Skip to content

Commit 79e88e7

Browse files
atjohnsatjohns
authored
Merge pull request #738 from aws-samples/feature/vpc-support
Feature/vpc support
2 parents f59ea92 + f6fdc00 commit 79e88e7

File tree

6 files changed

+231
-12
lines changed

6 files changed

+231
-12
lines changed

‎templates/codebuild-deploy.yaml‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -545,6 +545,16 @@ Parameters:
545545
Default: ''
546546
Description: >
547547
If enabling upload, the name of the S3 bucket where uploaded documents should be stored
548+
549+
VpcSubnetId:
550+
Type: String
551+
Default: ''
552+
Description: ID of a VPC subnet where all Lambda functions will run, only used if you need Lambda to run in a VPC
553+
554+
VpcSecurityGroupId:
555+
Type: String
556+
Default: ''
557+
Description: ID of a security group where all Lambda functions will run, only used if you need Lambda to run in a VPC
548558

549559
Conditions:
550560
NeedsParentOrigin: !Equals [!Ref ParentOrigin, '']
@@ -554,6 +564,7 @@ Conditions:
554564
ShouldNotSpecifyWafAcl: !Equals [!Ref WebAppWafAclArn, '']
555565
EnableStreaming: !Equals [!Ref AllowStreamingResponses, true]
556566
EnableUpload: !Equals [!Ref ShouldEnableUpload, true]
567+
NeedsVpc: !And [ !Not [ !Equals [!Ref VpcSubnetId, ''] ], !Not [ !Equals [!Ref VpcSecurityGroupId, ''] ] ]
557568

558569
Resources:
559570
# Bucket where S3 access logs are stored
@@ -769,6 +780,8 @@ Resources:
769780
InitiateChatLambdaCodeObject: !Ref InitiateChatLambdaCodeObject
770781
ConnectContactFlowId: !Ref ConnectContactFlowId
771782
ConnectInstanceId: !Ref ConnectInstanceId
783+
VpcSubnetId: !Ref VpcSubnetId
784+
VpcSecurityGroupId: !Ref VpcSecurityGroupId
772785
ParentOrigin:
773786
!If
774787
- UseDefaultCloudfrontUrl
@@ -786,6 +799,8 @@ Resources:
786799
SourceBucket: !Ref SourceBucket
787800
StreamingLambdaCodeObject: !Ref StreamingLambdaCodeObject
788801
TableName: !Join ["-", [!Ref "AWS::StackName", "streaming"]]
802+
VpcSubnetId: !Ref VpcSubnetId
803+
VpcSecurityGroupId: !Ref VpcSecurityGroupId
789804
ParentOrigin:
790805
!If
791806
- UseDefaultCloudfrontUrl
@@ -1032,8 +1047,17 @@ Resources:
10321047

10331048
# Lambda function for custom resource
10341049
CodeBuildStarterLambda:
1035-
Type: AWS::Lambda::Function
1050+
Type: AWS::Lambda::Function
10361051
Properties:
1052+
VpcConfig:
1053+
!If
1054+
- NeedsVpc
1055+
-
1056+
SecurityGroupIds:
1057+
- !Ref VpcSecurityGroupId
1058+
SubnetIds:
1059+
- !Ref VpcSubnetId
1060+
- !Ref "AWS::NoValue"
10371061
Code:
10381062
S3Bucket: !Ref SourceBucket
10391063
S3Key: !Ref CustomResourceCodeObject
@@ -1128,6 +1152,12 @@ Resources:
11281152
Type: AWS::IAM::Role
11291153
Properties:
11301154
Path: /
1155+
ManagedPolicyArns:
1156+
!If
1157+
- NeedsVpc
1158+
-
1159+
- "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
1160+
- !Ref "AWS::NoValue"
11311161
AssumeRolePolicyDocument:
11321162
Version: 2012-10-17
11331163
Statement:
@@ -1184,14 +1214,24 @@ Resources:
11841214
Condition: ShouldCleanupBuckets
11851215
Properties:
11861216
ServiceToken: !GetAtt S3CleanupLambda.Arn
1217+
ServiceTimeout: 60
11871218
Buckets:
11881219
- !Ref WebAppBucket
11891220

11901221
# Lambda function for custom resource
11911222
S3CleanupLambda:
11921223
Type: AWS::Lambda::Function
1193-
Condition: ShouldCleanupBuckets
1224+
Condition: ShouldCleanupBuckets
11941225
Properties:
1226+
VpcConfig:
1227+
!If
1228+
- NeedsVpc
1229+
-
1230+
SecurityGroupIds:
1231+
- !Ref VpcSecurityGroupId
1232+
SubnetIds:
1233+
- !Ref VpcSubnetId
1234+
- !Ref "AWS::NoValue"
11951235
Code:
11961236
S3Bucket: !Ref SourceBucket
11971237
S3Key: !Ref CustomResourceCodeObject
@@ -1207,6 +1247,12 @@ Resources:
12071247
Condition: ShouldCleanupBuckets
12081248
Properties:
12091249
Path: /
1250+
ManagedPolicyArns:
1251+
!If
1252+
- NeedsVpc
1253+
-
1254+
- "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
1255+
- !Ref "AWS::NoValue"
12101256
AssumeRolePolicyDocument:
12111257
Version: 2012-10-17
12121258
Statement:

‎templates/cognitouserpoolconfig.yaml‎

Lines changed: 55 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,19 @@ Parameters:
3535
Type: Number
3636
Description: >
3737
This is a required parameter.
38+
39+
VpcSubnetId:
40+
Type: String
41+
Default: ''
42+
Description: ID of a VPC subnet where all Lambda functions will run, only used if you need Lambda to run in a VPC
43+
44+
VpcSecurityGroupId:
45+
Type: String
46+
Default: ''
47+
Description: ID of a security group where all Lambda functions will run, only used if you need Lambda to run in a VPC
48+
49+
Conditions:
50+
NeedsVpc: !And [ !Not [ !Equals [!Ref VpcSubnetId, ''] ], !Not [ !Equals [!Ref VpcSecurityGroupId, ''] ] ]
3851

3952
Resources:
4053

@@ -44,8 +57,17 @@ Resources:
4457
ServiceToken: !GetAtt CognitoUserPoolDomainFunction.Arn
4558

4659
CognitoUserPoolDomainFunction:
47-
Type: AWS::Lambda::Function
60+
Type: AWS::Lambda::Function
4861
Properties:
62+
VpcConfig:
63+
!If
64+
- NeedsVpc
65+
-
66+
SecurityGroupIds:
67+
- !Ref VpcSecurityGroupId
68+
SubnetIds:
69+
- !Ref VpcSubnetId
70+
- !Ref "AWS::NoValue"
4971
Handler: index.handler
5072
Role: !GetAtt CognitoUserPoolDomainExecutionRole.Arn
5173
Runtime: python3.10
@@ -146,6 +168,12 @@ Resources:
146168
Type: AWS::IAM::Role
147169
Properties:
148170
Path: /
171+
ManagedPolicyArns:
172+
!If
173+
- NeedsVpc
174+
-
175+
- "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
176+
- !Ref "AWS::NoValue"
149177
AssumeRolePolicyDocument:
150178
Version: 2012-10-17
151179
Statement:
@@ -224,8 +252,17 @@ Resources:
224252
Timestamp: !Ref Timestamp
225253

226254
CognitoUserPoolUpdatesFunction:
227-
Type: AWS::Lambda::Function
255+
Type: AWS::Lambda::Function
228256
Properties:
257+
VpcConfig:
258+
!If
259+
- NeedsVpc
260+
-
261+
SecurityGroupIds:
262+
- !Ref VpcSecurityGroupId
263+
SubnetIds:
264+
- !Ref VpcSubnetId
265+
- !Ref "AWS::NoValue"
229266
Handler: index.handler
230267
Role: !GetAtt CognitoUserPoolDomainExecutionRole.Arn
231268
Runtime: python3.10
@@ -316,6 +353,12 @@ Resources:
316353
Type: AWS::IAM::Role
317354
Properties:
318355
Path: /
356+
ManagedPolicyArns:
357+
!If
358+
- NeedsVpc
359+
-
360+
- "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
361+
- !Ref "AWS::NoValue"
319362
AssumeRolePolicyDocument:
320363
Version: 2012-10-17
321364
Statement:
@@ -364,8 +407,17 @@ Resources:
364407
Properties:
365408
ServiceToken: !GetAtt CleanStackNameFunction.Arn
366409
CleanStackNameFunction:
367-
Type: AWS::Lambda::Function
410+
Type: AWS::Lambda::Function
368411
Properties:
412+
VpcConfig:
413+
!If
414+
- NeedsVpc
415+
-
416+
SecurityGroupIds:
417+
- !Ref VpcSecurityGroupId
418+
SubnetIds:
419+
- !Ref VpcSubnetId
420+
- !Ref "AWS::NoValue"
369421
Handler: index.handler
370422
Role: !GetAtt CleanStackNameExecutionRole.Arn
371423
Runtime: python3.10

‎templates/lexbot.yaml‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,21 @@ Parameters:
5151
Type: String
5252
Default: aws-bigdata-blog
5353

54+
VpcSubnetId:
55+
Type: String
56+
Default: ''
57+
Description: ID of a VPC subnet where all Lambda functions will run, only used if you need Lambda to run in a VPC
58+
59+
VpcSecurityGroupId:
60+
Type: String
61+
Default: ''
62+
Description: ID of a security group where all Lambda functions will run, only used if you need Lambda to run in a VPC
63+
5464
Conditions:
5565
EnableQBusiness: !Not [!Equals [!Ref AmazonQAppId, '']]
5666
ExampleBot: !Equals [!Ref AmazonQAppId, '']
5767
DeleteBot: !Equals [!Ref ShouldDeleteBot, true]
68+
NeedsVpc: !And [ !Not [ !Equals [!Ref VpcSubnetId, ''] ], !Not [ !Equals [!Ref VpcSecurityGroupId, ''] ] ]
5869

5970
Resources:
6071
ExampleBotRuntimeRole:
@@ -367,7 +378,13 @@ Resources:
367378
Service: lambda.amazonaws.com
368379
Action: sts:AssumeRole
369380
ManagedPolicyArns:
370-
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
381+
!If
382+
- NeedsVpc
383+
-
384+
- "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
385+
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
386+
-
387+
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
371388
Policies:
372389
- PolicyDocument:
373390
Version: 2012-10-17
@@ -436,8 +453,17 @@ Resources:
436453

437454
QnaBusinessLambdaFulfillmentFunction:
438455
Type: AWS::Lambda::Function
439-
Condition: EnableQBusiness
456+
Condition: EnableQBusiness
440457
Properties:
458+
VpcConfig:
459+
!If
460+
- NeedsVpc
461+
-
462+
SecurityGroupIds:
463+
- !Ref VpcSecurityGroupId
464+
SubnetIds:
465+
- !Ref VpcSubnetId
466+
- !Ref "AWS::NoValue"
441467
FunctionName: !Join ["-", [!Ref ParentStackName, "Fulfillment-Lambda"]]
442468
Handler: index.lambda_handler
443469
Role: !GetAtt 'LambdaFunctionRole.Arn'

‎templates/master.yaml‎

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -589,6 +589,17 @@ Parameters:
589589
This process is not automated because in many use cases Identity Center will not be in the same account as the bot.
590590
Manual set-up instructions can be found here: https://github.com/aws-samples/aws-lex-web-ui/blob/master/README-qbusiness.md
591591
592+
VpcSubnetId:
593+
Type: String
594+
Default: ''
595+
Description: ID of a VPC subnet where all Lambda functions will run, only used if you need Lambda to run in a VPC
596+
597+
VpcSecurityGroupId:
598+
Type: String
599+
Default: ''
600+
Description: ID of a security group where all Lambda functions will run, only used if you need Lambda to run in a VPC
601+
602+
592603
Rules:
593604
ValidateEitherV1orV2:
594605
RuleCondition: !Not
@@ -697,6 +708,11 @@ Metadata:
697708
- BotChatBubble
698709
- CustomerChatBubble
699710
- MinimizedButtonColor
711+
- Label:
712+
default: Lambda VPC Support
713+
Parameters:
714+
- VpcSubnetId
715+
- VpcSecurityGroupId
700716
- Label:
701717
default: Q Business Parameters
702718
Parameters:
@@ -706,6 +722,7 @@ Metadata:
706722
Conditions:
707723
IsLexV2: !Not [ !Equals [!Ref LexV2BotId, ''] ]
708724
NeedsBot: !And [ !Equals [!Ref BotName, ''], !Equals [!Ref LexV2BotId, ''] ]
725+
NeedsVpc: !And [ !Not [ !Equals [!Ref VpcSubnetId, ''] ], !Not [ !Equals [!Ref VpcSecurityGroupId, ''] ] ]
709726
NeedsCognito: !Equals [!Ref CognitoIdentityPoolId, '']
710727
NeedsParentOrigin: !Equals [!Ref WebAppParentOrigin, '']
711728
ShouldForceCognitoLogin: !Equals [!Ref ForceCognitoLogin, true]
@@ -726,6 +743,8 @@ Resources:
726743
QBusinessLambdaCodeObject: !Sub "${BootstrapPrefix}/qbusiness-lambda-v0.21.5.zip"
727744
AmazonQAppId: !Ref AmazonQAppId
728745
IDCApplicationARN: !Ref IDCApplicationARN
746+
VpcSubnetId: !Ref VpcSubnetId
747+
VpcSecurityGroupId: !Ref VpcSecurityGroupId
729748

730749
CognitoIdentityPool:
731750
Type: AWS::CloudFormation::Stack
@@ -860,7 +879,9 @@ Resources:
860879
AllowStreamingResponses: !Ref AllowStreamingResponses
861880
ShouldEnableUpload: !Ref ShouldEnableUpload
862881
UploadBucket: !Ref UploadBucket
863-
Timestamp: 1723566731
882+
VpcSubnetId: !Ref VpcSubnetId
883+
VpcSecurityGroupId: !Ref VpcSecurityGroupId
884+
Timestamp: 1726069319
864885

865886
CognitoIdentityPoolConfig:
866887
Type: AWS::CloudFormation::Stack
@@ -874,14 +895,25 @@ Resources:
874895
CodeBuildProjectName: !GetAtt CodeBuildDeploy.Outputs.CodeBuildProject
875896
CognitoUserPool: !GetAtt CognitoIdentityPool.Outputs.CognitoUserPoolId
876897
CognitoUserPoolClient: !GetAtt CognitoIdentityPool.Outputs.CognitoUserPoolClientId
877-
Timestamp: 1723566731
898+
VpcSubnetId: !Ref VpcSubnetId
899+
VpcSecurityGroupId: !Ref VpcSecurityGroupId
900+
Timestamp: 1726069319
878901

879902
##########################################################################
880903
# Lambda that will validate if user has put in an invalid CSS color/Hex string and fail deployment
881904
##########################################################################
882905
CSSValidationLambda:
883-
Type: AWS::Lambda::Function
906+
Type: AWS::Lambda::Function
884907
Properties:
908+
VpcConfig:
909+
!If
910+
- NeedsVpc
911+
-
912+
SecurityGroupIds:
913+
- !Ref VpcSecurityGroupId
914+
SubnetIds:
915+
- !Ref VpcSubnetId
916+
- !Ref "AWS::NoValue"
885917
Description: 'Lambda invoke wrapper for Custom CFN actions'
886918
Code:
887919
ZipFile: !Sub |
@@ -928,6 +960,12 @@ Resources:
928960
Type: AWS::IAM::Role
929961
Properties:
930962
Path: /
963+
ManagedPolicyArns:
964+
!If
965+
- NeedsVpc
966+
-
967+
- "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
968+
- !Ref "AWS::NoValue"
931969
AssumeRolePolicyDocument:
932970
Version: 2012-10-17
933971
Statement:
@@ -957,6 +995,7 @@ Resources:
957995
Version: "1.0"
958996
Properties:
959997
ServiceToken: !GetAtt CSSValidationLambda.Arn
998+
ServiceTimeout: 60
960999
MessageTextColor: !Ref MessageTextColor
9611000
ChatBackgroundColor: !Ref ChatBackgroundColor
9621001
ToolbarColor: !Ref ToolbarColor

0 commit comments

Comments
 (0)