s3_add_permissions.json

{
"AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "Example CFN template to add an S3 event source to a Lambda function - using a Lambda backed custom resource to call 'AddPermission()'.",

  "Resources" : {
        "S3": {
          "Type": "AWS::S3::Bucket"
        },
      "ProcessS3events": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Handler": "index.handler",
          "Role": { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] },
          "Code": {
            "ZipFile":  { "Fn::Join": ["\n", [
                "console.log('Loading function')",
                "exports.handler = function(event, context) {",
                "    console.log('Received event:', JSON.stringify(event, null, 2))",
                "    context.succeed()",
                "}"
              ]]}
            },
          "Runtime": "nodejs",
          "Timeout": "25"
        }
      },
      "LambdaExecutionRole": {
         "Type": "AWS::IAM::Role",
         "Properties": {
            "AssumeRolePolicyDocument": { 
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Sid": "",
                    "Effect": "Allow",
                    "Principal": {
                      "Service": "lambda.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                  }
                ]
              },
          "Policies": [ {
                 "PolicyName": "root",
                 "PolicyDocument": {
                    "Version" : "2012-10-17",
                    "Statement": [
                                          {
                        "Effect": "Allow",
                        "Action": [
                          "logs:*"
                        ],
                        "Resource": "arn:aws:logs:*:*:*"
                      },
                      {
                        "Effect": "Allow",
                        "Action": [
                          "lambda:AddPermission",
                          "s3:PutBucketNotification"
                        ],
                        "Resource": [
                          "*"
                        ]
                      } 
                     ]
                 }
               } 
            ]
         }
      },
      "AddLambdaPermission": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Code": {
            "ZipFile":  { "Fn::Join": ["\n", [
                  "var response = require('cfn-response')",
                  "exports.handler = function(event, context) {",
                  "    console.log('REQUEST RECEIVED:\\n ' + JSON.stringify(event))",
                  "        if (event.RequestType == 'Delete') {",
                  "        response.send(event, context, 'SUCCESS')",
                  "        return",
                  "    }",
                  "    var aws = require('aws-sdk')",
                  "    var response_status = 'SUCCESS'",
                  "    ,   response_data = {}",
                  "    ,   lambda = new aws.Lambda({region: event.ResourceProperties.Region})",
                  "    ,   s3 = new aws.S3({apiVersion: '2006-03-01'})",
                  "    var params = {",
                  "        Action: event.ResourceProperties.Action",
                  "    ,   FunctionName: event.ResourceProperties.FunctionName",
                  "    ,   Principal: event.ResourceProperties.Principal",
                  "    ,   SourceAccount: event.ResourceProperties.SourceAccount",
                  "    ,   StatementId: event.ResourceProperties.FunctionName",
                  "    }",
                  "    lambda.addPermission(params, function(err, data) {",
                  "        if (err) {",
                  "            response_data = {Error: 'Add Permissions call failed'}",
                  "            console.log(response_data.Error + ':\\n', err)",
                  "        }",
                  "      else {",
                  "            var params = {",
                  "                Bucket: event.ResourceProperties.Bucket,",
                  "                NotificationConfiguration:  {",
                  "                      LambdaFunctionConfigurations: [",
                  "                      {",
                  "                          LambdaFunctionArn: event.ResourceProperties.FunctionArn,",
                  "                          Events: ['s3:ObjectCreated:*']",
                  "                      } ]",
                  "                }",
                  "            }",
                  "            s3.putBucketNotificationConfiguration(params, function(err, data) {",
                  "                if (err) {",
                  "                    response_data = {Error: 'S3 Notification Config call failed'}",
                  "                    console.log(response_data.Error + ':\\n', err)",
                  "                 }",
                  "                 else {",
                  "                     console.log(data)",
                  "                     response_status = 'SUCCESS'",
                  "                 }",
                  "                 response.send(event, context, response_status, response_data)",
                  "            })",
                  "        }",
                  "    })",
                  "}"
                ]]}
              },
          "Role": { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] },
          "Handler": "index.handler",
          "Runtime": "nodejs",
          "Timeout": "25"
        }
     },
     "ResourceRecordsFunction": {
      "Type": "Custom::ResourceRecordsFunction",
      "DependsOn": "AddLambdaPermission",
      "Properties": {
        "ServiceToken": { "Fn::GetAtt": [ "AddLambdaPermission", "Arn" ] },
        "Region": { "Ref": "AWS::Region" },
        "FunctionName": { "Ref" : "ProcessS3events" },
        "FunctionArn" : { "Fn::GetAtt" : ["ProcessS3events", "Arn"] },
        "Principal": "s3.amazonaws.com",
        "SourceAccount": { "Ref": "AWS::AccountId" },
        "Bucket": {"Ref": "S3" },
        "Action": "lambda:InvokeFunction"
      }
    }
  }
}