPublicIpOnLaunch": true, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "Public" }, { "Key": "aws-cdk:subnet-type", "Value": "Public" }, { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet2" } ], "VpcId": { "Ref": "Vpc8378EB38" } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W33", "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" } ] } } }, "VpcPublicSubnet2RouteTable94F7E489": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet2" } ], "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcPublicSubnet2RouteTableAssociationDD5762D8": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "VpcPublicSubnet2RouteTable94F7E489" }, "SubnetId": { "Ref": "VpcPublicSubnet2Subnet691E08A3" } } }, "VpcPublicSubnet2DefaultRoute97F91067": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": { "Ref": "VpcIGWD7BA715C" }, "RouteTableId": { "Ref": "VpcPublicSubnet2RouteTable94F7E489" } }, "DependsOn": [ "VpcVPCGWBF912B6E" ] }, "VpcPublicSubnet2EIP3C605A87": { "Type": "AWS::EC2::EIP", "Properties": { "Domain": "vpc", "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet2" } ] } }, "VpcPublicSubnet2NATGateway9182C01D": { "Type": "AWS::EC2::NatGateway", "Properties": { "AllocationId": { "Fn::GetAtt": [ "VpcPublicSubnet2EIP3C605A87", "AllocationId" ] }, "SubnetId": { "Ref": "VpcPublicSubnet2Subnet691E08A3" }, "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PublicSubnet2" } ] }, "DependsOn": [ "VpcPublicSubnet2DefaultRoute97F91067", "VpcPublicSubnet2RouteTableAssociationDD5762D8" ] }, "VpcPrivateSubnet1Subnet536B997A": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 0, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.128.0/18", "MapPublicIpOnLaunch": false, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "Private" }, { "Key": "aws-cdk:subnet-type", "Value": "Private" }, { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PrivateSubnet1" } ], "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcPrivateSubnet1RouteTableB2C5B500": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PrivateSubnet1" } ], "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" }, "SubnetId": { "Ref": "VpcPrivateSubnet1Subnet536B997A" } } }, "VpcPrivateSubnet1DefaultRouteBE02A9ED": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "NatGatewayId": { "Ref": "VpcPublicSubnet1NATGateway4D7517AA" }, "RouteTableId": { "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" } } }, "VpcPrivateSubnet2Subnet3788AAA1": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 1, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.192.0/18", "MapPublicIpOnLaunch": false, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "Private" }, { "Key": "aws-cdk:subnet-type", "Value": "Private" }, { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PrivateSubnet2" } ], "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcPrivateSubnet2RouteTableA678073B": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/PrivateSubnet2" } ], "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "VpcPrivateSubnet2RouteTableA678073B" }, "SubnetId": { "Ref": "VpcPrivateSubnet2Subnet3788AAA1" } } }, "VpcPrivateSubnet2DefaultRoute060D2087": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "NatGatewayId": { "Ref": "VpcPublicSubnet2NATGateway9182C01D" }, "RouteTableId": { "Ref": "VpcPrivateSubnet2RouteTableA678073B" } } }, "VpcIGWD7BA715C": { "Type": "AWS::EC2::InternetGateway", "Properties": { "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc" } ] } }, "VpcVPCGWBF912B6E": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "InternetGatewayId": { "Ref": "VpcIGWD7BA715C" }, "VpcId": { "Ref": "Vpc8378EB38" } } }, "VpcRestrictDefaultSecurityGroupCustomResourceC73DA2BE": { "Type": "Custom::VpcRestrictDefaultSG", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E", "Arn" ] }, "DefaultSecurityGroupId": { "Fn::GetAtt": [ "Vpc8378EB38", "DefaultSecurityGroup" ] }, "Account": { "Ref": "AWS::AccountId" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "VpcFlowLogIAMRole6A475D41": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "vpc-flow-logs.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/FlowLog" } ] } }, "VpcFlowLogIAMRoleDefaultPolicy406FB995": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "VpcFlowLogLogGroup7B5C56B9", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", "Roles": [ { "Ref": "VpcFlowLogIAMRole6A475D41" } ] } }, "VpcFlowLogLogGroup7B5C56B9": { "Type": "AWS::Logs::LogGroup", "Properties": { "RetentionInDays": 731, "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/FlowLog" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" } ] } } }, "VpcFlowLog8FF33A73": { "Type": "AWS::EC2::FlowLog", "Properties": { "DeliverLogsPermissionArn": { "Fn::GetAtt": [ "VpcFlowLogIAMRole6A475D41", "Arn" ] }, "LogDestinationType": "cloud-watch-logs", "LogGroupName": { "Ref": "VpcFlowLogLogGroup7B5C56B9" }, "ResourceId": { "Ref": "Vpc8378EB38" }, "ResourceType": "VPC", "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc/FlowLog" } ], "TrafficType": "ALL" } }, "VpcDDB49FBEC5F": { "Type": "AWS::EC2::VPCEndpoint", "Properties": { "RouteTableIds": [ { "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" }, { "Ref": "VpcPrivateSubnet2RouteTableA678073B" }, { "Ref": "VpcPublicSubnet1RouteTable6C95E38E" }, { "Ref": "VpcPublicSubnet2RouteTable94F7E489" } ], "ServiceName": { "Fn::Join": [ "", [ "com.amazonaws.", { "Ref": "AWS::Region" }, ".dynamodb" ] ] }, "Tags": [ { "Key": "Name", "Value": "lamddb-deployFunctionWithExistingVpc/Vpc" } ], "VpcEndpointType": "Gateway", "VpcId": { "Ref": "Vpc8378EB38" } } }, "CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ] }, "ManagedPolicyArns": [ { "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" } ], "Policies": [ { "PolicyName": "Inline", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress" ], "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":security-group/", { "Fn::GetAtt": [ "Vpc8378EB38", "DefaultSecurityGroup" ] } ] ] } ] } ] } } ] }, "Metadata": { "guard": { "SuppressedRules": [] } } }, "CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "02b51ab524e7bcf8f477de3e71e5f9a72e448301b26ba62e9e75a14f9c55a093.zip" }, "Timeout": 900, "MemorySize": 128, "Handler": "__entrypoint__.handler", "Role": { "Fn::GetAtt": [ "CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0", "Arn" ] }, "Runtime": "nodejs24.x", "Description": "Lambda function for removing all inbound/outbound rules from the VPC default security group" }, "DependsOn": [ "CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CDK generated custom resource" }, { "id": "W89", "reason": "CDK generated custom resource" }, { "id": "W92", "reason": "CDK generated custom resource" } ] } } }, "testlambdadynamodbstackLambdaFunctionServiceRole758347A1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "testlambdadynamodbstackLambdaFunctionServiceRoleDefaultPolicy547FB7F4": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:UnassignPrivateIpAddresses" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:ConditionCheckItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "testlambdadynamodbstackDynamoTable8138E93B", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "testlambdadynamodbstackLambdaFunctionServiceRoleDefaultPolicy547FB7F4", "Roles": [ { "Ref": "testlambdadynamodbstackLambdaFunctionServiceRole758347A1" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Lambda needs the following minimum required permissions to send trace data to X-Ray and access ENIs in a VPC." } ] } } }, "testlambdadynamodbstackReplaceDefaultSecurityGroupsecuritygroup15025C82": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "lamddb-deployFunctionWithExistingVpc/test-lambda-dynamodb-stack/ReplaceDefaultSecurityGroup-security-group", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "VpcId": { "Ref": "Vpc8378EB38" } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W5", "reason": "Egress of 0.0.0.0/0 is default and generally considered OK" }, { "id": "W40", "reason": "Egress IPProtocol of -1 is default and generally considered OK" } ] } } }, "testlambdadynamodbstackLambdaFunction5DDB3E8D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "ZipFile": "exports.handler = async (event) => { console.log(event); return {statusCode: 200, body: \"\"}; }" }, "Environment": { "Variables": { "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1", "DDB_TABLE_NAME": { "Ref": "testlambdadynamodbstackDynamoTable8138E93B" } } }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "testlambdadynamodbstackLambdaFunctionServiceRole758347A1", "Arn" ] }, "Runtime": "nodejs22.x", "TracingConfig": { "Mode": "Active" }, "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "testlambdadynamodbstackReplaceDefaultSecurityGroupsecuritygroup15025C82", "GroupId" ] } ], "SubnetIds": [ { "Ref": "VpcPrivateSubnet1Subnet536B997A" }, { "Ref": "VpcPrivateSubnet2Subnet3788AAA1" } ] } }, "DependsOn": [ "testlambdadynamodbstackLambdaFunctionServiceRoleDefaultPolicy547FB7F4", "testlambdadynamodbstackLambdaFunctionServiceRole758347A1", "VpcPrivateSubnet1DefaultRouteBE02A9ED", "VpcPrivateSubnet1RouteTableAssociation70C59FA6", "VpcPrivateSubnet2DefaultRoute060D2087", "VpcPrivateSubnet2RouteTableAssociationA89CAD56" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions." }, { "id": "W89", "reason": "This is not a rule for the general case, just for specific use cases/industries" }, { "id": "W92", "reason": "Impossible for us to define the correct concurrency for clients" } ] } } }, "testlambdadynamodbstackLambdaFunctioninlinePolicyAddedToExecutionRole019E2DE85": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTelemetryRecords", "xray:PutTraceSegments" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "testlambdadynamodbstackLambdaFunctioninlinePolicyAddedToExecutionRole019E2DE85", "Roles": [ { "Ref": "testlambdadynamodbstackLambdaFunctionServiceRole758347A1" } ] }, "DependsOn": [ "VpcPrivateSubnet1DefaultRouteBE02A9ED", "VpcPrivateSubnet1RouteTableAssociation70C59FA6", "VpcPrivateSubnet2DefaultRoute060D2087", "VpcPrivateSubnet2RouteTableAssociationA89CAD56" ] }, "testlambdadynamodbstackDynamoTable8138E93B": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "id", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "id", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "SSEEnabled": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "DYNAMODB_TABLE_ENCRYPTED_KMS" ] } } } }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", "Default": "/cdk-bootstrap/hnb659fds/version", "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" } }, "Rules": { "CheckBootstrapVersion": { "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Contains": [ [ "1", "2", "3", "4", "5" ], { "Ref": "BootstrapVersion" } ] } ] }, "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." } ] } } }