sns_add_permissions.json

{
"AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "Example CFN template to add an SNS event source to a Lambda function - using a Lambda backed custom resource to call 'AddPermission()'.",

  "Resources" : {
        "TestSNSTopic": {
          "Type": "AWS::SNS::Topic",
          "Properties": {
            "Subscription": [ {
                "Endpoint":  { "Fn::GetAtt" : [ "ProcessSNSMessages", "Arn" ] },
                "Protocol": "lambda"
              } ],
            "TopicName": "TestSNSTopic1"
          }
        },
      "ProcessSNSMessages": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Handler": "index.handler",
          "Role": { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] },
          "Code": {
            "ZipFile":  { "Fn::Join": ["\n", [
                "console.log('Loading function')",
                "exports.handler = function(event, context) {",
                "    console.log('Received event:', JSON.stringify(event, null, 2))",
                "    context.succeed()",
                "}"
              ]]}
            },
          "Runtime": "nodejs",
          "Timeout": "25"
        }
      },
      "LambdaExecutionRole": {
         "Type": "AWS::IAM::Role",
         "Properties": {
            "AssumeRolePolicyDocument": { 
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Sid": "",
                    "Effect": "Allow",
                    "Principal": {
                      "Service": "lambda.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                  }
                ]
              },
          "Policies": [ {
                 "PolicyName": "root",
                 "PolicyDocument": {
                    "Version" : "2012-10-17",
                    "Statement": [
                                          {
                        "Effect": "Allow",
                        "Action": [
                          "logs:*"
                        ],
                        "Resource": "arn:aws:logs:*:*:*"
                      },
                      {
                        "Effect": "Allow",
                        "Action": [
                          "lambda:AddPermission"
                        ],
                        "Resource": [
                          "*"
                        ]
                      } 
                     ]
                 }
               } 
            ]
         }
      },
      "AddLambdaPermission": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Code": {
            "ZipFile":  { "Fn::Join": ["\n", [
                  "var response = require('cfn-response')",
                  "exports.handler = function(event, context) {",
                  "    console.log('REQUEST RECEIVED:\\n ' + JSON.stringify(event))",
                  "        if (event.RequestType == 'Delete') {",
                  "        response.send(event, context, 'SUCCESS')",
                  "        return",
                  "    }",
                  "    var aws = require('aws-sdk')",
                  "    var response_status = 'SUCCESS'",
                  "    ,   response_data = {}",
                  "    ,   function_name = event.ResourceProperties.FunctionName",
                  "    ,   principal = event.ResourceProperties.Principal",
                  "    ,   action = event.ResourceProperties.Action",
                  "    ,   source_arn = event.ResourceProperties.SourceArn",
                  "    ,   lambda = new aws.Lambda({region: event.ResourceProperties.Region})",    
                  "    var params = {",
                  "        Action: action",
                  "    ,   FunctionName: function_name",
                  "    ,   Principal: principal",
                  "    ,   SourceArn: source_arn",
                  "    ,   StatementId: function_name",
                  "    }",
                  "    lambda.addPermission(params, function(err, data) {",
                  "        if (err) {",
                  "            response_data = {Error: 'Add Permissions call failed'}",
                  "            console.log(response_data.Error + ':\\n', err)",
                  "        }",
                  "      else {",
                  "            console.log(data)",
                  "            response_status = 'SUCCESS'",
                  "        }",
                  "        response.send(event, context, response_status, response_data)",
                  "    })",
                  "}"
                ]]}
              },
          "Role": { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] },
          "Handler": "index.handler",
          "Runtime": "nodejs",
          "Timeout": "25"
        }
     },
     "ResourceRecordsFunction": {
      "Type": "Custom::ResourceRecordsFunction",
      "DependsOn": "AddLambdaPermission",
      "Properties": {
        "ServiceToken": { "Fn::GetAtt": [ "AddLambdaPermission", "Arn" ] },
        "Region": { "Ref": "AWS::Region" },
        "FunctionName": { "Ref" : "ProcessSNSMessages" },
        "Principal": "sns.amazonaws.com",
        "SourceArn": { "Ref": "TestSNSTopic" },
        "Action": "lambda:InvokeFunction"
      }
    }
  }
}