Added 'packaged' CFN template

Author: Ranganath

secretsmanager_rotate_ssh_keys_packaged.yaml

@@ -0,0 +1,113 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Lambda function to rotate SSH keys
+Parameters:
+  MasterWorkersStack:
+    AllowedPattern: ^[a-zA-Z][-a-zA-Z0-9]*$
+    Default: MasterWorkers
+    Description: CloudFormation Stack Name for Master and Workers
+    MaxLength: 255
+    MinLength: 1
+    Type: String
+  TagName:
+    AllowedPattern: ^[a-zA-Z][-a-zA-Z0-9]*$
+    Default: RotateSSHKeys
+    Description: Tag Name to locate Worker EC2 Instances to update with SSH Public
+      Keys
+    MaxLength: 255
+    MinLength: 1
+    Type: String
+  TagValue:
+    Default: 'True'
+    Description: Tag Value to locate Worker EC2 Instances to update with SSH Public
+      Keys
+    MaxLength: 255
+    MinLength: 1
+    Type: String
+  Username:
+    AllowedPattern: ^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)$
+    Default: ec2-user
+    Description: Username for the Linux user that is used to log into the Workers
+    MaxLength: 32
+    MinLength: 1
+    Type: String
+Resources:
+  InvokePermission:
+    Properties:
+      Action: lambda:InvokeFunction
+      FunctionName:
+        Ref: RotateSSH
+      Principal: secretsmanager.amazonaws.com
+    Type: AWS::Lambda::Permission
+  RotateSSH:
+    Properties:
+      CodeUri: s3://awsiammedia/public/sample/SecretsManagerStoreRotateSSHKeyPairs/rotate_ssh.zip
+      Description: Rotates SSH Keys
+      Environment:
+        Variables:
+          TAGNAME:
+            Ref: TagName
+          TAGVALUE:
+            Ref: TagValue
+          USERNAME:
+            Ref: Username
+      FunctionName: RotateSSH
+      Handler: rotate.lambda_handler
+      MemorySize: 1536
+      Policies:
+      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+      - arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess
+      - Statement:
+        - Action:
+          - secretsmanager:DescribeSecret
+          - secretsmanager:GetSecretValue
+          - secretsmanager:PutSecretValue
+          - secretsmanager:UpdateSecretVersionStage
+          Condition:
+            StringEquals:
+              secretsmanager:resource/AllowRotationLambdaArn:
+                Fn::Sub: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:RotateSSH
+          Effect: Allow
+          Resource:
+            Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:/dev/ssh*
+          Sid: SecretsManagerActions
+        - Action:
+          - ssm:SendCommand
+          Effect: Allow
+          Resource:
+          - Fn::Sub: arn:aws:ssm:${AWS::Region}::document/AWS-RunShellScript
+          Sid: SSMRunShellScriptDocument
+        - Action:
+          - ssm:SendCommand
+          Condition:
+            StringEquals:
+              ssm:resourceTag/RotateSSHKeys:
+                Ref: TagValue
+          Effect: Allow
+          Resource:
+          - Fn::Sub: arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
+          Sid: SSMRunShellScriptOnTaggedInstances
+        - Action:
+          - ssm:ListCommandInvocations
+          - ssm:GetCommandInvocation
+          - ssm:ListCommands
+          - ssm:DescribeInstanceInformation
+          Effect: Allow
+          Resource: '*'
+          Sid: SSMTrackCommands
+        - Action:
+          - ec2:DescribeInstances
+          Effect: Allow
+          Resource: '*'
+          Sid: EC2DescribeInstances
+        Version: '2012-10-17'
+      Runtime: python3.6
+      Timeout: 300
+      VpcConfig:
+        SecurityGroupIds:
+        - Fn::ImportValue:
+            Fn::Sub: ${MasterWorkersStack}-MasterSecurityGroup
+        SubnetIds:
+        - Fn::ImportValue:
+            Fn::Sub: ${MasterWorkersStack}-PrivateSubnet
+    Type: AWS::Serverless::Function
+Transform: AWS::Serverless-2016-10-31