Skip to content

Sumo patterns

Every pattern in cfn-typed-sumo, with a link to its code and the resources it creates. Each is an ordinary function that returns a resource or a Resources fragment (some return a small handle with the logical IDs and references); combine fragments with combine. The link on each name goes to its source on GitHub.

The patterns are opinions and the API is volatile: see cfn-typed-sumo. Import the ones in the first three sections from the package (from cfn_typed_sumo import queue_with_dlq), and the others from their module (from cfn_typed_sumo.storage import secure_bucket).

Basics: roles, queues, tags and rules

cfn_typed_sumo.patterns

Pattern What it is Resources Book
lambda_role Execution role for a Lambda: log permissions plus the extra statements. IAM::Role with log permissions plus your statements page
sqs_event_source Trigger the Lambda function_logical from an SQS queue. Lambda::EventSourceMapping page
queue_with_dlq A queue and its dead-letter queue, with logical IDs {name}Queue and {name}DLQ. 2 × SQS::Queue (queue and dead-letter queue); a handle with ARNs and URLs page
tagged Resolve the company tags for every taggable resource: its own tags over the service tags. no resources: resolves the mandatory company tags onto the template's resources page
untagged Logical IDs of taggable resources missing a company tag: a backstop for templates that skip tagged. no resources: lists taggable resources missing a company tag page
COMPANY_RULES The company's rules as Rule functions: S3 encryption and public access, log retention, no admin policies, queue naming, dead-letter queues. no resources: rules for assert_template_ok(..., rules=) page

HTTP API

cfn_typed_sumo.http_api

Pattern What it is Resources Book
http_api An HTTP API sending every route in routes (e.g. "GET /orders") to the Lambda function (a logical ID). ApiGatewayV2::Api, Integration, Stage, Authorizer (with jwt), one Route per route key, Lambda::Permission page

Static site

cfn_typed_sumo.static_site

Pattern What it is Resources Book
static_site A private bucket served by CloudFront through origin access control (OAC). S3::Bucket + BucketPolicy, CloudFront::OriginAccessControl + Distribution; with a domain CertificateManager::Certificate page

Load balancers

cfn_typed_sumo.loadbalancer

Pattern What it is Resources Book
load_balancer An application load balancer. No Name, so CloudFormation picks a unique one. ElasticLoadBalancingV2::LoadBalancer page
target_group Where the traffic goes. A short deregistration delay makes deploys faster. ElasticLoadBalancingV2::TargetGroup page
listener Forward a port to a target group. A certificate turns it into an HTTPS listener. ElasticLoadBalancingV2::Listener (HTTPS with a certificate) page
redirect_http_to_https A listener that answers with a permanent redirect instead of forwarding. ElasticLoadBalancingV2::Listener page
allow_from Let source_group (the load balancer's) reach group (the instances') on port. EC2::SecurityGroupIngress page
web_entrypoint One load balancer in front of several ports. EC2::SecurityGroup, LoadBalancer, and a TargetGroup and Listener per port page

Storage

cfn_typed_sumo.storage

Pattern What it is Resources Book
encryption_key A KMS key with rotation and an alias: logical IDs {name}Key and {name}KeyAlias. KMS::Key + KMS::Alias page
secure_bucket A private, encrypted bucket and its policy: logical IDs {name}Bucket and {name}BucketPolicy. S3::Bucket + S3::BucketPolicy page
dynamodb_table An on-demand table with point-in-time recovery. Keys are "name" (a string) or ("name", "N"). DynamoDB::Table page
ecr_repository A repository with immutable tags and scan-on-push, that the given principals may pull from. ECR::Repository page
publish Publish values as SSM parameters named {prefix}/{key}, for other stacks to read. one SSM::Parameter per value page

Compute, network and scaling (CDK L2 style)

cfn_typed_sumo.constructs

Pattern What it is Resources Book
function lambda.Function: the function, its execution role and its log group, {name}, {name}Role and {name}Logs. Lambda::Function, IAM::Role, Logs::LogGroup page
invoke_permission grantInvoke for a service: let principal ("events.amazonaws.com") invoke the function, from source_arn only. Lambda::Permission page
schedule events.Rule with a LambdaFunction target: the rule and the permission it needs, {name}Rule, {name}Permission. Events::Rule + Lambda::Permission page
topic_to_queue SqsSubscription: one subscription per topic, and the one queue policy that lets them all send. one SNS::Subscription per topic + one SQS::QueuePolicy page
vpc ec2.Vpc: public and private subnets in zones availability zones, an internet gateway, and a NAT gateway per zone. EC2::VPC, internet gateway, subnets per zone (public and private), route tables, NAT gateways with EIPs page
fargate_service ApplicationLoadBalancedFargateService: a cluster, a task, a service and an internet-facing load balancer. ECS::Cluster, TaskDefinition, Service, load balancer with target group and listener, 2 × SecurityGroup, 2 × IAM::Role, Logs::LogGroup page
alarm metric.createAlarm: one alarm on one metric. actions run when it fires, ok_actions when it recovers. CloudWatch::Alarm page
queue_backlog_alarm queue.metricApproximateNumberOfMessagesVisible().createAlarm: too many messages waiting for minutes. CloudWatch::Alarm page
lambda_errors_alarm fn.metricErrors().createAlarm: the function failed at least threshold times in a minute. CloudWatch::Alarm page
alarm_topic A topic for alarms to notify, with an email subscription each: {name}Topic and {name}Email{n}. SNS::Topic + one email SNS::Subscription each page
composite_alarm CompositeAlarm.fromAlarms: fires when any or all of the alarms with these logical IDs are in ALARM. CloudWatch::CompositeAlarm page
service_scaling service.autoScaleTaskCount with scaleOnCpuUtilization, scaleOnMemoryUtilization and scaleOnRequestCount. ApplicationAutoScaling::ScalableTarget + ScalingPolicy page
queue_step_scaling scaleOnMetric with steps: add tasks as the queue grows, and remove one when it is empty. ScalableTarget, 2 × ScalingPolicy, 2 × CloudWatch::Alarm page
live_alias fn.addAlias with provisioned concurrency: {name}Version{version} and {name}Alias. Lambda::Version + Lambda::Alias page
lambda_scaling alias.addAutoScaling: keep provisioned concurrency about utilization busy. Logical IDs {name}Target, {name}Tracking. ApplicationAutoScaling::ScalableTarget + ScalingPolicy page
table_scaling table.autoScaleReadCapacity and autoScaleWriteCapacity: read and write are (min, max) units. ScalableTarget + ScalingPolicy for each of read and write page

Integrations: A connected to B

cfn_typed_sumo.integrations

Pattern What it is Resources Book
api_to_lambda A REST API that proxies every path and method to a Lambda function. ApiGateway::RestApi, Resource, 2 × Method, Deployment, Stage, Lambda::Permission page
api_to_dynamodb GET /items/{id} straight from a table, with no Lambda in between. ApiGateway::RestApi, 2 × Resource, Method, Deployment, Stage, IAM::Role page
lambda_behind_alb Send the requests that match path_pattern on an existing listener to a Lambda function. ElasticLoadBalancingV2::TargetGroup + ListenerRule, Lambda::Permission page
alias_to_load_balancer An A record in zone_id that points at a load balancer in this template. Route53::RecordSet page
alias_to_distribution An A record in zone_id that points at a CloudFront distribution in this template. Route53::RecordSet page
fan_out One topic, and for each subscriber its own queue with a dead-letter queue. SNS::Topic; per subscriber a queue, a dead-letter queue, a QueuePolicy and a Subscription page
event_to_lambda An EventBridge rule that invokes a Lambda: {name}Rule and {name}InvokePermission. Events::Rule + Lambda::Permission page
event_to_queue An EventBridge rule that sends to an SQS queue: {name}Rule and {name}Policy. Events::Rule + SQS::QueuePolicy page
stream_trigger Invoke a Lambda for the changes of a DynamoDB table: {name}StreamMapping. Lambda::EventSourceMapping, and the statements the role needs page
with_stream The same table with a stream. The table is not modified. the same DynamoDB::Table, with a stream page
bucket_to_lambda A private bucket that invokes a Lambda when objects arrive: {name}Bucket and {name}InvokePermission. S3::Bucket with a notification, Lambda::Permission page
firehose_to_s3 A Firehose delivery stream that writes GZIP files to a bucket, with its role and logs. KinesisFirehose::DeliveryStream, IAM::Role, Logs::LogGroup + LogStream page
fargate_task A cluster, a task definition and (with desired_count) a service running one container, with no load balancer. ECS::Cluster, TaskDefinition, Service (optional), 2 × IAM::Role, Logs::LogGroup page