cloudformation.template

AWSTemplateFormatVersion: 2010-09-09
Description: Launch Compliance Enforcer

Parameters:
  LambdaScriptBucket:
    Type: String
    Description: s3 bucket name of the lambda script to execute
    Default: lambda-scripts-region-accountid
  LambdaScriptBucketKey:
    Type: String
    Description: s3 key of the lambda script to execute
    Default: compliance-enforcer/main.zip



Resources:
  LambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal: 
              Service:
                - "lambda.amazonaws.com" 
            Action: 
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: "root"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - logs:CreateLogStream
                  - logs:CreateLogGroup
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Resource:
                  - "arn:aws:logs:*:*:log-group:/aws/lambda/compliance-enforcer"
                  - "arn:aws:logs:*:*:log-group:/aws/lambda/compliance-enforcer:log-stream:*"
              -
                Effect: "Allow"
                Action:
                  - ec2:RevokeSecurityGroupIngress
                Resource: "*"
              -
                Effect: "Allow"
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub '${ComplianceEnforcerBucket.Arn}/*'
  ComplianceEnforcerBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName:
        Fn::Join: 
        - ""
        - - 'compliance-enforcer-'
          - !Ref AWS::Region
          - '-'
          - !Ref AWS::AccountId
  ComplianceEnforcerBucketPolicy: 
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref ComplianceEnforcerBucket
      PolicyDocument: 
        Statement: 
          - 
            Action: 
              - "s3:GetBucketAcl"
            Effect: "Allow"
            Resource: 
              - !Sub '${ComplianceEnforcerBucket.Arn}'
            Principal:
              Service: cloudtrail.amazonaws.com
          - 
            Action: 
              - "s3:PutObject"
            Effect: "Allow"
            Resource: 
              - !Sub '${ComplianceEnforcerBucket.Arn}/AWSLogs/*'
            Principal:
              Service: cloudtrail.amazonaws.com
            Condition: 
              StringEquals: 
                s3:x-amz-acl: bucket-owner-full-control 
  ComplianceEnforcerSNSTopic:
    Type: AWS::SNS::Topic
    Properties: 
      DisplayName: ComplianceEnforcer
      TopicName: ComplianceEnforcer
  ComplianceEnforcerSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties: 
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: SNS:Publish
            Resource: !Ref ComplianceEnforcerSNSTopic
      Topics: 
        - !Ref ComplianceEnforcerSNSTopic
  ComplianceEnforcerTrail:
    Type: AWS::CloudTrail::Trail
    Properties: 
      EnableLogFileValidation: False
      IsLogging: True
      S3BucketName:
        Fn::Join: 
        - ""
        - - 'compliance-enforcer-'
          - !Ref AWS::Region
          - '-'
          - !Ref AWS::AccountId
      SnsTopicName:
        Fn::GetAtt:
          - "ComplianceEnforcerSNSTopic"
          - "TopicName"
      TrailName: ComplianceEnforcer
    DependsOn: 
      - ComplianceEnforcerBucketPolicy
      - LambdaInvokePermission
  LambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      FunctionName: compliance-enforcer
      Handler: "main"
      Role: 
        Fn::GetAtt: 
          - "LambdaExecutionRole"
          - "Arn"
      Code: 
        S3Bucket: !Ref LambdaScriptBucket
        S3Key: !Ref LambdaScriptBucketKey
      Runtime: "go1.x"
      Timeout: 30
  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt 
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: sns.amazonaws.com
      SourceArn: !Ref ComplianceEnforcerSNSTopic
  LambdaSNSSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !GetAtt 
          - LambdaFunction
          - Arn
      Protocol: lambda
      TopicArn: !Ref ComplianceEnforcerSNSTopic
    DependsOn: 
      - LambdaInvokePermission