diff --git a/README.md b/README.md index cc6beb2..b379eab 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,3 @@ -# Proyecto Platzi - ## Despliegue del proyeto ### Pre-Requisitos diff --git a/dynamo/dynamo.sh b/dynamo/dynamo.sh new file mode 100644 index 0000000..62936d2 --- /dev/null +++ b/dynamo/dynamo.sh @@ -0,0 +1,6 @@ +#!/bin/bash +aws cloudformation deploy \ +--region us-east-1 \ +--parameter-overrides DynamoName="lablambda" DynamoKey="dni" \ +--stack-name dynamo-lambda-lab \ +--template-file ./dynamo.yml \ No newline at end of file diff --git a/dynamo/dynamo.yml b/dynamo/dynamo.yml new file mode 100644 index 0000000..1c0e5ce --- /dev/null +++ b/dynamo/dynamo.yml @@ -0,0 +1,30 @@ +AWSTemplateFormatVersion: '2010-09-09' +Parameters: + DynamoName: + Type: String + DynamoKey: + Type: String + +Resources: + DynamoLab: + Type: AWS::DynamoDB::Table + Properties: + TableName: !Ref DynamoName + BillingMode: PAY_PER_REQUEST + AttributeDefinitions: + - AttributeName: !Ref DynamoKey + AttributeType: S + KeySchema: + - AttributeName: !Ref DynamoKey + KeyType: HASH + SSESpecification: + SSEEnabled: true +Outputs: + DynamoName: + Value: !Ref DynamoLab + Export: + Name: DynamoLab + DynamoNameArn: + Value: !GetAtt DynamoLab.Arn + Export: + Name: DynamoLabArn \ No newline at end of file diff --git a/lambda_function.py b/lambda_function.py index 40112c8..9c5fc1b 100644 --- a/lambda_function.py +++ b/lambda_function.py @@ -2,20 +2,21 @@ import os from boto3.dynamodb.conditions import Key -DYNAMO_PLATZI = os.environ['DYNAMO_PLATZI'] +# Hola a todos companeros estoy editando el codigo porque soy developer +DYNAMO_BD = os.environ['DYNAMO_BD'] class DynamoAccessor: def __init__(self, dynamo_table): dynamo_db = boto3.resource('dynamodb') self.table = dynamo_db.Table(dynamo_table) - def get_data_from_dynamo(self, cc): - response = self.table.query(KeyConditionExpression=Key('cc').eq(cc)) + def get_data_from_dynamo(self, dni): + response = self.table.query(KeyConditionExpression=Key('dni').eq(dni)) return response["Items"][0] if any(response["Items"]) else None def lambda_handler(event, context): - dynamo_backend = DynamoAccessor(DYNAMO_PLATZI) - db_element = dynamo_backend.get_data_from_dynamo(event['cc']) + dynamo_backend = DynamoAccessor(DYNAMO_BD) + db_element = dynamo_backend.get_data_from_dynamo(event['dni']) return db_element diff --git a/prereq/aws-codepipeline-prereq.sh b/prereq/aws-codepipeline-prereq.sh new file mode 100644 index 0000000..3c98935 --- /dev/null +++ b/prereq/aws-codepipeline-prereq.sh @@ -0,0 +1,7 @@ +#!/bin/bash +aws cloudformation deploy \ +--region us-east-1 \ +--stack-name codepipeline-lambda-prereq \ +--template-file ./aws-codepipeline-prereq.yml \ +--capabilities CAPABILITY_IAM \ +--capabilities CAPABILITY_NAMED_IAM \ No newline at end of file diff --git a/prereq/aws-codepipeline-prereq.yml b/prereq/aws-codepipeline-prereq.yml new file mode 100644 index 0000000..888b5c3 --- /dev/null +++ b/prereq/aws-codepipeline-prereq.yml @@ -0,0 +1,335 @@ +AWSTemplateFormatVersion: 2010-09-09 +Description: Codepipeline pre requisites + +Resources: + SNSapprovalprd: + Type: AWS::SNS::Topic + Properties: + TopicName: approval-prd + KMSKey: + Type: "AWS::KMS::Key" + Properties: + Enabled: true + KeyPolicy: + Version: "2012-10-17" + Statement: + - Sid: "Enable IAM User Permissions" + Effect: "Allow" + Principal: + AWS: !Sub arn:aws:iam::${AWS::AccountId}:root + Action: + - "kms:*" + Resource: "*" + - Sid: "Allow access for Key Administrators" + Effect: "Allow" + Principal: + AWS: + - !Sub arn:aws:iam::${AWS::AccountId}:root + Action: + - "kms:Create*" + - "kms:Describe*" + - "kms:Enable*" + - "kms:List*" + - "kms:Put*" + - "kms:Update*" + - "kms:Revoke*" + - "kms:Disable*" + - "kms:Get*" + - "kms:Delete*" + - "kms:TagResource" + - "kms:UntagResource" + - "kms:ScheduleKeyDeletion" + - "kms:CancelKeyDeletion" + Resource: "*" + + S3ArtifactsBucket: + Type: AWS::S3::Bucket + Properties: + BucketName: !Sub codepipeline-artifacts-bucket-${AWS::AccountId}-${AWS::Region} + + S3ArtifactsBucketPolicy: + Type: AWS::S3::BucketPolicy + Properties: + Bucket: !Ref S3ArtifactsBucket + PolicyDocument: + Version: "2012-10-17" + Id: SSEAndSSLPolicy + Statement: + - Sid: "" + Effect: Allow + Principal: + AWS: + - !GetAtt CodeBuildRole.Arn + - !GetAtt CodePipelineRole.Arn + Action: + - s3:Get* + - s3:Put* + Resource: !Sub "arn:aws:s3:::${S3ArtifactsBucket}/*" + + CodeBuildRole: + Type: AWS::IAM::Role + Properties: + AssumeRolePolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Principal: + Service: + - codebuild.amazonaws.com + Action: + - sts:AssumeRole + Path: "/service-role/" + Policies: + - PolicyName: codebuild-policy + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - ecr:GetAuthorizationToken + - ec2:CreateNetworkInterface + - ec2:DescribeDhcpOptions + - ec2:DescribeNetworkInterfaces + - ec2:DeleteNetworkInterface + - ec2:DescribeSubnets + - ec2:DescribeSecurityGroups + - ec2:DescribeVpcs + - ec2:CreateNetworkInterfacePermission + - lambda:* + - cloudformation:Describe* + - cloudformation:Get* + - cloudformation:List* + - cloudformation:ValidateTemplate + - cloudformation:ExecuteChangeSet + Resource: "*" + - Effect: Allow + Action: + - s3:* + - sqs:* + - sns:* + Resource: "*" + - Effect: Allow + Action: + - kms:* + Resource: + - !GetAtt KMSKey.Arn + - Effect: Allow + Action: + - logs:CreateLogGroup + - logs:CreateLogStream + - logs:PutLogEvents + Resource: + - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/* + + CodePipelineRole: + Type: AWS::IAM::Role + Properties: + AssumeRolePolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Principal: + Service: + - codepipeline.amazonaws.com + Action: + - sts:AssumeRole + Path: "/" + Policies: + - PolicyName: codepipeline-policy + PolicyDocument: + Version: "2012-10-17" + Statement: + - Effect: Allow + Action: + - s3:PutObject + - s3:GetObject + - s3:GetObjectVersion + - s3:GetBucketVersioning + Resource: + - !Sub "arn:aws:s3:::${S3ArtifactsBucket}/*" + - Effect: Allow + Action: + - codebuild:BatchGetBuilds + - codebuild:BatchGetProjects + - codebuild:ListBuilds + - codebuild:ListBuildsForProject + - codebuild:ListConnectedOAuthAccounts + - codebuild:ListProjects + - codebuild:ListRepositories + - codebuild:StartBuild + - codebuild:StopBuild + - sns:Publish + - cloudwatch:* + - lambda:InvokeFunction + - lambda:ListFunctions + - s3:* + - iam:PassRole + - cloudformation:DescribeStacks + Resource: "*" + - Effect: Allow + Action: + - kms:DescribeKey + - kms:GenerateDataKey* + - kms:Encrypt + - kms:ReEncrypt* + - kms:Decrypt + Resource: + - !GetAtt KMSKey.Arn + + LambdaPolicyEC2: + Type: AWS::IAM::ManagedPolicy + Properties: + PolicyDocument: + Version: 2012-10-17 + Statement: + - + Effect: Allow + Action: + - ec2:DisassociateAddress + - ec2:CreateDhcpOptions + - ec2:ReplaceRouteTableAssociation + - ec2:RunScheduledInstances + - ec2:RequestSpotFleet + - ec2:DisableVgwRoutePropagation + - ec2:AssociateVpcCidrBlock + - ec2:ReleaseHosts + - ec2:ReplaceRoute + - ec2:DisassociateVpcCidrBlock + - ec2:DeleteNetworkInterfacePermission + - ec2:DescribeNetworkInterfaces + - ec2:StartInstances + - ec2:DescribeNetworkInterfaceAttribute + - ec2:CreateRoute + - ec2:ReplaceNetworkAclEntry + - ec2:CreateSecurityGroup + - ec2:CreateNetworkAcl + - ec2:DescribeNetworkInterfacePermissions + - ec2:TerminateInstances + - ec2:AcceptVpcEndpointConnections + - ec2:DeleteNetworkInterface + - ec2:CreateRouteTable + - ec2:RunInstances + - ec2:StopInstances + - ec2:DisassociateRouteTable + - ec2:DisassociateSubnetCidrBlock + - ec2:ModifyHosts + - ec2:ReplaceNetworkAclAssociation + - ec2:CreateVolume + - ec2:CreateNetworkInterface + - ec2:DetachVpnGateway + - ec2:CreateDefaultVpc + - ec2:DisassociateIamInstanceProfile + - ec2:CreateVpcEndpoint + - ec2:DisableVpcClassicLink + - ec2:CreateSubnet + Resource: + - "*" + LambdaPolicyDynamo: + Type: AWS::IAM::ManagedPolicy + Properties: + PolicyDocument: + Version: 2012-10-17 + Statement: + - + Effect: Allow + Action: + - dynamodb:PutItem + - dynamodb:UpdateItem + - dynamodb:GetItem + - dynamodb:* + Resource: + - "*" + + LambdaPolicyCW: + Type: AWS::IAM::ManagedPolicy + Properties: + PolicyDocument: + Version: 2012-10-17 + Statement: + - + Effect: Allow + Action: + - logs:* + - cloudwatch:* + - xray:* + Resource: + - "*" + + LambdaRole: + Type: AWS::IAM::Role + Properties: + ManagedPolicyArns: + - !Ref LambdaPolicyDynamo + - !Ref LambdaPolicyEC2 + - !Ref LambdaPolicyCW + AssumeRolePolicyDocument: + Version: 2012-10-17 + Statement: + - + Effect: Allow + Principal: + Service: + - lambda.amazonaws.com + Action: + - sts:AssumeRole + Path: / + LambdaPolicyS3: + Type: AWS::IAM::ManagedPolicy + Properties: + PolicyDocument: + Version: 2012-10-17 + Statement: + - + Effect: Allow + Action: + - s3:ListAllMyBuckets + - s3:HeadBucket + - s3:ListObjects + Resource: + - "*" + - + Effect: Allow + Action: + - s3:* + Resource: + - "*" + + + +Outputs: + PipelineCMKey: + Value: !GetAtt KMSKey.Arn + Export: + Name: PipelineCMKey + PipelineRole: + Value: !GetAtt CodePipelineRole.Arn + Export: + Name: PipelineRole + CodeBuildRole: + Value: !GetAtt CodeBuildRole.Arn + Export: + Name: CodeBuildRole + S3ArtifactsBucket: + Value: !Ref S3ArtifactsBucket + Export: + Name: S3ArtifactsBucket + SNSapprovalprd: + Value: !Ref SNSapprovalprd + Export: + Name: SNSapprovalprd + LambdaPolicyDynamo: + Value: !Ref LambdaPolicyDynamo + Export: + Name: LambdaPolicyDynamo + LambdaPolicyEC2: + Value: !Ref LambdaPolicyEC2 + Export: + Name: LambdaPolicyEC2 + LambdaPolicyCW: + Value: !Ref LambdaPolicyCW + Export: + Name: LambdaPolicyCW + LambdaPolicyS3: + Value: !Ref LambdaPolicyS3 + Export: + Name: LambdaPolicyS3 diff --git a/template.yml b/template.yml index 4020258..42c1928 100644 --- a/template.yml +++ b/template.yml @@ -7,12 +7,12 @@ Resources: FunctionName: VotaNet Handler: lambda_function.lambda_handler Runtime: python3.7 - MemorySize: 256 - Timeout: 300 + MemorySize: 512 + Timeout: 400 Role: !GetAtt LambdaRole.Arn Environment: Variables: - DYNAMO_PLATZI: !ImportValue DynamoPlatzi + DYNAMO_BD: !ImportValue DynamoLab LambdaRole: Type: AWS::IAM::Role Properties: