template.yml

AWSTemplateFormatVersion: '2010-09-09'

Description: Automatic capacity reservation manager

Parameters:
    S3Bucket:
        Description: The name of the bucket that contains the Lambda source (leave blank to use latest)
        Type: String
        Default: ''
    
    S3Key:
        Description: The key of the ZIP package within the bucket (leave blank to use latest)
        Type: String
        Default: ''

Mappings:
    RegionMap:
        us-east-1:
            bucketname: ianmckay-us-east-1
        us-east-2:
            bucketname: ianmckay-us-east-2
        us-west-1:
            bucketname: ianmckay-us-west-1
        us-west-2:
            bucketname: ianmckay-us-west-2
        ap-south-1:
            bucketname: ianmckay-ap-south-1
        ap-northeast-2:
            bucketname: ianmckay-ap-northeast-2
        ap-southeast-1:
            bucketname: ianmckay-ap-southeast-1
        ap-southeast-2:
            bucketname: ianmckay-ap-southeast-2
        ap-northeast-1:
            bucketname: ianmckay-ap-northeast-1
        ca-central-1:
            bucketname: ianmckay-ca-central-1
        eu-central-1:
            bucketname: ianmckay-eu-central-1
        eu-west-1:
            bucketname: ianmckay-eu-west-1
        eu-west-2:
            bucketname: ianmckay-eu-west-2
        eu-west-3:
            bucketname: ianmckay-eu-west-3
        eu-north-1:
            bucketname: ianmckay-eu-north-1
        sa-east-1:
            bucketname: ianmckay-sa-east-1

Conditions:
    S3Defined: !Not [ !Equals [ '', !Ref S3Bucket ] ]

Resources:
    LambdaServiceRole:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Principal:
                        Service: lambda.amazonaws.com
                    Action: sts:AssumeRole
            Path: /
            ManagedPolicyArns:
              - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
            Policies:
              - PolicyName: AutoCapacityReservationPermissions
                PolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Action:
                          - ec2:DescribeInstances
                          - ec2:DescribeImages
                          - ec2:DescribeCapacityReservations
                          - ec2:CreateCapacityReservation
                        Resource: '*'
                      - Effect: Allow
                        Action:
                          - ec2:CreateTags
                          - ec2:DeleteTags
                          - ec2:ModifyCapacityReservation
                          - ec2:CancelCapacityReservation
                        Resource: !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:capacity-reservation/*
                      - Effect: Allow
                        Action:
                          - ec2:CreateTags
                          - ec2:DeleteTags
                        Resource: !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
                        Condition:
                            ForAllValues:StringEquals:
                                aws:TagKeys: "AutoCapacityReservationId"

    LambdaFunction:
        Type: AWS::Lambda::Function
        Properties:
            Handler: index.handler
            Role: !GetAtt LambdaServiceRole.Arn
            Code:
                S3Bucket: !If
                  - S3Defined
                  - !Ref S3Bucket
                  - Fn::FindInMap:
                      - RegionMap
                      - !Ref AWS::Region
                      - bucketname
                S3Key: !If
                  - S3Defined
                  - !Ref S3Key
                  - auto-capacity-reservations/app.zip
            Runtime: python3.8
            Timeout: 30

    EC2InstanceStateChangeEventRule:
        Type: AWS::Events::Rule
        Properties: 
            Description: Auto capacity reservations rule
            EventPattern: !Sub |
                {
                    "source": [
                        "aws.ec2"
                    ],
                    "detail-type": [
                        "EC2 Instance State-change Notification"
                    ],
                    "detail": {
                        "state": [
                            "terminated",
                            "pending"
                        ]
                    },
                    "region": [
                        "${AWS::Region}"
                    ]
                }
            State: ENABLED
            Targets: 
              - Arn: !GetAtt LambdaFunction.Arn
                Id: Action
    
    EventsLambdaPermission:
        Type: AWS::Lambda::Permission
        Properties:
            FunctionName: !GetAtt LambdaFunction.Arn
            Action: lambda:InvokeFunction
            Principal: events.amazonaws.com
            SourceArn: !GetAtt EC2InstanceStateChangeEventRule.Arn