无服务器框架1.0：将Cloudformation转换为Yaml for AWS Firehose

Question

Does anyone know of a definitive guide for converting cloudformation to yaml in Serverless v1.0?

I can make quite a few things work but I'm completely stuck on how to setup Firehose and allow a lambda to write to it.

I think the resources section would look something like this:

resources:
Resources:
  FirehoseBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-firehose-bucket
  FirehoseDeliveryStream:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamName: "FirehoseDeliveryStream"
      S3DestinationConfiguration:
        BucketARN:
          Fn::Join:
          - ''
          - - 'arn:aws:s3:::'
            - Ref: FirehoseBucket
        BufferingHints:
          IntervalInSeconds: 60
          SizeInMBs: 5
        CompressionFormat: GZIP
        Prefix: ${prefix}
        RoleARN: "arn:aws:iam::${account-number}:role/${project}-${env}-IamRoleLambda"

But I have no idea how to convert the Cloudformation for the IAM section, which is described here: http://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html .

Any pointers, examples or guides on CF->Yaml conversion much appreciated!

Answer 1

The IAM statements for the Lambda Execution Role (ie the role that the Lambda function assumes when executing) is not specified in the resources.

So if you need permissions to do something from inside your Lambda function you need to give the assumed role permission.

This is specified in the provider section. So in your case (I just copied something from your link, you will have to change it to what you need) it will be something like this (assuming nodejs runtime):

provider:
    name: aws
    runtime: nodejs4.3
    iamRoleStatements:
        - Effect: Allow
            Action:
                - firehose:DeleteDeliveryStream
                - firehose:PutRecord
                - firehose:PutRecordBatch
                - firehose:UpdateDestination
            Resource:
                - arn:aws:firehose:region:account-id:deliverystream/delivery-stream-name
        - Effect: Allow
            Action:
                - logs:PutLogEvents
            Resource:
                - arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name

Bonus: For general resources specified in cloud formation json format use an online converter from json to yaml. Much easier to get the started that way.