Sumologic DLQ CloudWatch Logs Lambda (https://help.sumologic.com/03Send-Data/Collect-from-Other-Data-Sources/Amazon-CloudWatch-Logs), but in yaml

DLQLambdaCloudFormation.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Sumo Logic CloudWatch log collector
Parameters:

  Environment:
    Type: String
    AllowedValues:
      - test
      - prod
    Default: test

Mappings:

  EnvironmentMap:
    test:
      SumoEndPointURL: https://your-sumo-collector.com/1234567890=
      LogGroupName: YOUR-LOG-GROUP-HERE
    prod:
      SumoEndPointURL: https://your-sumo-collector.com/1234567890=
      LogGroupName: YOUR-LOG-GROUP-HERE

  RegionMap:
    us-east-1:
      bucketname: appdevzipfiles-us-east-1
    us-east-2:
      bucketname: appdevzipfiles-us-east-2
    us-west-1:
      bucketname: appdevzipfiles-us-west-1
    us-west-2:
      bucketname: appdevzipfiles-us-west-2
    ap-south-1:
      bucketname: appdevzipfiles-ap-south-1
    ap-northeast-2:
      bucketname: appdevzipfiles-ap-northeast-2
    ap-southeast-1:
      bucketname: appdevzipfiles-ap-southeast-1
    ap-southeast-2:
      bucketname: appdevzipfiles-ap-southeast-2
    ap-northeast-1:
      bucketname: appdevzipfiles-ap-northeast-1
    ca-central-1:
      bucketname: appdevzipfiles-ca-central-1
    eu-central-1:
      bucketname: appdevzipfiles-eu-central-1
    eu-west-1:
      bucketname: appdevzipfiles-eu-west-1
    eu-west-2:
      bucketname: appdevzipfiles-eu-west-2
    eu-west-3:
      bucketname: appdevzipfiles-eu-west-3
    eu-north-1:
      bucketname: appdevzipfiles-eu-north-1s
    sa-east-1:
      bucketname: appdevzipfiles-sa-east-1

Resources:

  SumoCWLogSubsriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      LogGroupName: !FindInMap [EnvironmentMap, !Ref Environment, LogGroupName]
      DestinationArn: !GetAtt SumoCWLogsLambda.Arn
      FilterPattern: ''

  SumoCWLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt SumoCWLogsLambda.Arn
      Action: lambda:InvokeFunction
      Principal: !Sub logs.${AWS::Region}.amazonaws.com
      SourceAccount: !Ref AWS::AccountId

  SumoCWDeadLetterQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Ref AWS::StackName

  SumoCWLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub ${AWS::StackName}-sqs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sqs:DeleteMessage
                  - sqs:GetQueueUrl
                  - sqs:ListQueues
                  - sqs:ChangeMessageVisibility
                  - sqs:SendMessageBatch
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                  - sqs:GetQueueAttributes
                  - sqs:ListQueueTags
                  - sqs:ListDeadLetterSourceQueues
                  - sqs:DeleteMessageBatch
                  - sqs:PurgeQueue
                  - sqs:DeleteQueue
                  - sqs:CreateQueue
                  - sqs:ChangeMessageVisibilityBatch
                  - sqs:SetQueueAttributes
                Resource: !GetAtt SumoCWDeadLetterQueue.Arn
        - PolicyName: !Sub ${AWS::StackName}-logs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogStreams
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
        - PolicyName: !Sub ${AWS::StackName}-lambda
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${SumoCWProcessDLQLambda}

  SumoCWDLQLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub ${AWS::StackName}-sqs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sqs:DeleteMessage
                  - sqs:GetQueueUrl
                  - sqs:ListQueues
                  - sqs:ChangeMessageVisibility
                  - sqs:SendMessageBatch
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                  - sqs:GetQueueAttributes
                  - sqs:ListQueueTags
                  - sqs:ListDeadLetterSourceQueues
                  - sqs:DeleteMessageBatch
                  - sqs:PurgeQueue
                  - sqs:DeleteQueue
                  - sqs:CreateQueue
                  - sqs:ChangeMessageVisibilityBatch
                  - sqs:SetQueueAttributes
                Resource: !GetAtt SumoCWDeadLetterQueue.Arn
        - PolicyName: !Sub ${AWS::StackName}-logs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogStreams
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*

  SumoCWLogsLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !FindInMap [RegionMap, !Ref 'AWS::Region', bucketname]
        S3Key: cloudwatchlogs-with-dlq.zip
      Role: !GetAtt SumoCWLambdaExecutionRole.Arn
      Timeout: 300
      DeadLetterConfig:
        TargetArn: !GetAtt SumoCWDeadLetterQueue.Arn
      Handler: cloudwatchlogs_lambda.handler
      Runtime: nodejs8.10
      MemorySize: 128
      Environment:
        Variables:
          SUMO_ENDPOINT: !FindInMap [EnvironmentMap, !Ref Environment, SumoEndPointURL]
          LOG_FORMAT: Others
          INCLUDE_LOG_INFO: 'true'

  SumoCWEventsInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref SumoCWProcessDLQLambda
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt SumoCWProcessDLQScheduleRule.Arn

  SumoCWProcessDLQScheduleRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Events rule for Cron
      ScheduleExpression: rate(5 minutes)
      State: ENABLED
      Targets:
        - Arn: !GetAtt SumoCWProcessDLQLambda.Arn
          Id: TargetFunctionV1

  SumoCWProcessDLQLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !FindInMap [RegionMap, !Ref 'AWS::Region', bucketname]
        S3Key: cloudwatchlogs-with-dlq.zip
      Role: !GetAtt SumoCWDLQLambdaExecutionRole.Arn
      Timeout: 300
      Handler: DLQProcessor.handler
      DeadLetterConfig:
        TargetArn: !GetAtt SumoCWDeadLetterQueue.Arn
      Runtime: nodejs8.10
      MemorySize: 128
      Environment:
        Variables:
          SUMO_ENDPOINT: !FindInMap [EnvironmentMap, !Ref Environment, SumoEndPointURL]
          TASK_QUEUE_URL: !Sub https://sqs.${AWS::Region}.amazonaws.com/${AWS::AccountId}/${AWS::StackName}
          NUM_OF_WORKERS: 2
          LOG_FORMAT: Others
          INCLUDE_LOG_INFO: 'true'

Outputs:
  SumoCWLogsLambdaArn:
    Description: The ARN of the sumologic cloudwatch logs lambda
    Value: !GetAtt SumoCWLogsLambda.Arn