src/vpce.js
function buildVPCEndpoint(service, { routeTableIds = [], subnetIds = [] } = {}) {
  const endpoint = {
    Type: 'AWS::EC2::VPCEndpoint',
    Properties: {
      ServiceName: {
        'Fn::Join': [
          '.',
          [
            'com.amazonaws',
            {
              Ref: 'AWS::Region',
            },
            service,
          ],
        ],
      },
      VpcId: {
        Ref: 'VPC',
      },
    },
  };

  // @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html
  if (service === 's3' || service === 'dynamodb') {
    endpoint.Properties.VpcEndpointType = 'Gateway';
    endpoint.Properties.RouteTableIds = routeTableIds;
    endpoint.Properties.PolicyDocument = {
      Statement: [
        {
          Effect: 'Allow',
          /*
          TODO 11/21: We should restrict the VPC Endpoint to only the Lambda
          IAM role, but this doesn't work.

          Principal: {
            AWS: {
              'Fn::GetAtt': [
                'IamRoleLambdaExecution',
                'Arn',
              ],
            },
          }, */
          Principal: '*',
          Resource: '*',
        },
      ],
    };
    if (service === 's3') {
      endpoint.Properties.PolicyDocument.Statement[0].Action = 's3:*';
    } else if (service === 'dynamodb') {
      endpoint.Properties.PolicyDocument.Statement[0].Action = 'dynamodb:*';
    }
  } else {
    endpoint.Properties.VpcEndpointType = 'Interface';
    endpoint.Properties.SubnetIds = subnetIds;
    endpoint.Properties.PrivateDnsEnabled = true;
    endpoint.Properties.SecurityGroupIds = [
      {
        Ref: 'LambdaEndpointSecurityGroup',
      },
    ];
  }

  const parts = service.split(/[-_.]/g);
  parts.push('VPCEndpoint');
  const cfName = parts.map(part => part.charAt(0).toUpperCase() + part.slice(1)).join('');

  return {
    [cfName]: endpoint,
  };
}
function buildVPCEndpoint(service, { routeTableIds = [], subnetIds = [] } = {}) {
  const endpoint = {
    Type: 'AWS::EC2::VPCEndpoint',
    Properties: {
      ServiceName: {
        'Fn::Join': [
          '.',
          [
            'com.amazonaws',
            {
              Ref: 'AWS::Region',
            },
            service,
          ],
        ],
      },
      VpcId: {
        Ref: 'VPC',
      },
    },
  };

  // @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html
  if (service === 's3' || service === 'dynamodb') {
    endpoint.Properties.VpcEndpointType = 'Gateway';
    endpoint.Properties.RouteTableIds = routeTableIds;
    endpoint.Properties.PolicyDocument = {
      Statement: [
        {
          Effect: 'Allow',
          /*
          TODO 11/21: We should restrict the VPC Endpoint to only the Lambda
          IAM role, but this doesn't work.

          Principal: {
            AWS: {
              'Fn::GetAtt': [
                'IamRoleLambdaExecution',
                'Arn',
              ],
            },
          }, */
          Principal: '*',
          Resource: '*',
        },
      ],
    };
    if (service === 's3') {
      endpoint.Properties.PolicyDocument.Statement[0].Action = 's3:*';
    } else if (service === 'dynamodb') {
      endpoint.Properties.PolicyDocument.Statement[0].Action = 'dynamodb:*';
    }
  } else {
    endpoint.Properties.VpcEndpointType = 'Interface';
    endpoint.Properties.SubnetIds = subnetIds;
    endpoint.Properties.PrivateDnsEnabled = true;
    endpoint.Properties.SecurityGroupIds = [
      {
        Ref: 'LambdaEndpointSecurityGroup',
      },
    ];
  }

  const parts = service.split(/[-_.]/g);
  parts.push('VPCEndpoint');
  const cfName = parts.map(part => part.charAt(0).toUpperCase() + part.slice(1)).join('');

  return {
    [cfName]: endpoint,
  };
}
function buildVPCEndpoint ( service , { routeTableIds = [ ] , subnetIds = [ ] } = { } ) { const endpoint = { Type : 'AWS::EC2::VPCEndpoint' , Properties : { ServiceName : { 'Fn::Join' : [ '.' , [ 'com.amazonaws' , { Ref : 'AWS::Region' , } , service , ] , ] , } , VpcId : { Ref : 'VPC' , } , } , } ; // @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html if ( service === 's3' || service === 'dynamodb' ) { endpoint . Properties . VpcEndpointType = 'Gateway' ; endpoint . Properties . RouteTableIds = routeTableIds ; endpoint . Properties . PolicyDocument = { Statement : [ { Effect : 'Allow' , /*
          TODO 11/21: We should restrict the VPC Endpoint to only the Lambda
          IAM role, but this doesn't work.

          Principal: {
            AWS: {
              'Fn::GetAtt': [
                'IamRoleLambdaExecution',
                'Arn',
              ],
            },
          }, */ Principal : '*' , Resource : '*' , } , ] , } ; if ( service === 's3' ) { endpoint . Properties . PolicyDocument . Statement [ 0 ] . Action = 's3:*' ; } else if ( service === 'dynamodb' ) { endpoint . Properties . PolicyDocument . Statement [ 0 ] . Action = 'dynamodb:*' ; } } else { endpoint . Properties . VpcEndpointType = 'Interface' ; endpoint . Properties . SubnetIds = subnetIds ; endpoint . Properties . PrivateDnsEnabled = true ; endpoint . Properties . SecurityGroupIds = [ { Ref : 'LambdaEndpointSecurityGroup' , } , ] ; } const parts = service . split ( / [-_.] / g ) ; parts . push ( 'VPCEndpoint' ) ; const cfName = parts . map ( part => part . charAt ( 0 ) . toUpperCase ( ) + part . slice ( 1 ) ) . join ( '' ) ; return { [ cfName ] : endpoint , } ; }
Build a VPCEndpoint

@param {String} service
@param {Object} params
@return {Object}
Build a VPCEndpoint