lambda-cloudformation.yaml

#  Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
#  the License. A copy of the License is located at
#      http://aws.amazon.com/apache2.0/
#  or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
#  CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and
#  limitations under the License.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: automated cleanup of ECR repositories
Resources:
  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: main.handler
      Runtime: python2.7
      Description: ECR Cleanup Lambda
      CodeUri: ./
      MemorySize: 128
      Timeout: 300
      Role: !GetAtt LAMBDAROLE.Arn
      Events:
        Schedule:
          Type: Schedule
          Properties:
            Schedule: cron(0 22 * * ? *)
      Environment:
        Variables:
          REGION: None
          DRYRUN: True
          IMAGES_TO_KEEP: 100
  LAMBDAROLE:
      Type: AWS::IAM::Role
      Properties:
        #RoleName: !Sub ${AWS::StackName}-Role-${AWS::Region}
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            -
              Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                  - sts:AssumeRole
        Path: /
  LAMBDAPOLICY:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-Policy-${AWS::Region}
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          -
            Effect: Allow
            Action:
              - ecr:BatchDeleteImage
              - ecr:DescribeRepositories
              - ecr:ListImages
              - ecr:DescribeImages
              - ecs:DescribeClusters
              - ecs:DescribeTaskDefinition
              - ecs:DescribeTasks
              - ecs:ListClusters
              - ecs:ListTaskDefinitions
              - ecs:ListTasks
            Resource: "*"
      Roles:
        -
          !Ref LAMBDAROLE