Merge branch 'delete_shared_storage_security' into 'develop'

Add lambda to remove shared storage security group for res demo

See merge request mwvaughn/aws-hpc-recipes!99

Author: mwvaughn

recipes/res/res_demo_env/assets/res-demo-stack.yaml

@@ -100,6 +100,7 @@ Resources:
 
   RES:
     Type: AWS::CloudFormation::Stack
+    DependsOn: InvokeDeleteSharedStorageSecurityGroup
     Properties:
       Parameters:
         EnvironmentName: !Ref EnvironmentName
@@ -152,6 +153,94 @@ Resources:
         LDAPConnectionURI: !GetAtt [ RESExternal, Outputs.LDAPConnectionURI ]
       TemplateURL: https://aws-hpc-recipes.s3.us-east-1.amazonaws.com/main/recipes/res/res_demo_env/assets/res-sso-keycloak.yaml
 
+  InvokeDeleteSharedStorageSecurityGroupRole:
+    Type: 'AWS::IAM::Role'
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: lambda.amazonaws.com
+            Action: 'sts:AssumeRole'
+      Policies:
+        - PolicyName: InvokeConfigureSSOLambdaPolicy
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action:
+                  - lambda:InvokeFunction
+                Resource:
+                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${EnvironmentName}-delete_shared_storage_security_group
+              - Effect: Allow
+                Action:
+                  - ec2:DescribeSecurityGroups
+                  - ec2:DeleteSecurityGroup
+                  - ec2:DescribeNetworkInterfaces
+                Resource: '*'
+
+  InvokeDeleteSharedSecurityGroupHandlerFunction:
+      Type: 'AWS::Lambda::Function'
+      DependsOn: 
+      - InvokeDeleteSharedStorageSecurityGroupRole
+      Properties:
+        Description: 'Deletes the shared storage security group when the stack is deleted.'
+        FunctionName: !Sub InvokeDeleteSharedSecurityGroupHandlerFunction-${AWS::StackName}
+        Timeout: 360 # 6 minutes
+        Role: !GetAtt InvokeDeleteSharedStorageSecurityGroupRole.Arn
+        Handler: index.handler
+        Runtime: python3.11
+        Code:
+          ZipFile: |
+            import boto3
+            import os
+            import logging
+            import cfnresponse
+
+            logger = logging.getLogger()
+            logger.setLevel(logging.INFO)              
+
+            def handler(event, context):
+              logger.info(f"Received event: {event}")
+              response = {}
+
+              if event["RequestType"] == "Delete":
+                try:
+                  ec2 = boto3.client("ec2")
+                  sgResponse = ec2.describe_security_groups(
+                    Filters=[
+                      {
+                        'Name': 'group-name', 
+                        'Values': [ 
+                          f"{os.environ['ENVIRONMENT_NAME']}-shared-storage-security-group",
+                        ]
+                      }
+                    ]
+                  )
+                  
+                  if len(sgResponse['SecurityGroups']) == 0:
+                    response['Output'] = "Shared storage security group not found."
+                  else:
+                    ec2.delete_security_group(GroupId=sgResponse['SecurityGroups'][0]['GroupId'])
+                    response['Output'] = "Shared storage security group deleted."s
+
+                  cfnresponse.send(event, context, cfnresponse.SUCCESS, response)
+                except Exception as e:
+                  logger.error(f"Error: Unable to delete shared storage security group: {e}")
+                  response['Output'] = f"Error: Unable to delete shared storage security group: {e}"
+                  cfnresponse.send(event, context, cfnresponse.FAILED, response)
+              else:
+                cfnresponse.send(event, context, cfnresponse.SUCCESS, response)
+        Environment:
+          Variables:
+            ENVIRONMENT_NAME: !Ref EnvironmentName
+
+  InvokeDeleteSharedStorageSecurityGroup:
+    Type: Custom::DeleteSharedStorageSecurityGroup
+    Properties:
+      ServiceToken: !GetAtt InvokeDeleteSharedSecurityGroupHandlerFunction.Arn
+
 Outputs:
   KeycloakUrl:
     Description: Keycloak Administrator Url