cross-account-lambda.yml

AWSTemplateFormatVersion: '2010-09-09-OC'

# Include file that contains Organization Section.
# The Organization Section describes Accounts, Organizational Units, etc.
Organization: !Include ../organization.yml

# Any Binding that does not explicitly specify a region will default to this.
# Value can be either string or list
DefaultOrganizationBindingRegion: eu-central-1


Parameters:

  resourcePrefix:
    Type: String
    Default: my

  functionName:
    Type: String

  functionAccount:
    Type: String
    Default: !Ref SharedServicesAccount

# Section contains a named set of Bindings.
# Bindings determine what resources are deployed where
# These bindings can be !Ref'd from the Resources in the resource section
OrganizationBindings:

  # Binding for: InvokeFunctionPolicy
  # Function assumed to already be present in account
  FunctionAccountBinding:
    Account: !Ref functionAccount

  # Binding for: InvokePermissions
  InvokePermissionAccountBinding:
    Account: '*'
    ExcludeAccount: !Ref functionAccount


Resources:

  InvokeFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    OrganizationBinding: !Ref InvokePermissionAccountBinding
    Properties:
      ManagedPolicyName: !Sub '${resourcePrefix}-${functionName}-invoke-policy'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: lambda:InvokeFunction
            Resource: !Sub 'arn:aws:lambda:*:${functionAccount}:function:${functionName}'

  InvokePermissions:
    Type: AWS::Lambda::Permission
    OrganizationBinding: !Ref FunctionAccountBinding
    ForeachAccount: !Ref InvokePermissionAccountBinding
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref functionName
      Principal: !Ref CurrentAccount