kumogata-template 0.0.35 → 0.0.36

data/template/iam-role.rb

@@ -4,6 +4,21 @@
 #
 require 'kumogata/template/helper'
 require 'kumogata/template/iam'
+require 'kumogata/template/kinesis'
+require 'kumogata/template/pinpoint'
+
+args[:managed_policies].collect!{|v| "service-role/#{v}" } if args.key? :managed_policies
+args[:policies].each_with_index do |v, i|
+  next unless v.key? :type
+  case v[:type]
+  when /^kinesis firehose/
+    args[:policies][i][:document] = _kinesis_firehose_to_delivery_stream_role(v[:document])
+  when /^pinpoint kinesis stream/
+    args[:policies][i][:document] = _pinpoint_to_kinesis_stream_role(v[:document])
+  when /^pinpoint kinesis firehose/
+    args[:policies][i][:document] = _pinpoint_to_kinesis_firehose_delivery_stream_role(v[:document])
+  end
+end if args.key? :policies
 
 name = _resource_name(args[:name], "role")
 policy = _iam_assume_role_policy_document(args)
@@ -15,7 +30,7 @@ managed_policies =
   end
 path = args[:path] || "/"
 policies = _iam_policies("policies", args)
-role_name = _real_name("role", args)
+role = _name("role", args)
 
 _(name) do
   Type "AWS::IAM::Role"
@@ -27,6 +42,6 @@ _(name) do
     ManagedPolicyArns managed_policies unless managed_policies.empty?
     Path path
     Policies policies unless policies.empty?
-    RoleName role_name if role_name
+    RoleName role
   end
 end

data/template/iam-user.rb

@@ -6,7 +6,7 @@ require 'kumogata/template/helper'
 require 'kumogata/template/iam'
 
 name = _resource_name(args[:name], "user")
-group = _ref_array("group", args)
+groups = _ref_array("groups", args, "group")
 login_profile =
   if args.key? :login_profile
     _iam_login_profile(args[:login_profile])
@@ -21,16 +21,16 @@ managed_policies =
   end
 path = args[:path] || "/"
 policies = _iam_policies("policies", args)
-user = _real_name("user", args)
+user = _name("user", args)
 
 _(name) do
   Type "AWS::IAM::User"
   Properties do
-    Group group unless group.empty?
+    Groups groups unless groups.empty?
     LoginProfile login_profile unless login_profile.empty?
     ManagedPolicyArns managed_policies unless managed_policies.empty?
     Path path
     Policies policies unless policies.empty?
-    UserName user if user
+    UserName user
   end
 end

data/template/kinesis-firehose-delivery-stream.rb

@@ -0,0 +1,36 @@
+#
+# Kinesis Firehose Delivery System resource
+# http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesisfirehose-deliverystream.html
+#
+require 'kumogata/template/helper'
+require 'kumogata/template/kinesis'
+
+name = _resource_name(args[:name], 'kinesis firehose delivery stream')
+stream_name = _name('stream', args)
+stream_type = _kinesis_firehose_to_delivery_stream_type(args[:type])
+elasticsearch = _kinesis_firehose_delivery_stream_elasticsearch_destination(args[:es])
+extended_s3 = _kinesis_firehose_delivery_stream_extended_s3_destination(args[:extended_s3])
+kinesis = _kinesis_firehose_delivery_stream_kinesis_stream_source(args[:kinesis])
+redshift = _kinesis_firehose_delivery_stream_redshift_destination(args[:redshift])
+s3_dest = _kinesis_firehose_delivery_stream_s3_destnation(args[:s3_dest])
+depends = _depends([ { ref_log_stream: 'logs log stream' } ], args)
+
+if stream_type == 'KinesisStreamAsSource'
+  elasticsearch = ''
+  extended_s3 = ''
+  redshift = ''
+end
+
+_(name) do
+  Type 'AWS::KinesisFirehose::DeliveryStream'
+  Properties do
+    DeliveryStreamName stream_name
+    DeliveryStreamType stream_type
+    ElasticsearchDestinationConfiguration elasticsearch unless elasticsearch.empty?
+    ExtendedS3DestinationConfiguration extended_s3 unless extended_s3.empty?
+    KinesisStreamSourceConfiguration kinesis unless kinesis.empty?
+    RedshiftDestinationConfiguration redshift unless redshift.empty?
+    S3DestinationConfiguration s3_dest unless s3_dest.empty?
+  end
+  DependsOn depends unless depends.empty?
+end

data/template/kinesis-stream.rb

@@ -0,0 +1,21 @@
+#
+# Kinesis stream resource
+# http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesis-stream.html
+#
+require 'kumogata/template/helper'
+
+name = _resource_name(args[:name], 'kinesis stream')
+stream = _name('stream', args)
+rentention = args[:rentention] || 24
+shard = args[:shard] || 1
+tags = _tags(args, 'stream')
+
+_(name) do
+  Type 'AWS::Kinesis::Stream'
+  Properties do
+    Name stream
+    RetentionPeriodHours rentention
+    ShardCount shard
+    Tags tags
+  end
+end

data/template/kms-alias.rb

@@ -5,8 +5,8 @@
 require 'kumogata/template/helper'
 
 name = _resource_name(args[:name], "kms alias")
-alias_name = _ref_name("alias", args)
-target = _ref_name("target", args)
+alias_name = _name("alias", args)
+target = _name("target", args)
 
 _(name) do
   Type "AWS::KMS::Alias"

data/template/kms-key.rb

@@ -6,7 +6,7 @@ require 'kumogata/template/helper'
 require 'kumogata/template/iam'
 
 name = _resource_name(args[:name], "kms key")
-description = args[:description] || ""
+description = _ref_string_default('description', args, '', "#{args[:name]} kms key description")
 enabled = _bool("enabled", args, true)
 rotation = _bool("rotation", args, false)
 policy = _iam_policy_document("policy", args)

data/template/lambda-alias.rb

@@ -5,10 +5,10 @@
 require 'kumogata/template/helper'
 
 name = _resource_name(args[:name], "lambda alias")
-description = args[:description] || ""
+description = _ref_string_default("description", args, '', "#{args[:name]} lambda alias description")
 function_name = _ref_attr_string("function_name", "Arn", args, "lambda function")
 function_version = _ref_attr_string("function_version", "Version", args, "lambda version")
-alias_name = _ref_name("alias_name", args)
+alias_name = _name("alias_name", args)
 
 _(name) do
   Type "AWS::Lambda::Alias"

data/template/lambda-event-source-mapping.rb

@@ -7,8 +7,8 @@ require 'kumogata/template/helper'
 name = _resource_name(args[:name], "lambda event source mapping")
 batch_size = args[:batch_size] || 100
 enabled = _bool("enabled", args, true)
-event_source = _ref_attr_string("event_source", "Arn", args, args[:event_source_prefix])
-function_name = _ref_attr_string("function_name", "Arn", args, "lambda function")
+event = _ref_attr_string("event", "Arn", args, args[:event_prefix])
+function = _ref_attr_string("function", "Arn", args, "lambda function")
 starting_position = _valid_values(args[:starting_position],
                                   %w( trim_horizon latest ), "latest")
 
@@ -17,8 +17,8 @@ _(name) do
   Properties do
     BatchSize batch_size
     Enabled enabled
-    EventSourceArn event_source
-    FunctionName function_name
+    EventSourceArn event
+    FunctionName function
     StartingPosition starting_position.upcase
   end
 end

data/template/lambda-function.rb

@@ -8,30 +8,28 @@ require 'kumogata/template/lambda'
 name = _resource_name(args[:name], "lambda function")
 code = _lambda_function_code(args)
 dead_letter = _lambda_dead_letter(args)
-description = args[:description] || ""
+description = _ref_string_default("description", args, '', "#{args[:name]} lambda function description")
 environment = _lambda_function_environment(args)
-function_name = args[:function_name] || ""
-runtime = _valid_values(args[:runtime],
-                        %w( nodejs nodejs4.3 java8 python2.7 ), "nodejs")
+function = _name("function", args)
+runtime = _lambda_to_runtime(args[:runtime])
+handler_index = args[:handler] || 'lambda'
 handler =
-  if args.key? :handler
-    args[:handler]
+  case runtime
+  when /^nodejs/
+    "#{handler_index}.handler"
+  when /^python/
+    "#{handler_index}.handler"
   else
-    case runtime
-    when /^nodejs/
-      "#{args[:function_name]}.handler"
-    when /^python/
-      "#{args[:function_name]}.lambda_handler"
-    else
-      args[:handler]
-    end
+    'lambda.handler'
   end
 memory_size = args[:memory_size] || 128
 role = _ref_attr_string("role", "Arn", args, "role")
 role = _ref_string("role_arn", args, "role") if role.empty?
-timeout = args[:timeout] || 3
+timeout = args[:timeout] || 300
+trace = _lambda_trace_config(args)
 vpc_config = _lambda_vpc_config(args)
-tags = _tags(args)
+tags = _tags(args, "function")
+depends = _depends([ { ref_role: 'role' } ], args)
 
 _(name) do
   Type "AWS::Lambda::Function"
@@ -40,14 +38,16 @@ _(name) do
     DeadLetterConfig dead_letter unless dead_letter.empty?
     Description description unless description.empty?
     Environment environment unless environment.empty?
-    FunctionName function_name unless function_name.empty?
+    FunctionName function
     Handler handler
     #KmsKeyArn
     MemorySize memory_size
     Role role
     Runtime runtime
     Timeout timeout
+    TracingConfig trace unless trace.empty?
     VpcConfig vpc_config unless vpc_config.empty?
     Tags tags
   end
+  DependsOn depends unless depends.empty?
 end

data/template/lambda-permission.rb

@@ -3,24 +3,45 @@
 # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html
 #
 require 'kumogata/template/helper'
+require 'kumogata/template/iam'
 
 name = _resource_name(args[:name], "lambda permission")
-action = args[:action] || "lambda:*"
-function_name = _ref_attr_string("function_name", "Arn", args, "lambda function")
-principal = _valid_values(args[:principal],
-                          %w( s3.amazonaws.com sns.amazonaws.com ),
-                          "sns.amazonaws.com")
+action = args[:action] || 'invoke function'
+function = _ref_attr_string("function", "Arn", args, "lambda function", 'arn')
+principal = args[:principal]
 source_account = _ref_string("source_account", args, "account id")
-source_prefix = (principal == "s3.amazonaws") ? "bucket" : "topic"
-source_arn = _ref_string("source_arn", args, source_prefix)
+source_account = _ref_pseudo('account id') if source_account.empty? and principal == 's3'
+source_arn_prefix =
+  case principal
+  when 's3'
+    'bucket'
+  when 'sns'
+    'topic'
+  when 'events'
+    'events rule'
+    # TBD
+  else
+    ''
+  end
+source_arn =
+  case principal
+  when 'sns'
+    _ref_string("source_arn", args, source_arn_prefix)
+  else
+    _ref_attr_string('source_arn', 'Arn', args, source_arn_prefix)
+  end
+
+source_arn = _iam_arn("s3", { ref: args[:ref_iam_source_arn] }) if args.key? :ref_iam_source_arn and principal =~ /s3/ and source_arn.empty?
+depends = _depends([ { ref_function: 'lambda function' } ], args)
 
 _(name) do
   Type "AWS::Lambda::Permission"
   Properties do
-    Action action
-    FunctionName function_name
-    Principal principal
+    Action "lambda:#{_capitalize(action)}"
+    FunctionName function
+    Principal "#{principal}.#{DOMAIN}"
     SourceAccount source_account unless source_account.empty?
     SourceArn source_arn unless source_arn.empty?
   end
+  DependsOn depends unless depends.empty?
 end

data/template/lambda-version.rb

@@ -7,13 +7,15 @@ require 'kumogata/template/helper'
 name = _resource_name(args[:name], "lambda version")
 code_sha256 = args[:code_sha256] || ""
 description = args[:description] || ""
-function_name = _ref_attr_string("function_name", "Arn", args, "lambda function")
+function = _ref_attr_string("function", "Arn", args, "lambda function")
+depends = _depends([ { ref_function: 'lambda function' } ], args)
 
 _(name) do
   Type "AWS::Lambda::Version"
   Properties do
     CodeSha256 code_sha256 unless code_sha256.empty?
     Description description unless description.empty?
-    FunctionName function_name
+    FunctionName function
   end
+  DependsOn depends unless depends.empty?
 end

data/template/logs-destination.rb

@@ -7,7 +7,7 @@ require 'kumogata/template/iam'
 require 'kumogata/template/logs'
 
 name = _resource_name(args[:name], "logs destination")
-dest = _ref_name("dest", args)
+dest = _name("dest", args)
 policy = _iam_policy_document("policy", args)
 role = _ref_attr_string("role", "Arn", args, "role")
 target = _iam_arn("kinesis", args[:target].merge(type: "stream"))

data/template/logs-log-group.rb

@@ -6,7 +6,7 @@ require 'kumogata/template/helper'
 require 'kumogata/template/logs'
 
 name = _resource_name(args[:name], "logs log group")
-group = _ref_name("group", args)
+group = _name("group", args)
 rentention = args[:rentention] || 365
 
 _(name) do

data/template/logs-log-stream.rb

@@ -6,8 +6,9 @@ require 'kumogata/template/helper'
 require 'kumogata/template/logs'
 
 name = _resource_name(args[:name], "logs log stream")
-group = _ref_name("group", args)
-stream = _ref_name("stream", args)
+group = _name("group", args)
+stream = _name("stream", args)
+depends = _depends([ { ref_log_group: 'logs log group' } ], args)
 
 _(name) do
   Type "AWS::Logs::LogStream"
@@ -15,4 +16,5 @@ _(name) do
     LogGroupName group
     LogStreamName stream
   end
+  DependsOn depends unless depends.empty?
 end

data/template/logs-metric-filter.rb

@@ -8,7 +8,7 @@ require 'kumogata/template/logs'
 name = _resource_name(args[:name], "logs metric filter")
 # pattern ex. [timestamps, ip_addresses, error_codes = 1234*, size, ...]
 pattern = args[:pattern]
-group = _ref_name("group", args)
+group = _name("group", args)
 trans = _logs_metric_filter_transformations(args)
 
 _(name) do

data/template/logs-subscription_filter.rb

@@ -10,7 +10,7 @@ dest = _ref_attr_string("dest", "Arn", args, "role")
 # Filter and Pattern Syntax
 # http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
 pattern = args[:pattern]
-group = _ref_name("group", args)
+group = _name("group", args)
 role = _ref_attr_string("role", "Arn", args, "role")
 
 _(name) do

data/template/mappings-ec2.rb

@@ -6,93 +6,155 @@ require 'kumogata/template/helper'
 AWSInstanceType2Arch do
   EC2_INSTANCE_TYPES.each do |type|
     _(type) do
-      Arch "HVM64"
+      Arch 'HVM64'
     end
   end
 end
 
-# Amazon Linux AMI (HVM / 64-bit)
+# Amazon Linux AMI x86_64 HVM GP2
 # https://aws.amazon.com/marketplace/pp/B00CIYTQTC/
 AWSRegionArch2AMIAmazonLinuxOfficial do
-  # 2017.03.0.20170417, released 04/19/2017
+  # 2017.09.1.20180115, released 01/15/2018
   image_id = {
-    virginia:   "c58c1dd3",
-    ohio:       "4191b524",
-    california: "7a85a01a",
-    oregon:     "4836a428",
-    canada:     "0bd66a6f",
-    ireland:    "01ccc867",
-    frankfurt:  "b968bad6",
-    london:     "b6daced2",
-    tokyo:      "923d12f5",
-    seoul:      "9d15c7f3",
-    singapore:  "fc5ae39f",
-    sydney:     "162c2575",
-    mumbai:     "52c7b43d",
-    saopaulo:   "37cfad5b",
+    virginia:   '97785bed',
+    ohio:       'f63b1193',
+    california: '824c4ee2',
+    oregon:     'f2d3638a',
+    canada:     'a954d1cd',
+    frankfurt:  '5652ce39',
+    ireland:    'd834aba1',
+    london:     '403e2524',
+    paris:      '8ee056f3',
+    singapore:  '68097514',
+    sydney:     '942dd1f6',
+    seoul:      '863090e8',
+    tokyo:      'ceafcba8',
+    mumbai:     '531a4c3c',
+    saopaulo:   '84175ae8',
   }
 
   AWS_REGION.each do |key, region|
     _(region) do
       HVM64 "ami-#{image_id[key]}"
-    end
+    end if key !~ /local/
+  end
+end
+
+# Amazon Linux 2 AMI x86_64 HVM GP2
+# https://aws.amazon.com/amazon-linux-2/release-notes/
+# for r in $(aws --profile <profile> --output text ec2 describe-regions --query 'Regions[].RegionName'); do i=$(aws --profile <profile> --region $r --output text ec2 describe-images --owners amazon --filters Name=name,Values="amzn2-ami-hvm*gp2" --query 'Images[].[Name, ImageId]'); echo "$r: \"$i\""; done
+AWSRegionArch2AMIAmazonLinux2Official do
+  # 2017.12.0.20180115
+  image_id = {
+    virginia:   '428aa838',
+    ohio:       '710e2414',
+    california: '4a787a2a',
+    oregon:     '7f43f307',
+    canada:     '7549cc11',
+    frankfurt:  '1b2bb774',
+    ireland:    'db1688a2',
+    london:     '6d263d09',
+    paris:      '5ce55321',
+    singapore:  '4f89f533',
+    sydney:     '38708c5a',
+    seoul:      '3e04a450',
+    tokyo:      'c2680fa4',
+    mumbai:     '3b2f7954',
+    saopaulo:   'f1337e9d',
+  }
+
+  AWS_REGION.each do |key, region|
+    _(region) do
+      HVM64 "ami-#{image_id[key]}"
+    end if key !~ /local/
   end
 end
 
-# CentOS 7 (x86_64) with Updates HVM
+# CentOS 7 x86_64 with Updates HVM
 # https://wiki.centos.org/Cloud/AWS
 # https://aws.amazon.com/marketplace/pp/B00O7WM7QW/
 AWSRegionArch2AMICentos7Official do
-  # 1704, released 05/15/2017
+  # 18001_01, released 01/14/2018
   image_id = {
-    virginia:   "46c1b650",
-    ohio:       "18f8df7d",
-    california: "f5d7f195",
-    oregon:     "f4533694",
-    canada:     "28823e4c",
-    ireland:    "061b1560",
-    frankfurt:  "fa2df395",
-    london:     "e05a4d84",
-    tokyo:      "29d1e34e",
-    seoul:      "08e93466",
-    singapore:  "7d2eab1e",
-    sydney:     "34171d57",
-    mumbai:     "3c0e7353",
-    saopaulo:   "b31a75df",
+    virginia:   '4bf3d731',
+    ohio:       'e1496384',
+    california: '65e0e305',
+    oregon:     'a042f4d8',
+    canada:     'dcad28b8',
+    frankfurt:  '337be65c',
+    ireland:    '6e28b517',
+    london:     'ee6a718a',
+    paris:      'bfff49c2',
+    singapore:  'd2fa88ae',
+    sydney:     'b6bb47d4',
+    seoul:      '7248e81c',
+    tokyo:      '25bd2743',
+    mumbai:     '5d99ce32',
+    saopaulo:   'f9adef95',
   }
 
   AWS_REGION.each do |key, region|
     _(region) do
       HVM64 "ami-#{image_id[key]}"
-    end
+    end if key !~ /local/
   end
 end
 
-# Ubuntu Server 16.04 LTS
+# Ubuntu 16.04 LTS - Xenial (HVM)
 # https://cloud-images.ubuntu.com/locator/ec2/
 # https://aws.amazon.com/marketplace/pp/B01JBL2M0O
 AWSRegionArch2AMIUbuntu16Official do
-  # 20170411, released 04/11/2017
+  # 16.04 LTS 2018022, released 03/06/2018
   image_id = {
-    virginia:   "e4139df2",
-    ohio:       "33ab8f56",
-    california: "30476250",
-    oregon:	"17ba2a77",
-    canada:     "9eee52fa",
-    ireland:    "b5a893d3",
-    frankfurt:  "1b4d9e74",
-    london:     "4d3a2e29",
-    tokyo:      "c9e3c0ae",
-    seoul:      "3cda0852",
-    singapore:  "6e74ca0d",
-    sydney:     "92e8e6f1",
-    mumbai:     "",  ## N/A
-    saopaulo:   "36187a5a",
+    virginia:   'b46295c9',
+    ohio:       'f6cef993',
+    california: 'c16862a1',
+    oregon:	'1c1d9664',
+    canada:     '919b1cf5',
+    frankfurt:  '6283ef0d',
+    ireland:    '70054309',
+    london:     'be4aaed9',
+    paris:      '5563d528',
+    singapore:  '8f4f05f3',
+    sydney:     'ed77b18f',
+    seoul:      'e546eb8b',
+    tokyo:      '64612102',
+    mumbai:     '00000000',  ## N/A
+    saopaulo:   '4a733826',
   }
 
   AWS_REGION.each do |key, region|
     _(region) do
       HVM64 "ami-#{image_id[key]}"
-    end
+    end if key !~ /local/ and !image_id[key].empty?
+  end
+end
+
+# Amazon Linux AMI 2017.09.i x86_64 ECS HVM GP2
+# http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI_launch_latest.html
+AWSRegionArch2AMIEcsOfficial do
+  # 2017.09.j
+  image_id = {
+    ohio:       'ef64528a',
+    virginia:   'cad827b7',
+    oregon:	'baa236c2',
+    california: '29b8b249',
+    paris:      '0356e07e',
+    london:     '25f51242',
+    ireland:    '64c4871d',
+    frankfurt:  '3b7d1354',
+    seoul:      '3b19b455',
+    tokyo:      'bb5f13dd',
+    sydney:     'a677b6c4',
+    singapore:  'f88ade84',
+    canada:     'db48cfbf',
+    mumbai:     '9e91cff1',
+    saopaulo:   'da2c66b6',
+  }
+
+  AWS_REGION.each do |key, region|
+    _(region) do
+      HVM64 "ami-#{image_id[key]}" if region !~ /local/
+    end if key !~ /local/ and !image_id[key].empty?
   end
 end

data/template/output-arn.rb

@@ -3,7 +3,15 @@
 #
 require 'kumogata/template/helper'
 
-_output "#{args[:name]} name", ref_value: args[:name],
-                               export: _export_string(args, "name")
-_output "#{args[:name]} arn", ref_value: [ args[:name], "Arn" ],
-                              export: _export_string(args, "arn")
+name =
+  if args.key? :resource
+    "#{args[:name]} #{args[:resource]}"
+  else
+    args[:name]
+  end
+
+_output "#{name} name", ref_value: name,
+                        export: _export_string(args, "name")
+
+_output "#{name} arn", ref_value: [ name, "Arn" ],
+                       export: _export_string(args, "arn")

data/template/output-certificate.rb

@@ -0,0 +1,11 @@
+#
+# Output access key
+#
+require 'kumogata/template/helper'
+
+_output "#{args[:name]} access key",
+        ref_value: "#{args[:name]} access key",
+        export: _export_string(args, "access key")
+_output "#{args[:name]} secret access key",
+        ref_value: [ "#{args[:name]} access key", "SecretAccessKey" ],
+        export: _export_string(args, "secret access key")

data/template/output-distribution.rb

@@ -0,0 +1,11 @@
+#
+# Output distribution
+#
+require 'kumogata/template/helper'
+
+_output "#{args[:name]} distribution",
+        ref_value: "#{args[:name]} distribution",
+        export: _export_string(args, "distribution")
+_output "#{args[:name]} distribution domain",
+        ref_value: [ "#{args[:name]} distribution", "DomainName" ],
+        export: _export_string(args, "distribution domain")

data/template/output-domain-name.rb

@@ -0,0 +1,11 @@
+#
+# Output domain name
+#
+require 'kumogata/template/helper'
+
+_output "#{args[:name]} domain name domain",
+        ref_value: "#{args[:name]} domain name",
+        export: _export_string(args, "domain name")
+_output "#{args[:name]} domain name distribution",
+        ref_value: [ "#{args[:name]} domain name", "DistributionDomainName" ],
+        export: _export_string(args, "domain name distribution")