Package: crhelper
Custom Resource HelperSimplify best practice Custom Resource creation, sending responses to CloudFormation and providing exception, timeout
trapping, and detailed configurable logging.FeaturesDead simple to use, reduces the complexity of writing a CloudFormation custom resourceGuarantees that CloudFormation will get a response even if an exception is raisedReturns meaningful errors to CloudFormation Stack events in the case of a failurePolling enables run times longer than the lambda 15 minute limitJSON logging that includes request id's, stack id's and request type to assist in tracing logs relevant to a
particular CloudFormation eventCatches function timeouts and sends CloudFormation a failure responseStatic typing (mypy) compatibleInstallationInstall into the root folder of your lambda functioncdmy-lambda-function/
pipinstallcrhelper-t.Example UsageThis blogcovers usage in more detail.from__future__importprint_functionfromcrhelperimportCfnResourceimportlogginglogger=logging.getLogger(__name__)# Initialise the helper, all inputs are optional, this example shows the defaultshelper=CfnResource(json_logging=False,log_level='DEBUG',boto_level='CRITICAL',sleep_on_delete=120,ssl_verify=None)try:## Init code goes herepassexceptExceptionase:helper.init_failure(e)@helper.createdefcreate(event,context):logger.info("Got Create")# Optionally return an ID that will be used for the resource PhysicalResourceId,# if None is returned an ID will be generated. If a poll_create function is defined# return value is placed into the poll event as event['CrHelperData']['PhysicalResourceId']## To add response data update the helper.Data dict# If poll is enabled data is placed into poll event as event['CrHelperData']helper.Data.update({"test":"testdata"})# To return an error to cloudformation you raise an exception:ifnothelper.Data.get("test"):raiseValueError("this error will show in the cloudformation events log and console.")return"MyResourceId"@helper.updatedefupdate(event,context):logger.info("Got Update")# If the update resulted in a new resource being created, return an id for the new resource.# CloudFormation will send a delete event with the old id when stack update completes@helper.deletedefdelete(event,context):logger.info("Got Delete")# Delete never returns anything. Should not fail if the underlying resources are already deleted.# Desired state.@helper.poll_createdefpoll_create(event,context):logger.info("Got create poll")# Return a resource id or True to indicate that creation is complete. if True is returned an id# will be generatedreturnTruedefhandler(event,context):helper(event,context)PollingIf you need longer than the max runtime of 15 minutes, you can enable polling by adding additional decorators forpoll_create,poll_updateorpoll_delete. When a poll function is defined forcreate/update/deletethe
function will not send a response to CloudFormation and instead a CloudWatch Events schedule will be created to
re-invoke the lambda function every 2 minutes. When the function is invoked the matching@helper.poll_function will
be called, logic to check for completion should go here, if the function returnsNonethen the schedule will run again
in 2 minutes. Once complete either return a PhysicalResourceID orTrueto have one generated. The schedule will be
deleted and a response sent back to CloudFormation. If you use polling the following additional IAM policy must be
attached to the function's IAM role:{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["lambda:AddPermission","lambda:RemovePermission","events:PutRule","events:DeleteRule","events:PutTargets","events:RemoveTargets"],"Resource":"*"}]}Certificate VerificationTo turn off certification verification, or to use a custom CA bundle path for the underlying boto3 clients used by this library, override thessl_verifyargument with the appropriate values.  These can be either:False- do not validate SSL certificates. SSL will still be used, but SSL certificates will not be verified.path/to/cert/bundle.pem- A filename of the CA cert bundle to uses. You can specify this argument if you want to use a different CA cert bundle than the one used by botocore.CreditsDecorator implementation inspired byhttps://github.com/ryansb/cfn-wrapper-pythonLog implementation inspired byhttps://gitlab.com/hadrien/aws_lambda_loggingLicenseThis library is licensed under the Apache 2.0 License.