Add Lambda handler wrapper for SNS-based custom resources

[roberth-k]

Description of changes:
Adds cfn.LambdaWrapSNS(). This function is similar to cfn.LambdaWrap(), but it first unwraps the CloudFormation custom resource input payload from a SNS event. An invalid SNS event is considered an invocation error.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov-io]

Codecov Report

Merging #208 into master will decrease coverage by 1.31%.
The diff coverage is 0%.

@@            Coverage Diff             @@
##           master     #208      +/-   ##
==========================================
- Coverage    77.2%   75.88%   -1.32%     
==========================================
  Files          18       18              
  Lines         636      647      +11     
==========================================
  Hits          491      491              
- Misses        104      115      +11     
  Partials       41       41

Impacted Files	Coverage Δ
cfn/wrap.go	65.78% <0%> (-26.81%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 39a255e...75a8753. Read the comment docs.

[bmoffatt]

Can you point me to an example (docs, other languages, etc..) of how the SNS gets sent to the Lambda?

1. It's not clear to me how/why this would get used instead of the direct Lambda backed customer resources.
2. I want to do a functional test myself :)

[roberth-k]

This guide from the AWS Blog provides a practical example, although some of the samples are erroneous (e.g. the Message of an example event not being shown as a string). Amazon's documentation for SNS-backed custom resources does suggest the input signature is the same as for Lambda-backed custom resources, but having recently implemented one I've had to include this SNS event wrapper to make it work.

I suspect that a SNS-backed custom resource is invoked via the Publish API rather than any special integration, so it would make sense that the event is delivered with the appropriate decorations.

[bmoffatt]

That blog really helps put this in context, thanks!

You might be asking yourself why I used SNS when CloudFormation custom resources can invoke Lambda directly. I could have invoked Lambda directly, but SNS simplifies cross account permissions and makes the configuration easier.