sns_add_permissions.json

{
"AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "Test Lambda custom resource to return 'ReadEndPoint.Addresses' from ElastiCache ReplicationGroup.",

  "Parameters" : {
    "s3Bucket" : {
      "Description" : "Name of S3 bucket the Lambda functions are stored in",
      "Type" : "String"
    },
    "lambdaSNSProcessFunction" : {
      "Description" : "Name of Lambda custom resource function object",
      "Type" : "String",
      "Default" : "lambdasnsprocessfunction.zip"
    },
   "lambdaSetPermissionFunction" : {
      "Description" : "Name of Lambda custom resource function object",
      "Type" : "String",
      "Default" : "lambdasetpermissionfunction.zip"
    }
  },
  "Resources" : {
        "TestSNSTopic": {
          "Type": "AWS::SNS::Topic",
          "Properties": {
            "Subscription": [ {
                "Endpoint":  { "Fn::GetAtt" : [ "ProcessSNSMessages", "Arn" ] },
                "Protocol": "lambda"
              } ],
            "TopicName": "TestSNSTopic"
          }
        },
      "ProcessSNSMessages": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Handler": "index.handler",
          "Role": { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] },
          "Code": {
            "S3Bucket": { "Ref" : "s3Bucket" },
            "S3Key": { "Ref" : "lambdaSNSProcessFunction" }
          },
          "Runtime": "nodejs",
          "Timeout": "25"
        }
      },
      "LambdaExecutionRole": {
         "Type": "AWS::IAM::Role",
         "Properties": {
            "AssumeRolePolicyDocument": { 
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Sid": "",
                    "Effect": "Allow",
                    "Principal": {
                      "Service": "lambda.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                  }
                ]
              },
          "Policies": [ {
                 "PolicyName": "root",
                 "PolicyDocument": {
                    "Version" : "2012-10-17",
                    "Statement": [ {
                       "Effect": "Allow",
                       "Action": "*",
                       "Resource": "*"
                    } ]
                 }
               } 
            ]
         }
      },
      "AddLambdaPermission": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Handler": "index.handler",
          "Role": { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] },
          "Code": {
            "S3Bucket": { "Ref" : "s3Bucket" },
            "S3Key": { "Ref" : "lambdaSetPermissionFunction" }
          },
          "Runtime": "nodejs",
          "Timeout": "25"
        }
      },
     "ResourceRecordsFunction": {
      "Type": "Custom::ResourceRecordsFunction",
      "DependsOn": "AddLambdaPermission",
      "Properties": {
        "ServiceToken": { "Fn::GetAtt": [ "AddLambdaPermission", "Arn" ] },
        "Region": { "Ref": "AWS::Region" },
        "FunctionName": { "Ref" : "ProcessSNSMessages" },
        "Principal": "sns.amazonaws.com",
        "SourceArn": { "Ref": "TestSNSTopic" },
        "Action": "lambda:InvokeFunction"
      }
    }
  }
}