# Path: stacker_blueprints/policies.py
# def lambda_basic_execution_statements(function_name):
#     log_group = Join("/", ["/aws/lambda", function_name])
#     return cloudwatch_logs_write_statements(log_group)
# 
# def lambda_vpc_execution_statements():
#     """Allow Lambda to manipuate EC2 ENIs for VPC support."""
#     return [
#         Statement(
#             Effect=Allow,
#             Resource=['*'],
#             Action=[
#                 ec2.CreateNetworkInterface,
#                 ec2.DescribeNetworkInterfaces,
#                 ec2.DeleteNetworkInterface,
#             ]
#         )
#     ]


import logging
import awacs.logs
import awacs.kinesis
import awacs.dynamodb
from stacker.blueprints.base import Blueprint
from stacker.blueprints.variables.types import TroposphereType
from stacker.util import cf_safe_name
from troposphere import (
    NoValue,
    Output,
    Ref,
    Sub,
    iam,
)
from troposphere import awslambda
from troposphere import events
from awacs.aws import Statement, Allow, Policy
from awacs.helpers.trust import get_lambda_assumerole_policy
from .policies import (
    lambda_basic_execution_statements,
    lambda_vpc_execution_statements,
)
            iam.PolicyType(
                "Policy",
                PolicyName=Sub("${AWS::StackName}-policy"),
                PolicyDocument=Policy(
                    Statement=self.generate_policy_statements()
                ),
                Roles=[self.role.Ref()],
            )
        )

        t.add_output(
            Output("PolicyName", Value=Ref(self.policy))
        )

    def create_role(self):
        t = self.template

        self.role = t.add_resource(
            iam.Role(
                "Role",
                AssumeRolePolicyDocument=get_lambda_assumerole_policy()
            )
        )

        if self.get_variables()["VpcConfig"]:
            # allow this Lambda to modify ENIs to allow it to run in our VPC.
            self.role.Policies = [
                iam.Policy(
                    PolicyName=Sub("${AWS::StackName}-vpc-policy"),
                    PolicyDocument=Policy(

# Path: stacker_blueprints/policies.py
# def lambda_basic_execution_statements(function_name):
#     log_group = Join("/", ["/aws/lambda", function_name])
#     return cloudwatch_logs_write_statements(log_group)
# 
# def lambda_vpc_execution_statements():
#     """Allow Lambda to manipuate EC2 ENIs for VPC support."""
#     return [
#         Statement(
#             Effect=Allow,
#             Resource=['*'],
#             Action=[
#                 ec2.CreateNetworkInterface,
#                 ec2.DescribeNetworkInterfaces,
#                 ec2.DeleteNetworkInterface,
#             ]
#         )
#     ]


# Path: stacker_blueprints/aws_lambda.py
import logging
import awacs.logs
import awacs.kinesis
import awacs.dynamodb
from stacker.blueprints.base import Blueprint
from stacker.blueprints.variables.types import TroposphereType
from stacker.util import cf_safe_name
from troposphere import (
    NoValue,
    Output,
    Ref,
    Sub,
    iam,
)
from troposphere import awslambda
from troposphere import events
from awacs.aws import Statement, Allow, Policy
from awacs.helpers.trust import get_lambda_assumerole_policy
from .policies import (
    lambda_basic_execution_statements,
    lambda_vpc_execution_statements,
)

            iam.PolicyType(
                "Policy",
                PolicyName=Sub("${AWS::StackName}-policy"),
                PolicyDocument=Policy(
                    Statement=self.generate_policy_statements()
                ),
                Roles=[self.role.Ref()],
            )
        )

        t.add_output(
            Output("PolicyName", Value=Ref(self.policy))
        )

    def create_role(self):
        t = self.template

        self.role = t.add_resource(
            iam.Role(
                "Role",
                AssumeRolePolicyDocument=get_lambda_assumerole_policy()
            )
        )

        if self.get_variables()["VpcConfig"]:
            # allow this Lambda to modify ENIs to allow it to run in our VPC.
            self.role.Policies = [
                iam.Policy(
                    PolicyName=Sub("${AWS::StackName}-vpc-policy"),
                    PolicyDocument=Policy(

                        Statement=lambda_vpc_execution_statements()