compliance-account-setup.yaml

#
# Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# or in the "license" file accompanying this file. This file is distributed 
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either 
# express or implied. See the License for the specific language governing 
# permissions and limitations under the License.
#

#
# NO CHANGE SHOUD BE REQUIRED
# This code is launching a Nested Stack. To modify the RuleSet, modify compliance-account-ruleset-setup.yaml in the RuleSet directory (see README)
#

AWSTemplateFormatVersion: 2010-09-09
Description: Sets up the Compliance Account with lambda functions used by custom rules and the elements used by the RuleSet. 
Parameters:
  SourceLambdaBucket:
    Type: String
    Description: Bucket name where lambda code zips are placed
    MaxLength: 63
    MinLength: 3
    ConstraintDescription: Enter the name not the ARN, must be in the same region than the stack
    
  CentralizedS3BucketConfig:
    ConstraintDescription: Enter DNS-compliant prefix
    Description: Bucket prefix where Config logs are stored. A dash and the account ID (12-digit) will be appended to it
    Default: centralized-config
    MaxLength: 63
    MinLength: 10
    Type: String
    
Resources:

  CreateRuleSetStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join ["/", ["https://s3.amazonaws.com", !Ref SourceLambdaBucket, "compliance-account-ruleset-setup.yaml"]]
      Parameters:
        SourceLambdaBucket: !Ref SourceLambdaBucket
        LambdaRuleIAMRoleARN: !GetAtt 
        - LambdaRuleIAMRole
        - Arn
    DependsOn: LambdaRuleIAMRole

  ComplianceEventsDynamoDBTable: 
    Type: "AWS::DynamoDB::Table"
    Properties: 
      AttributeDefinitions: 
        - 
          AttributeName: "RuleARN"
          AttributeType: "S"
        - 
          AttributeName: "RecordedInDDBTimestamp"
          AttributeType: "S"
      KeySchema: 
        - 
          AttributeName: "RuleARN"
          KeyType: "HASH"
        - 
          AttributeName: "RecordedInDDBTimestamp"
          KeyType: "RANGE"
      ProvisionedThroughput: 
        ReadCapacityUnits: "5"
        WriteCapacityUnits: "5"
      TableName: "ComplianceEventsTable"

  ComplianceStatusDynamoDBTable: 
    Type: "AWS::DynamoDB::Table"
    Properties: 
      AttributeDefinitions: 
        - 
          AttributeName: "RuleARN"
          AttributeType: "S"
      KeySchema: 
        - 
          AttributeName: "RuleARN"
          KeyType: "HASH"
      ProvisionedThroughput: 
        ReadCapacityUnits: "5"
        WriteCapacityUnits: "5"
      TableName: "ComplianceStatusTable"
    
  LambdaRuleIAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: LambdaForComplianceRuleRole
      Path: /service-role/
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/SecurityAudit'
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: 2012-10-17

  LambdaRuleLogPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles: 
      - LambdaForComplianceRuleRole
      PolicyName: LambdaRuleLogPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: 'logs:CreateLogGroup'
            Resource: !Join 
              - ':'
              - - 'arn:aws:logs'
                - !Ref 'AWS::Region'
                - !Ref 'AWS::AccountId'
          - Effect: Allow
            Action:
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
            Resource: 
              - !Join [ '', ['arn:aws:logs:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':log-group:/aws/lambda/*', ':*']]
    DependsOn: LambdaRuleIAMRole

  LambdaRuleDynamoPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles:  
      - LambdaForComplianceRuleRole
      PolicyName: LambdaRuleDynamoPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: 'dynamodb:UpdateItem'
            Resource: !Join 
              - ':'
              - - 'arn:aws:dynamodb'
                - !Ref 'AWS::Region'
                - !Ref 'AWS::AccountId'
                - 'table/ComplianceStatusTable'
          - Effect: Allow
            Action: 'dynamodb:UpdateItem'
            Resource: !Join 
              - ':'
              - - 'arn:aws:dynamodb'
                - !Ref 'AWS::Region'
                - !Ref 'AWS::AccountId'
                - 'table/ComplianceEventsTable'
    DependsOn: 
    - LambdaRuleIAMRole
    - ComplianceStatusDynamoDBTable
    - ComplianceEventsDynamoDBTable    

  LambdaRuleSNSPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles: 
      - LambdaForComplianceRuleRole
      PolicyName: LambdaRuleSNSPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: 'sns:Publish'
            Resource: '*'
    DependsOn: 
    - LambdaRuleIAMRole
    - ComplianceStatusDynamoDBTable
    - ComplianceEventsDynamoDBTable    

  LambdaRuleAssumeRolePolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles:
        - LambdaForComplianceRuleRole
      PolicyName: AssumeRole
      PolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Resource: '*'
        Version: 2012-10-17
    DependsOn: 
    - LambdaRuleIAMRole

  CentralizedS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ !Ref CentralizedS3BucketConfig, !Ref 'AWS::AccountId']]
      LifecycleConfiguration:
        Rules:
        - Status: Enabled
          Transitions:
          - StorageClass: STANDARD_IA
            TransitionInDays: 30
      Tags:
      - Key: Owner
        Value: Security
      VersioningConfiguration:
        Status: Enabled
        
  CentralizedS3BucketPolicy:
    DependsOn: CentralizedS3Bucket
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Join [ "-", [ !Ref CentralizedS3BucketConfig, !Ref 'AWS::AccountId']]
      PolicyDocument:
        Statement:
        - Action: s3:GetBucketAcl
          Effect: Allow
          Principal:
            Service: config.amazonaws.com
          Resource: !Join [ "", ["arn:aws:s3:::", !Ref CentralizedS3BucketConfig, "-", !Ref 'AWS::AccountId']]
          Sid: ConfigAllowGetBucketAcl
        - Action: s3:PutObject
          Condition:
            StringEquals:
              s3:x-amz-acl: bucket-owner-full-control
          Effect: Allow
          Principal:
            Service: config.amazonaws.com
          Resource: !Join [ "", ["arn:aws:s3:::", !Ref CentralizedS3BucketConfig, "-", !Ref 'AWS::AccountId', "/AWSLogs/*"]]
          Sid: ConfigAllowPutObject
        Version: '2012-10-17'