template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Lambda2SQS

Globals:
  Function:
    Runtime: go1.x

Parameters:
  DefaultSecurityGroup:
    Type: String
    Default: sg-66390301
  PrivateSubnets:
    Type: String
    Default: >
      subnet-0ff046ccc4e3b6281,subnet-0938728dfb344b970,subnet-0e123bd457c082cff

Resources:
  Push:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: ut_lambda2sqs_push
      Role: !GetAtt LambdaRole.Arn
      CodeUri: .
      Handler: push-bin
      Runtime: go1.x
      Environment:
        Variables:
          SQS_URL: !Ref SQLTriggerQueue

  Process:
    Type: AWS::Serverless::Function
    Properties:
      Role: !GetAtt LambdaRole.Arn
      CodeUri: .
      FunctionName: ut_lambda2sqs_process
      VpcConfig:
        SecurityGroupIds: [!Ref DefaultSecurityGroup]
        SubnetIds: !Split [',', !Ref PrivateSubnets]
      Handler: process-bin
      Runtime: go1.x
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt [SQLTriggerQueue, Arn]
            BatchSize: 1

  SQLTriggerQueueDLQ:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 1209600

  SQLTriggerQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 120
      MessageRetentionPeriod: 604800
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt [SQLTriggerQueueDLQ, Arn]
        maxReceiveCount: 10

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
            Action: ['sts:AssumeRole']
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
        - arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - arn:aws:iam::aws:policy/AmazonSNSFullAccess
        - arn:aws:iam::aws:policy/AmazonSQSFullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole