cloud-formation-source-account-former2.yml

AWSTemplateFormatVersion: "2010-09-09"
Metadata:
    Generator: "former2"
Description: "cloud-formation-source-account-former2"
Parameters:
    DestinationAccount:
      Type: "String"
      Default: "destination-account"
Resources:
    LambdaFunction:
        Type: "AWS::Lambda::Function"
        Properties:
            Description: ""
            FunctionName: "CAR-Source-Lambda"
            Handler: "index.handler"
            Code: 
               ZipFile: !Sub |
                 exports.handler = async (event) => {
                   var aws = require('aws-sdk');
                   var sts = new aws.STS({ region: process.env.AWS_REGION });
                   var stsParams = {
                     RoleArn: "arn:aws:iam::${DestinationAccount}:role/service-role/CAR-Destination-IAMRole",
                     DurationSeconds: 3600,
                     RoleSessionName: "cross-account-lambda-session"
                   };
                   const stsResults = await sts.assumeRole(stsParams).promise();
                   var lambda = new aws.Lambda({
                     region: process.env.AWS_REGION, 
                     accessKeyId: stsResults.Credentials.AccessKeyId, 
                     secretAccessKey:stsResults.Credentials.SecretAccessKey, 
                     sessionToken: stsResults.Credentials.SessionToken
                    });
                    const result = await lambda.invoke({
                    FunctionName: "arn:aws:lambda:us-east-1:${DestinationAccount}:function:CAR-Destination-Lambda",
                    InvocationType: "RequestResponse",
                    Payload: "{}"
                    }).promise();

                    const response = {
                       statusCode: 200,
                       body: JSON.stringify(result)
                    };
                    return response;
                 };
            MemorySize: 128
            Role: !GetAtt IAMRole.Arn
            Runtime: "nodejs12.x"
            Timeout: 25
            TracingConfig: 
                Mode: "PassThrough"

    IAMRole:
        Type: "AWS::IAM::Role"
        Properties:
            Path: "/"
            RoleName: "source-lambda-iam-role"
            AssumeRolePolicyDocument: !Sub |
              {
                "Version": "2012-10-17",
                "Statement": [
                   {
                      "Effect": "Allow",
                      "Principal": {
                         "Service": "lambda.amazonaws.com"
                       },
                      "Action": "sts:AssumeRole"
                   }
                ]
              }
            MaxSessionDuration: 3600
            Description: "source-lambda-iam-role"

    IAMPolicy:
        Type: "AWS::IAM::Policy"
        Properties:
            PolicyDocument: !Sub |
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Action": "sts:AssumeRole",
                            "Resource": "arn:aws:iam::${DestinationAccount}:role/service-role/CAR-Destination-IAMRole",
                            "Effect": "Allow"
                        }
                    ]
                }
            Roles: 
              - !Ref IAMRole
            PolicyName: "car-source-to-destination-assume-policy"