template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
    Chatbot provisioner

    Lex Provisioner SAM Template
Globals:
    Function:
        Timeout: 300

Resources:
    ManageLexRole:
        Type: 'AWS::IAM::Role'
        Properties:
            RoleName: "managed-lex-role"
            Path: '/'
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                    -   Effect: Allow
                        Principal:
                            Service:
                                - 'lambda.amazonaws.com'
                        Action:
                            - sts:AssumeRole
            Policies:
                -   PolicyName: "LambdaAddPermission"
                    PolicyDocument:
                        Version: 2012-10-17
                        Statement:
                            -   Effect: Allow
                                Action:
                                    - lambda:AddPermission
                                Resource: '*'
                -   PolicyName: "LexGet"
                    PolicyDocument:
                        Version: 2012-10-17
                        Statement:
                            -   Effect: Allow
                                Action:
                                    - lex:Get*
                                Resource: '*'
                -   PolicyName: "LexMutating"
                    PolicyDocument:
                        Version: 2012-10-17
                        Statement:
                            -   Effect: Allow
                                Action:
                                    - lex:Put*
                                    - lex:Delete*
                                    - lex:Create*
                                Resource:
                                    - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:bot:*:*"
                                    - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:intent:*:*"
                                    - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:slottype:*:*"
    LexProvisioner:
        Type: AWS::Serverless::Function
        DependsOn:
          - ManageLexRole
        Properties:
            Role: !GetAtt ManageLexRole.Arn
            CodeUri: src/
            Handler: app.lambda_handler
            Runtime: python3.7
            Environment:
                Variables:
                    CONFIRM: TRUE,
                    DEBUG: FALSE
    LogsForLambda:
        Type: 'AWS::IAM::Policy'
        Properties:
            PolicyName: "LogsForLexLambda"
            PolicyDocument:
                Version: '2012-10-17'
                Statement:
                -
                    Effect: Allow
                    Action:
                    - 'logs:CreateLogGroup'
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                    Resource:
                    - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
                    - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:*"
            Roles:
                - Ref: ManageLexRole
Outputs:
    LexProvisionerARN:
      Description: "Lambda Provisioner Function ARN"
      Value: !GetAtt LexProvisioner.Arn
      Export:
        Name: !Sub "${AWS::StackName}-LexProvisioner"
    ManageLexRole:
      Description: "Implicit IAM Role created for ManageLexRole function"
      Value: !GetAtt ManageLexRole.Arn