template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  EC2 Instance Starter

Parameters:
  IsSkippedAuthorizer:
    Type: String
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'

Globals:
  Function:
    Timeout: 3

Resources:
  EC2InstanceStarterApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: v1
      Auth:
        DefaultAuthorizer: LambdaAuthorization
        Authorizers:
          LambdaAuthorization:
            FunctionArn: !GetAtt Authorizer.Arn
            Identity:
              ReauthorizeEvery: 0

  Authorizer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/
      Handler: auth.lambda_handler
      Runtime: python3.9
      Environment:
        Variables:
          IS_SKIPPED: !Ref IsSkippedAuthorizer
      Policies:
        - Statement:
          - Sid: DescribeIAMUserAccessKeys
            Effect: Allow
            Action:
              - iam:ListUsers
              - iam:ListAccessKeys
            Resource: "*"

  EC2InstanceStarter:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/
      Handler: app.lambda_handler
      Runtime: python3.9
      Architectures:
        - x86_64
      Events:
        StartEC2Instance:
          Type: Api
          Properties:
            RestApiId: !Ref EC2InstanceStarterApi
            Path: /start
            Method: post
      Policies:
        - Statement:
          - Sid: StartEC2Instance
            Effect: Allow
            Action:
              - ec2:StartInstances
            Resource:
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
          - Sid: DescribeEC2Instances
            Effect: Allow
            Action:
              - ec2:DescribeInstances
            Resource: "*"

Outputs:
  EC2InstanceStarterApi:
    Description: "API Gateway endpoint URL for Prod stage for EC2 Instance Starter function"
    Value: !Sub "https://${EC2InstanceStarterApi}.execute-api.${AWS::Region}.amazonaws.com/v1/start/"
  EC2InstanceStarterIamRoleArn:
    Description: "Implicit IAM Role created for EC2 Instance Starter function"
    Value: !GetAtt EC2InstanceStarterRole.Arn