Common-LogBuckets.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Common-LogBuckets Template.
  This creates Log (Audit) S3 Buckets.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Environment Configuration
        Parameters:
          - AccountAlias
          - EnvironmentName
      - Label:
          default: Bucket Configuration
        Parameters:
          - UseGlacier
    ParameterLabels:
      AccountAlias:
        default: Account Alias
      EnvironmentName:
        default: Environment Name
      UseGlacier:
        default: Use Glacier
Parameters:
  AccountAlias:
    Description: Unique Alias of the Account (if defined). If specified, the Alias instead of the AccountID is appended to bucket names to insure uniqueness.
    Type: String
    MaxLength: 32
    Default: ''
    AllowedPattern: (^$|^[a-z][-a-z0-9]*$)
    ConstraintDescription: must begin with a lower case letter and contain lower case letters, numbers and dashes.
  EnvironmentName:
    Description: Name of the Environment associated with the Stack
    Type: String
    Default: Production
    AllowedValues:
      - Production
      - Staging
      - UAT
      - QA
      - Testing
      - Development
      - Build
      - Core
      - Recovery
      - Log
      - Identity
      - Management
      - Organization
    ConstraintDescription: must be Production, Staging, UAT, QA, Testing, Development, Build, Core, Recovery, Log, Identity, Management or Organization.
  UseGlacier:
    Description: Use Glacier for Archived Logs
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
Mappings:
  RegionNameMap:
    us-east-1:
      Name: Virginia
      Code: ue1
    us-east-2:
      Name: Ohio
      Code: ue2
    us-west-1:
      Name: California
      Code: uw1
    us-west-2:
      Name: Oregon
      Code: uw2
    ap-east-1:
      Name: HongKong
      Code: ae1
    ap-south-1:
      Name: Mumbai
      Code: ad1
    ap-northeast-2:
      Name: Seoul
      Code: an2
    ap-southeast-1:
      Name: Singapore
      Code: as1
    ap-southeast-2:
      Name: Sydney
      Code: as2
    ap-northeast-1:
      Name: Tokyo
      Code: an1
    ca-central-1:
      Name: Canada
      Code: cc1
    eu-central-1:
      Name: Frankfurt
      Code: ec1
    eu-west-1:
      Name: Ireland
      Code: ew1
    eu-west-2:
      Name: London
      Code: ew2
    eu-west-3:
      Name: Paris
      Code: ew3
    eu-north-1:
      Name: Stockholm
      Code: en1
    me-south-1:
      Name: Bahrain
      Code: ms1
    sa-east-1:
      Name: SaoPaulo
      Code: se1
  RegionLoadBalancerAccountMap:
    us-east-1:
      Account: '127311923021'
    us-east-2:
      Account: '033677994240'
    us-west-1:
      Account: '027434742980'
    us-west-2:
      Account: '797873946194'
    ap-east-1:
      Account: '754344448648'
    ap-south-1:
      Account: '718504428378'
    ap-northeast-2:
      Account: '600734575887'
    ap-southeast-1:
      Account: '114774131450'
    ap-southeast-2:
      Account: '783225319266'
    ap-northeast-1:
      Account: '582318560864'
    ca-central-1:
      Account: '985666609251'
    eu-central-1:
      Account: '054676820928'
    eu-west-1:
      Account: '156460612806'
    eu-west-2:
      Account: '652711504416'
    eu-west-3:
      Account: '009996457667'
    eu-north-1:
      Account: '897822967062'
    me-south-1:
      Account: '076674570225'
    sa-east-1:
      Account: '507241528517'
Conditions:
  AppendAccountId: !Equals [ !Ref AccountAlias, '' ]
  ConfigureGlacier: !Equals [ !Ref UseGlacier, true ]
Resources:
  ArchiveLogsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub
        - archive-logs-${Account}-${AWS::Region}
        - Account: !If [ AppendAccountId, !Ref 'AWS::AccountId', !Ref AccountAlias ]
      AccessControl: LogDeliveryWrite
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: ReduceStorageCostsThenDeletePriorVersions
            Status: Enabled
            Prefix: ''
            Transitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            ExpirationInDays: 2555
            NoncurrentVersionTransitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            NoncurrentVersionExpirationInDays: 2555
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-ArchiveLogsBucket
    DeletionPolicy: Retain
  ArchiveLogsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ArchiveLogsBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: DenyUnEncryptedConnections
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:*
            Resource: !Sub arn:aws:s3:::${ArchiveLogsBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${ArchiveLogsBucket}/*
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: AES256
          - Sid: DenyDeletes
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:Delete*
            Resource: !Sub arn:aws:s3:::${ArchiveLogsBucket}/*
          - Sid: DenyDeleteBucket
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:DeleteBucket
            Resource: !Sub arn:aws:s3:::${ArchiveLogsBucket}
    DependsOn: ArchiveLogsBucket
  LoadBalancerLogsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub
        - loadbalancer-logs-${Account}-${AWS::Region}
        - Account: !If [ AppendAccountId, !Ref 'AWS::AccountId', !Ref AccountAlias ]
      AccessControl: Private
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: ReduceStorageCostsThenDeletePriorVersions
            Status: Enabled
            Prefix: ''
            Transitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            ExpirationInDays: 2555
            NoncurrentVersionTransitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            NoncurrentVersionExpirationInDays: 2555
      LoggingConfiguration:
        DestinationBucketName: !Ref ArchiveLogsBucket
        LogFilePrefix: loadbalancer
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-LoadBalancerLogsBucket
    DeletionPolicy: Retain
  LoadBalancerLogsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LoadBalancerLogsBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowLoadBalancerWrite
            Effect: Allow
            Principal:
              AWS: !Sub
                - arn:aws:iam::${RegionLoadBalancerAccount}:root
                - RegionLoadBalancerAccount: !FindInMap [ RegionLoadBalancerAccountMap, !Ref 'AWS::Region', Account ]
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${LoadBalancerLogsBucket}/AWSLogs/${AWS::AccountId}/*
          - Sid: DenyUnEncryptedConnections
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:*
            Resource: !Sub arn:aws:s3:::${LoadBalancerLogsBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${LoadBalancerLogsBucket}/*
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: AES256
          - Sid: DenyDeletes
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:Delete*
            Resource: !Sub arn:aws:s3:::${LoadBalancerLogsBucket}/*
          - Sid: DenyDeleteBucket
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:DeleteBucket
            Resource: !Sub arn:aws:s3:::${LoadBalancerLogsBucket}
    DependsOn: LoadBalancerLogsBucket
  ConfigBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub
        - config-${Account}-${AWS::Region}
        - Account: !If [ AppendAccountId, !Ref 'AWS::AccountId', !Ref AccountAlias ]
      AccessControl: Private
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: ReduceStorageCostsThenDeletePriorVersions
            Status: Enabled
            Prefix: ''
            Transitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            ExpirationInDays: 2555
            NoncurrentVersionTransitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            NoncurrentVersionExpirationInDays: 2555
      LoggingConfiguration:
        DestinationBucketName: !Ref ArchiveLogsBucket
        LogFilePrefix: config
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-ConfigBucket
    DeletionPolicy: Retain
  ConfigBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ConfigBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowConfigACLCheck
            Effect: Allow
            Principal:
              Service: config.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !Sub arn:aws:s3:::${ConfigBucket}
          - Sid: AllowConfigWrite
            Effect: Allow
            Principal:
              Service: config.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${ConfigBucket}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
          - Sid: DenyUnEncryptedConnections
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:*
            Resource: !Sub arn:aws:s3:::${ConfigBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${ConfigBucket}/*
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: AES256
          - Sid: DenyDeletes
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:Delete*
            Resource: !Sub arn:aws:s3:::${ConfigBucket}/*
          - Sid: DenyDeleteBucket
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:DeleteBucket
            Resource: !Sub arn:aws:s3:::${ConfigBucket}
    DependsOn: ConfigBucket
  CloudTrailBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub
        - cloudtrail-${Account}-${AWS::Region}
        - Account: !If [ AppendAccountId, !Ref 'AWS::AccountId', !Ref AccountAlias ]
      AccessControl: Private
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: ReduceStorageCostsThenDeletePriorVersions
            Status: Enabled
            Prefix: ''
            Transitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 90
            ExpirationInDays: 2555
            NoncurrentVersionTransitions:
              - StorageClass: !If [ ConfigureGlacier, GLACIER, STANDARD_IA ]
                TransitionInDays: 30
            NoncurrentVersionExpirationInDays: 180
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-CloudTrailBucket
    DeletionPolicy: Retain
  CloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowCloudTrailACLCheck
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !Sub arn:aws:s3:::${CloudTrailBucket}
          - Sid: AllowCloudTrailWrite
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${CloudTrailBucket}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
          - Sid: DenyUnEncryptedConnections
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:*
            Resource: !Sub arn:aws:s3:::${CloudTrailBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:PutObject
            Resource: !Sub arn:aws:s3:::${CloudTrailBucket}/*
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: AES256
          - Sid: DenyDeletes
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:Delete*
            Resource: !Sub arn:aws:s3:::${CloudTrailBucket}/*
          - Sid: DenyDeleteBucket
            Effect: Deny
            Principal:
              AWS: '*'
            Action: s3:DeleteBucket
            Resource: !Sub arn:aws:s3:::${CloudTrailBucket}
    DependsOn: CloudTrailBucket
Outputs:
  ArchiveLogsBucket:
    Description: The ArchiveLogs Bucket Name
    Value: !Ref ArchiveLogsBucket
    Export:
      Name: !Sub ${AWS::StackName}-ArchiveLogsBucket
  LoadBalancerLogsBucket:
    Description: The LoadBalancerLogs Bucket Name
    Value: !Ref LoadBalancerLogsBucket
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancerLogsBucket
  ConfigBucket:
    Description: The Config Bucket Name
    Value: !Ref ConfigBucket
    Export:
      Name: !Sub ${AWS::StackName}-ConfigBucket
  CloudTrailBucket:
    Description: The CloudTrail Bucket Name
    Value: !Ref CloudTrailBucket
    Export:
      Name: !Sub ${AWS::StackName}-CloudTrailBucket