Resources:
  # Create a bucket in the local region
  LambdaZipsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  # Copy zip files from source bucket
  CopyZips:
    Type: Custom::CopyZips
    Properties:
      ServiceToken: !GetAtt 'CopyZipsFunction.Arn'
      DestBucket: !Ref 'LambdaZipsBucket'
      SourceBucket: !Ref 'QSS3BucketName'
      Prefix: !Ref 'QSS3KeyPrefix'
      Objects:
        - functions/packages/MyFunction/lambda.zip
  # Your lambda function
  MyFunction:
    # DependsOn is required to ensure copy is complete before creating the function
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
      Code:
        # points to regional bucket
        S3Bucket: !Ref 'LambdaZipsBucket'
        S3Key: !Sub '${QSS3KeyPrefix}functions/packages/MyFunction/lambda.zip'
    ...