@continuous-excellence/ze-great-dashboard-aws 0.31.41 → 0.31.43

package/template.yml

@@ -1,4 +1,4 @@
-AWSTemplateFormatVersion: '2010-09-09'
+AWSTemplateFormatVersion: "2010-09-09"
 Description: Ze Great Dashboard private Lambda application (integrate through a customer-managed gateway)
 
 Metadata:
@@ -18,10 +18,10 @@ Parameters:
   # ARN of a Secrets Manager JSON object or Parameter Store SecureString such as
   # {"GITHUB_TOKEN":"github_pat_..."}. The value stays server-side; this ARN is the only
   # credential-related Lambda setting.
-  SecretReference: { Type: String, Default: '' }
+  SecretReference: { Type: String, Default: "" }
 
 Conditions:
-  HasSecretReference: !Not [!Equals [!Ref SecretReference, '']]
+  HasSecretReference: !Not [!Equals [!Ref SecretReference, ""]]
   HasReservedConcurrency: !Not [!Equals [!Ref ReservedConcurrentExecutions, 0]]
 
 Resources:
@@ -30,15 +30,16 @@ Resources:
     Properties:
       # A stable, Name-derived role name lets consumer bootstrap policies scope CloudFormation
       # execution to this stack's runtime role rather than every role in the account.
-      RoleName: !Sub '${Name}-server'
+      RoleName: !Sub "${Name}-server"
       AssumeRolePolicyDocument:
-        Version: '2012-10-17'
-        Statement: [{ Effect: Allow, Principal: { Service: lambda.amazonaws.com }, Action: sts:AssumeRole }]
+        Version: "2012-10-17"
+        Statement:
+          [{ Effect: Allow, Principal: { Service: lambda.amazonaws.com }, Action: sts:AssumeRole }]
       ManagedPolicyArns: [arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
       Policies:
         - PolicyName: read-consumer-credentials
           PolicyDocument:
-            Version: '2012-10-17'
+            Version: "2012-10-17"
             Statement:
               - Effect: Allow
                 Action: [secretsmanager:DescribeSecret, secretsmanager:GetSecretValue]
@@ -47,7 +48,7 @@ Resources:
                 Resource: !If
                   - HasSecretReference
                   - !Ref SecretReference
-                  - !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ze-great-dashboard-no-secret-configured'
+                  - !Sub "arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ze-great-dashboard-no-secret-configured"
               - Effect: Allow
                 Action: ssm:GetParameter
                 # The same reference may instead be an SSM parameter ARN. The opposite service's
@@ -55,19 +56,20 @@ Resources:
                 Resource: !If
                   - HasSecretReference
                   - !Ref SecretReference
-                  - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ze-great-dashboard-no-credential-configured'
+                  - !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ze-great-dashboard-no-credential-configured"
               - Effect: Allow
                 Action: kms:Decrypt
-                Resource: '*'
+                Resource: "*"
                 # Parameter Store supplies this encryption context itself. This permits decryption
                 # only while SSM reads this exact configured parameter, including custom KMS keys.
                 Condition:
                   StringEquals:
-                    'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
-                    'kms:EncryptionContext:PARAMETER_ARN': !Ref SecretReference
+                    "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
+                    "kms:EncryptionContext:PARAMETER_ARN": !Ref SecretReference
   ServerLogGroup:
     Type: AWS::Logs::LogGroup
-    Properties: { RetentionInDays: !Ref LogRetentionInDays, LogGroupName: !Sub '/aws/lambda/${Name}' }
+    Properties:
+      { RetentionInDays: !Ref LogRetentionInDays, LogGroupName: !Sub "/aws/lambda/${Name}" }
   ServerFunction:
     Type: AWS::Lambda::Function
     DependsOn: ServerLogGroup
@@ -78,7 +80,8 @@ Resources:
       Handler: index.handler
       MemorySize: !Ref MemorySize
       Timeout: !Ref Timeout
-      ReservedConcurrentExecutions: !If [HasReservedConcurrency, !Ref ReservedConcurrentExecutions, !Ref AWS::NoValue]
+      ReservedConcurrentExecutions:
+        !If [HasReservedConcurrency, !Ref ReservedConcurrentExecutions, !Ref AWS::NoValue]
       Role: !GetAtt ServerRole.Arn
       Code: { S3Bucket: !Ref LambdaArtifactBucket, S3Key: !Ref LambdaArtifactKey }
       Environment: