template.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31

Description: Failed Change Sets Destroyer deletes failed change sets from CloudFormation stacks.

Metadata:
  AWS::ServerlessRepo::Application:
    Name: failed-change-sets-destroyer
    Description: Failed Change Sets Destroyer deletes failed change sets from CloudFormation stacks.
    Author: Michal Gorski
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: [ 'lambda','cloudwatch','cron','cloudformation','change-set' ]
    HomePageUrl: https://github.com/mgorski-mg/aws-failed-change-sets-destroyer
    SemanticVersion: 1.1.3
    SourceCodeUrl: https://github.com/mgorski-mg/aws-failed-change-sets-destroyer

Parameters:
  SchedulerCronParameter:
    Type: String
    Description: Enter scheduler cron expression. Default is cron(0 0 1 * ? *).
    Default: cron(0 0 1 * ? *)
  SchedulerEnabledParameter:
    Type: String
    Description: Enable scheduler. Default is ENABLED.
    Default: ENABLED
    AllowedValues: [ ENABLED, DISABLED ]

Resources:
  FailedChangeSetsDestroyer:
    Type: AWS::Serverless::Function
    Properties:
      Description: Deletes failed change sets from CloudFormation stacks.
      CodeUri: code/
      Handler: handler.lambda_handler
      Runtime: python3.12
      Timeout: 900
      MemorySize: 128
      Tracing: Active
      Architectures:
        - arm64
      Events:
        Schedule:
          Type: Schedule
          Properties:
            State: !Ref SchedulerEnabledParameter
            Schedule: !Ref SchedulerCronParameter
            Input: '{"dry_run": false}'
      Policies:
        - AWSLambdaBasicExecutionRole
        - Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action:
                - ec2:DescribeRegions
                - cloudformation:ListStacks
                - cloudformation:ListChangeSets
                - cloudformation:DeleteChangeSet
              Resource: '*'

  FailedChangeSetsDestroyerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${FailedChangeSetsDestroyer}
      RetentionInDays: 180