CloudFormation Template - AWS Lambda With ECR, Secrets and VPC access

lambda-template.yml

Description: A stack containing resources for an AWS Serverless Lambda function deployed through an AWS ECR. The Lambda will be given a role that grants it permission to access resources in a VPC. The IDs of the security group and subnet of the VPC resource must be specified as parameters. An optional parameter allows the application name to be set so resources will be tagged appropriately. In addition, secrets are delivered to the Lambda environment. These secrets must exist in the SecretManager store before this template can be spun up.

Parameters:
  applicationName:
    Type: String
    Default: my-lambdas
    Description: Name of the application
  securityGroupID:
    Type: String
    Description: ID of the security group allowing ingress into the VPC resource Lambda is accessing.
  subnetId:
    Type: String
    Description: ID of the subnet in which the VPC resource is deployed.

Resources:
  LambdaECR:
      Type: AWS::ECR::Repository
      Description: ECR to hold image of Lambda function
      Properties:
        ImageScanningConfiguration: 
          ScanOnPush: true
        RepositoryName: !Sub "${applicationName}-lambda"
        RepositoryPolicyText:
          Version: "2012-10-17"
          Statement:
            - Sid: ECRLambdaPolicy
              Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - "ecr:BatchGetImage"
                - "ecr:GetDownloadUrlForLayer"
        Tags:
          - Key: Name
            Value: !Sub ${application}-lambda-ecr

  LambdaExecutor:
      Type: AWS::IAM::Role
      Description: Role to allow Lambda to basic access to VPC
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: 
                - "sts:AssumeRole"
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        RoleName: !Sub ${applicationName}-lambda-executor

  Lambda: 
      Type: AWS::Lambda::Function
      Properties:
        FunctionName: !Sub ${applicationName}-lambda
        Code: 
          ImageUri: !GetAtt LambdaECR.RepositoryUri
        PackageType: Image
        Role: !GetAtt LambdaExecutor.Arn
        VpcConfig:
          SecurityGroupIds: 
            - !Ref securityGroupID
          SubnetIds:
            - !Ref subnetID
        Environment:
          Variables:
            # replace the following with appropriate secrets. 
            # this template assumes the Lambda is accessing an RDS.
            RDS_DB: !Ref applicationName
            RDS_HOST: !Sub '{{resolve:secretsmanager:${applicationName}-dbHost:SecretString}}'
            RDS_USER: !Sub '{{resolve:secretsmanager:${applicationName}-dbUsername:SecretString}}'
            RDS_PASSWORD: !Sub '{{resolve:secretsmanager:${applicationName}-dbPassword:SecretString}}'
        Timeout: 90
        Tags:
          - Key: Name
            Value: !Sub ${applicationName}-lambda
            
Outputs:
  ECRUri:
    Value: !GetAtt LambdaECR.RepositoryURi
    Export:
      Name: !Sub ${applicationName}-ECRUri
  LambdaArn:
    Value: !GetAtt Lambda.Arn
    Export:
      Name: !Sub ${applicationName}-LambdaArn

Excellent! Thanks for your response

It randomly occured to me you could also use CodeBuild and make the Lambda dependent on a signal from the pipeline.