text: from aws_cdk import (
      aws_iam as iam,
      aws_ec2 as ec2,
      aws_ssm as ssm,
      core
  )
  
  class SecurityStack(core.Stack):
      def __init__(self, scope: core.Construct, id:str, vpc: ec2.Vpc, **kwargs) -> None:
          super().__init__(scope, id, **kwargs)
          
          prj_name = self.node.try_get_context("project_name")
          env_name = self.node.try_get_context("env")
  
          lambda_sg = ec2.SecurityGroup(self, 'lambdasg',
                                          security_group_name='lambda-sg',
                                          vpc=vpc,
                                          description='SG for lambda functions',
                                          allow_all_outbound=True
                                          )
          
          self.bastion_sg = ec2.SecurityGroup(self, 'bastionsg',
                                          security_group_name='bastion-sg',
                                          vpc=vpc,
                                          description='SG for Bastion Host',
                                          allow_all_outbound=True
                                          )
  
          self.bastion_sg.add_ingress_rule(ec2.Peer.any_ipv4(), ec2.Port.tcp(22), "SSH Access")
          
          lambda_role = iam.Role(self, 'lambdarole',
                                  assumed_by=iam.ServicePrincipal(service='lambda.amazonaws.com'),
                                  role_name='lambda-role',
                                  managed_policies=[iam.ManagedPolicy.from_aws_managed_policy_name(
                                      managed_policy_name='service-role/AWSLambdaBasicExecutionRole'
                                  )])
          lambda_role.add_to_policy(
              statement=iam.PolicyStatement(
                  actions=['s3:*', 'rds:*'],
                  resources=['*']
              )
          )
  
          # Declare ssm paramas
  
          ssm.StringParameter(self, 
                              'lambdasg-param',
                              parameter_name=f'/{env_name}/lambda-sg',
                              string_value=lambda_sg.security_group_id)
          
          ssm.StringParameter(self, 
                              'lambdarole-param-arn',
                              parameter_name=f'/{env_name}/lambda-role-arn',
                              string_value=lambda_role.role_arn)
  
          ssm.StringParameter(self, 
                              'lambdarole-param-name',
                              parameter_name=f'/{env_name}/lambda-role-name',
                              string_value=lambda_role.role_name)