【2022年】とりあえず始めるAWSでLambda開発する時のSAMの設定公開

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  関数の説明
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 300
Parameters:
  Env:
    Type: String
    AllowedValues:
      - local
      - develop
      - staging
      - production
    Default: local
  MemorySize:
    Type: Number
    AllowedValues:
      - 128
      - 256
      - 512
      - 1024
    Default: 128

Mappings:
  Config:
    dev:
      LogRetentionInDays: 3
      securityGroupIds:
        - sg-xxxx
      subnetIds:
        - subnet-xxxx
        - subnet-yyyy
    stg:
      LogRetentionInDays: 7
      securityGroupIds:
        - sg-xxxx
      subnetIds:
        - subnet-xxxx
        - subnet-yyyy
    prd:
      LogRetentionInDays: 180
      securityGroupIds:
        - sg-xxxx
      subnetIds:
        - subnet-xxxx
        - subnet-yyyy

Resources:
  LambdaFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: !Sub 'FUNCTION_NAME-${Env}'
      Policies:
        - AmazonSSMReadOnlyAccess
        - KMSDecryptPolicy:
            KeyId: "xxxx-yyyy-zzzz"
      MemorySize: !Ref MemorySize
      Tags:
        Name: !Sub "FUNCTION_NAME-${Env}"
        Env: !Ref Env
      Environment:
        Variables:
          SMV_ENV: !Ref Env
          TZ: "Asia/Tokyo"
      VpcConfig:
        SecurityGroupIds: !FindInMap [ Config, !Ref Env, securityGroupIds ]
        SubnetIds: !FindInMap [ Config, !Ref Env, subnetIds ]
      CodeUri: ./
      Handler: ./src/index.handler
      Runtime: nodejs14.x
  LambdaConfig:
    Type: AWS::Lambda::EventInvokeConfig
    Properties:
      FunctionName: !Ref LambdaFunction
      MaximumEventAgeInSeconds: 300
      MaximumRetryAttempts: 0
      Qualifier: $LATEST
  LambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${LambdaFunction}'
      RetentionInDays: !FindInMap [ Config, !Ref Env, LogRetentionInDays ]
    DependsOn: LambdaFunction
  LambdaLogGroupPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Sub
        - error-log-notify:${Env}
        - {Env: !Ref Env}
      Action: lambda:InvokeFunction
      Principal: logs.ap-northeast-1.amazonaws.com
      SourceAccount: 'xxxxxxxx'
      SourceArn: !GetAtt LambdaLogGroup.Arn
    DependsOn: LambdaLogGroup
  LambdaLogGroupSubscription:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      DestinationArn: !Sub
        - エラーログ通知用LambdaのArn:${Env}
        - {Env: !Ref Env}
      FilterPattern: 'ERROR'
      LogGroupName: !Sub '/aws/lambda/${LambdaFunction}'
    DependsOn: LambdaLogGroupPermission

Policies:
        - AmazonSSMReadOnlyAccess
        - KMSDecryptPolicy:
            KeyId: "xxxx-yyyy-zzzz"

LambdaConfig:
    Type: AWS::Lambda::EventInvokeConfig
    Properties:
      FunctionName: !Ref LambdaFunction
      MaximumEventAgeInSeconds: 300
      MaximumRetryAttempts: 0
      Qualifier: $LATEST