How do I add a Lambda Function with an S3 Trigger in CloudFormation?

Question

I've been working with CloudFormation YAML for awhile and have found it to be comprehensive - until now. I'm struggling in trying to use SAM/CloudFormation to create a Lambda function that is triggered whenever an object is added to an existing S3 bucket.

All of the examples I've seen thus far seem to require that you create the bucket in the same CloudFormation script as you create the Lambda function. This doesn't work for me, because we have a design goal to be able to use CloudFormation redeploy our entire stack to different regions or AWS accounts and quickly stand up our application. S3 bucket names must be globally unique, so if I create the bucket in CloudFormation, the script will break when I try to deploy it to a different region/account. I could probably get around this by creating buckets with the account name/region in the name, but that's just not desirable from a bucket sprawl perspective.

So, does anyone have a solution for creating a Lambda function in CloudFormation that is triggered by objects being written to an existing S3 bucket?

Thanks!

Answer 1

This is impossible, according to the SAM team . This is something which the underlying CloudFormation service can't do.

There is a possible workaround, if you implement a Custom resource which would trigger a separate Lambda function to modify the existing bucket and link it to the Lambda function that you want to deploy.

As "implement a Custom Resource" isn't very specific: Here is an AWS github repo with scaffold code to help write it , and then you declare something like the following in your template (where LambdaToBucket ) is the custom function you wrote. I've found that you need to configure two things in that function: one is a bucket notification configuration on the bucket (saying tell Lambda about changes), the other is a Lambda Permission on the function (saying allow invocations from S3).

    Resources:
      JoinLambdaToBucket:
      Type: Custom::JoinLambdaToExistingBucket
      Properties:
        ServiceToken: !GetAtt LambdaToBucket.Arn