cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Lambda function to rotate SSH keys
Parameters:
  TagName:
    AllowedPattern: ^[a-zA-Z][-a-zA-Z0-9]*$
    Default: RotateSSH
    Description: Tag Name to locate Worker EC2 Instances to update with SSH Public
      Keys
    MaxLength: 255
    MinLength: 1
    Type: String
  TagValue:
    Default: 'true'
    Description: Tag Value to locate Worker EC2 Instances to update with SSH Public
      Keys
    MaxLength: 255
    MinLength: 1
    Type: String
  Usernames:
    AllowedPattern: ^([a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$))+(,([a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)))*$
    Default: ec2-user,ubuntu  # FIXME: Usernames for the Linux User that is used to log into the Workers
    Description: Usernames for the Linux user that is used to log into the Workers
    MaxLength: 64
    MinLength: 1
    Type: String
  S3Bucket:
    Default: 'deploy' # FIXME: Add the bucket name here. This S3 bucket will hold the public key
    Description: Bucket to keep the public key
    MaxLength: 255
    MinLength: 1
    Type: String
  S3File:
    Default: 'ssh/dev/public_key' # FIXME: S3 key of SSH public key
    Description: s3 path of the public key
    MaxLength: 255
    MinLength: 1
    Type: String
Resources:
  InvokePermission:
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Ref: RotateSSH
      Principal: secretsmanager.amazonaws.com
    Type: AWS::Lambda::Permission
  RotateSSH:
    Properties:
      CodeUri: s3://lambda-codes/rotate_ssh.zip # FIXME: S3 URI of the lambda code
      Description: Rotates SSH Keys
      Environment:
        Variables:
          TAGNAME:
            Ref: TagName
          TAGVALUE:
            Ref: TagValue
          USERNAMES:
            Ref: Usernames
          S3_BUCKET:
            Ref: S3Bucket
          S3_FILE:
            Ref: S3File
      FunctionName: RotateSSH
      Handler: rotate.lambda_handler
      MemorySize: 1536
      Policies:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      - arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess
      - Statement:
        - Action:
          - secretsmanager:DescribeSecret
          - secretsmanager:GetSecretValue
          - secretsmanager:PutSecretValue
          - secretsmanager:UpdateSecretVersionStage
          Condition:
            StringEquals:
              secretsmanager:resource/AllowRotationLambdaArn:
                Fn::Sub: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:RotateSSH
          Effect: Allow
          Resource:
            Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:/dev/ssh*
          Sid: SecretsManagerActions
        - Action:
            - s3:PutObject
          Effect: Allow
          Resource:
            Fn::Sub: arn:aws:s3:::deploy/*  # FIXME: Add the bucket ARN here. This S3 bucket will hold the public key
          Sid: S3Actions
        - Action:
            - "kms:Describe*"
            - kms:Decrypt
            - kms:GenerateDataKey
          Effect: Allow
          Resource:
            Fn::Sub: "*"
          Sid: KMSActions
        - Action:
          - ssm:SendCommand
          Effect: Allow
          Resource:
          - Fn::Sub: arn:aws:ssm:${AWS::Region}::document/AWS-RunShellScript
          Sid: SSMRunShellScriptDocument
        - Action:
          - ssm:SendCommand
          Condition:
            StringEquals:
              ssm:resourceTag/RotateSSHKeys:
                Ref: TagValue
          Effect: Allow
          Resource:
          - Fn::Sub: arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
          Sid: SSMRunShellScriptOnTaggedInstances
        - Action:
          - ssm:ListCommandInvocations
          - ssm:GetCommandInvocation
          - ssm:ListCommands
          - ssm:DescribeInstanceInformation
          Effect: Allow
          Resource: '*'
          Sid: SSMTrackCommands
        - Action:
          - ec2:DescribeInstances
          Effect: Allow
          Resource: '*'
          Sid: EC2DescribeInstances
        Version: '2012-10-17'
      Runtime: python3.6
      Timeout: 300
      VpcConfig:
        SecurityGroupIds:
          - 'sg-XXXXXXXXX' # FIXME: Security Group IDs of the Lambda function
        SubnetIds:
          - 'subnet-XXXXXXXXXX' # FIXME: Security Group Ids of the Lambda function
    Type: AWS::Serverless::Function
Transform: AWS::Serverless-2016-10-31