Scheduled Lambda (EventBridge Cron)

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "EventBridgeRuledailycloudwatch",
          "To": "ReportLambdalambda",
          "Label": "cron trigger"
        },
        {
          "From": "LambdaRoleiam",
          "To": "ReportLambdalambda",
          "Label": "execution role"
        },
        {
          "From": "ReportLambdalambda",
          "To": "ReportBuckets3",
          "Label": "write report"
        },
        {
          "From": "ReportLambdalambda",
          "To": "DLQsqs",
          "Label": "on failure → DLQ"
        }
      ]
    }
  },
  "Resources": {
    "EventBridgeRuledailycloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "saa-scheduler",
        "AlarmDescription": "EventBridge/CloudWatch Events scheduled rule — cron(0 8 * * ? *)",
        "Namespace": "AWS/Events",
        "MetricName": "TriggeredRules"
      }
    },
    "ReportLambdalambda": {
      "Type": "AWS::Lambda::Function",
      "DependsOn": [
        "LambdaRoleiam"
      ],
      "Properties": {
        "FunctionName": "saa-daily-report",
        "Runtime": "nodejs20.x",
        "Handler": "index.handler",
        "MemorySize": 512,
        "Architectures": [
          "arm64"
        ],
        "Timeout": 30,
        "Description": "Scheduled job handler — runs daily report logic.",
        "ReservedConcurrentExecutions": 1,
        "Environment": {
          "Variables": {
            "APP_ENV": "demo",
            "LOG_LEVEL": "info"
          }
        },
        "TracingConfig": {
          "Mode": "Active"
        },
        "Code": {
          "ZipFile": "exports.handler = async (event) => ({ statusCode: 200, body: JSON.stringify({ ok: true, requestId: event.requestContext?.requestId || 'demo' }) });"
        },
        "Role": {
          "Fn::GetAtt": [
            "LambdaRoleiam",
            "Arn"
          ]
        }
      }
    },
    "LambdaRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-daily-report-role",
        "Description": "Lambda execution role — CloudWatch Logs + S3 write for report output",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
          "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
        ]
      }
    },
    "DLQsqs": {
      "Type": "AWS::SQS::Queue",
      "Properties": {
        "QueueName": "saa-report-dlq",
        "MessageRetentionPeriod": 1209600
      }
    },
    "ReportBuckets3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "saa-report-output",
        "VersioningConfiguration": {
          "Status": "Enabled"
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "NotificationConfiguration": {
          "LambdaConfigurations": [
            {
              "Event": "s3:ObjectCreated:*",
              "Function": {
                "Fn::GetAtt": [
                  "ReportLambdalambda",
                  "Arn"
                ]
              }
            }
          ]
        }
      },
      "DependsOn": [
        "ReportLambdalambdaReportBuckets3Permission"
      ]
    },
    "ReportLambdalambdaDLQsqsEventSourceMapping": {
      "Type": "AWS::Lambda::EventSourceMapping",
      "DependsOn": [
        "ReportLambdalambda",
        "DLQsqs"
      ],
      "Properties": {
        "EventSourceArn": {
          "Fn::GetAtt": [
            "DLQsqs",
            "Arn"
          ]
        },
        "FunctionName": {
          "Ref": "ReportLambdalambda"
        },
        "Enabled": true,
        "BatchSize": 10
      }
    },
    "ReportLambdalambdaReportBuckets3Permission": {
      "Type": "AWS::Lambda::Permission",
      "DependsOn": [
        "ReportLambdalambda"
      ],
      "Properties": {
        "Action": "lambda:InvokeFunction",
        "FunctionName": {
          "Ref": "ReportLambdalambda"
        },
        "Principal": "s3.amazonaws.com",
        "SourceAccount": {
          "Ref": "AWS::AccountId"
        },
        "SourceArn": {
          "Fn::Sub": "arn:${AWS::Partition}:s3:::saa-report-output"
        }
      }
    }
  }
}