deploy-sumo-aws-apps.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: A CloudFormation template that creates a role for authenticating with Sumo’s AWS integrations.

Metadata:

  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Sumo Logic Deployment Configuration (Required)"
        Parameters:
          - SumoDeployment
          - SumoAccessID
          - SumoAccessKey
          - RemoveSumoResourcesOnDeleteStack
          - SumoOrganizationId
          - S3BucketPrefix
      -
        Label:
          default: "Select the Sumo Logic Apps that you want to Deploy:"
        Parameters:
          - InstallGuardDutyApp
          - InstallGuardDutyBenchmarkApp
          - InstallVPCFlowLogsApp
          - InstallWAFApp
          - InstallS3AuditApp
          - InstallSecurityHub
          - InstallThreatIntelForAWS
          - InstallCloudTrailApp
          - InstallCISFoundationsApp
          - InstallPCICloudTrailApp
          - InstallPCIVPCFlowLogsApp

      -
        Label:
          default: "Sumo Logic Amazon GuardDuty App Configuration"
        Parameters:
          - SourceCategoryName

      -
        Label:
          default: "Sumo Logic Amazon GuardDuty Benchmark App Configuration"
        Parameters:
          - BenchmarkSourceCategoryName
      -
        Label:
          default: "Sumo Logic Amazon VPC Flow Logs App Configuration"
        Parameters:
          - VPCFlowLogsTargetS3BucketName
          - VPCFlowLogsCreateTargetS3Bucket
          - VPCFlowLogsSourceCategoryName
          - VPCFlowLogsPathExpression
          - VPCFlowLogsExcludeRuleName
          - VPCFlowLogsExcludeRule

      -
        Label:
          default: "Sumo Logic Amazon S3 Audit App Configuration"
        Parameters:
          - S3AuditLogsTargetS3BucketName
          - S3AuditCreateTargetS3Bucket
          - S3AuditSourceCategoryName
          - S3AuditPathExpression
      -
        Label:
          default: "Sumo Logic AWS WAF App Configuration"
        Parameters:
          - KinesisDestinationS3BucketName
          - CreateKinesisDestinationS3Bucket
          - WAFSourceCategoryName
          - WAFPathExpression
          - DeliveryStreamName
          - CompressionFormat

      -
        Label:
          default: "Sumo Logic AWS CloudTrail App Configuration"
        Parameters:
          - CloudTrailTargetS3BucketName
          - CreateCloudTrailTargetS3Bucket
          - CloudTrailSourceCategoryName
          - CloudTrailPathExpression

      -
        Label:
          default: "Sumo Logic AWS Security Hub App Configuration"
        Parameters:
          - EnableSecurityHub
          - SecurityHubLogsS3BucketName
          - SecurityHubCreateS3Bucket
          - SecurityHubPathExpression
          - SecurityHubConnectionName
          - SecurityHubSourceCategoryName

      -
        Label:
          default: "Sumo Logic Threat Intel For AWS App Configuration"
        Parameters:
          - CloudTrailSourceCategoryName
          - VPCFlowLogsSourceCategoryName
          - ELBSourceCategory

      -
        Label:
          default: "Sumo Logic CIS AWS Foundations Benchmark App Configuration"
        Parameters:
          - CISFoundationsTargetS3BucketName
          - CISFoundationsSourceCategoryName
          - CreateCISFoundationsTargetS3Bucket
          - CISFoundationsPathExpression
      -
        Label:
          default: "Sumo Logic PCI Compliance For AWS CloudTrail App Configuration"
        Parameters:
          - CloudTrailSourceCategoryName
          - CloudTrailPathExpression
          - CloudTrailTargetS3BucketName
          - CreateCloudTrailTargetS3Bucket

      -
        Label:
          default: "Sumo Logic PCI Compliance For Amazon VPC Flow App Configuration"
        Parameters:
          - VPCFlowLogsSourceCategoryName
          - VPCFlowLogsPathExpression
          - VPCFlowLogsTargetS3BucketName
          - VPCFlowLogsCreateTargetS3Bucket

      - Label:
          default: "AWS Quick Start configuration"
        Parameters:
          - QSS3BucketName
          - QSS3KeyPrefix

    ParameterLabels:
      SumoDeployment:
        default: "Sumo Logic Deployment Name"
      SumoAccessID:
        default: "Sumo Logic Access ID"
      SumoAccessKey:
        default: "Sumo Logic Access Key"
      RemoveSumoResourcesOnDeleteStack:
        default: "Delete Sumo Logic Resources when stack is deleted"
      SumoOrganizationId:
        default: "Sumo Logic Organization Id"
      S3BucketPrefix:
        default: "Prefix For Your S3 Buckets"
      InstallGuardDutyApp:
        default: "Install Amazon GuardDuty App"
      InstallGuardDutyBenchmarkApp:
        default: "Install Amazon GuardDuty Benchmark App"
      InstallVPCFlowLogsApp:
        default: "Install Amazon VPC Flow Logs App"
      InstallWAFApp:
        default: "Install AWS WAF App"
      InstallS3AuditApp:
        default: "Install Amazon S3 Audit App"
      InstallSecurityHub:
        default: "Install AWS Security Hub App"
      InstallThreatIntelForAWS:
        default: "Install Threat Intel for AWS App"
      InstallPCICloudTrailApp:
        default: "Install PCI Compliance For AWS CloudTrail App"
      InstallPCIVPCFlowLogsApp:
        default: "Install PCI Compliance For Amazon VPC Flow App"
      InstallCloudTrailApp:
        default: "Install AWS CloudTrail App"
      InstallCISFoundationsApp:
        default: "Install CIS AWS Foundations Benchmark App"
      SourceCategoryName:
        default: "Source Category Name"
      BenchmarkSourceCategoryName:
        default: "Source Category Name"
      VPCFlowLogsTargetS3BucketName:
        default: "S3 Bucket Name for Logs"
      VPCFlowLogsCreateTargetS3Bucket:
        default: "Create S3 Bucket for Logs"
      VPCFlowLogsSourceCategoryName:
        default: "Source Category Name"
      VPCFlowLogsPathExpression:
        default: "Path Expression"
      VPCFlowLogsExcludeRuleName:
        default: "Exclude Rule Name"
      VPCFlowLogsExcludeRule:
        default: "Exclude Rule"
      S3AuditLogsTargetS3BucketName:
        default: "S3 Bucket Name for Logs"
      S3AuditCreateTargetS3Bucket:
        default: "Create S3 Bucket for Logs"
      S3AuditSourceCategoryName:
        default: "Source Category Name"
      S3AuditPathExpression:
        default: "Path Expression"
      KinesisDestinationS3BucketName:
        default: "S3 Bucket Name for Logs"
      CreateKinesisDestinationS3Bucket:
        default: "Create S3 Bucket for Logs"
      WAFSourceCategoryName:
        default: "Source Category Name"
      WAFPathExpression:
        default: "Path Expression"
      DeliveryStreamName:
        default: "Kinesis Delivery Stream Name"
      CompressionFormat:
        default: "Compression Format"
      EnableSecurityHub:
        default: "Enable Security Hub"
      SecurityHubLogsS3BucketName:
        default: "S3 Bucket Name for Logs"
      SecurityHubCreateS3Bucket:
        default: "Create S3 Bucket for Logs"
      SecurityHubPathExpression:
        default: "Path Expression"
      SecurityHubConnectionName:
        default: "Security Hub Connection Name"
      SecurityHubSourceCategoryName:
        default: "Source Category Name"
      CloudTrailTargetS3BucketName:
        default: "S3 Bucket Name for Logs"
      CreateCloudTrailTargetS3Bucket:
        default: "Create S3 Bucket for Logs"
      CloudTrailSourceCategoryName:
        default: "Source Category Name"
      CloudTrailPathExpression:
        default: "Path Expression"
      ELBSourceCategory:
        default: "Sumo Logic ELB App Source Category Name"
      CISFoundationsTargetS3BucketName:
        default: "S3 Bucket Name for Logs"
      CISFoundationsSourceCategoryName:
        default: "Source Category Name"
      CreateCISFoundationsTargetS3Bucket:
        default: "Create S3 Bucket for Logs"
      CISFoundationsPathExpression:
        default: "Path Expression"
      QSS3BucketName:
        default: "Quick Start S3 bucket name"
      QSS3KeyPrefix:
        default: "Quick Start S3 key prefix"

Parameters:
  InstallGuardDutyApp:
    Type: String
    Default: "yes"
    Description: Do you need to install guard duty app?
    AllowedValues:
      - "yes"
      - "no"
  SourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/GuardDuty

  SumoOrganizationId:
    Description: The Account Overview page displays information about your Sumo Logic organization.
    Type: String
  SumoAccessID:
    Type: String
    Description: The Sumo Logic Access ID.
  SumoAccessKey:
    Type: String
    Description: The Sumo Logic Access Key.
  SumoDeployment:
    Type: String
    AllowedValues:
      - au
      - ca
      - de
      - eu
      - jp
      - us2
      - us1
    Description: "Enter au, ca, de, eu, jp, us2, or us1."
  RemoveSumoResourcesOnDeleteStack:
    AllowedValues:
      - true
      - false
    Default: true
    Description: To delete collector, sources and app when stack is deleted, set this parameter to true. Default is true.
    Type: String
  S3BucketPrefix:
    Type: String
    Description: Provide a unique S3 Bucket prefix to apply for all logs buckets created using the quickstart template.

  InstallGuardDutyBenchmarkApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  BenchmarkSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/Guardduty/benchmark

  InstallCloudTrailApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  CloudTrailSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/cloudtrail
  CloudTrailPathExpression:
    Type: String
    Description: Path expression to match one or more S3 objects. For example, ABC*.log or ABC.log or *.
    Default: "*"
  CloudTrailTargetS3BucketName:
    Type: String
    Default: "quickstart-cloudtrail-logs"
    Description: Provide the bucket name where the logs will be stored and then collected by Sumo Logic source.
  CreateCloudTrailTargetS3Bucket:
    Type: String
    Default: "yes"
    AllowedValues: ["yes", "no"]
    Description: "Do you want to create a target S3 bucket?"

  InstallCISFoundationsApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  CISFoundationsSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/CIS
  CISFoundationsPathExpression:
    Type: String
    Description: Path expression to match one or more S3 objects. For example, ABC*.log or ABC.log or *.
    Default: "*"
  CISFoundationsTargetS3BucketName:
    Type: String
    Default: "quickstart-cis-logs"
    Description: Provide the bucket name where the logs will be stored and then collected by Sumo Logic source.
  CreateCISFoundationsTargetS3Bucket:
    Type: String
    Default: "yes"
    AllowedValues: ["yes", "no"]
    Description: "Do you want to create a target S3 bucket?"

  InstallVPCFlowLogsApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  VPCFlowLogsSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/vpc
  VPCFlowLogsTargetS3BucketName:
    Type: String
    Default: "quickstart-vpc-logs"
    Description: Provide the bucket name where the logs will be stored and then collected by Sumo Logic source.
  VPCFlowLogsCreateTargetS3Bucket:
    Type: String
    Default: "yes"
    AllowedValues: ["yes", "no"]
    Description: "Do you want to create a target S3 bucket?"
  VPCFlowLogsPathExpression:
    Type: String
    Description: Path expression to match one or more S3 objects. For example, ABC*.log or ABC.log or *.
    Default: "*"
  VPCFlowLogsExcludeRuleName:
    Type: String
    Description: Processing rule for Sumo Logic Source.
    Default: Exclude VPC File Flow headers
  VPCFlowLogsExcludeRule:
    Type: String
    Description: Exclude rule regexp
    Default: version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status

  InstallS3AuditApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  S3AuditSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/s3audit
  S3AuditLogsTargetS3BucketName:
    Type: String
    Default: "quickstart-s3-audit-logs"
    Description: Provide the bucket name where the logs will be stored and then collected by Sumo Logic source.
  S3AuditCreateTargetS3Bucket:
    Type: String
    Default: "yes"
    AllowedValues: ["yes", "no"]
    Description: "Do you want to create a target S3 bucket?"
  S3AuditPathExpression:
    Type: String
    Description: Path expression to match one or more S3 objects. For example, ABC*.log or ABC.log or *.
    Default: "*"

  InstallWAFApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  WAFSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: "AWS/QuickStart/waf"
  KinesisDestinationS3BucketName:
    Type: String
    Default: "quickstart-waf-kinesis-logs"
    Description: Provide the bucket name where the logs will be stored and then collected by Sumo Logic source.
  CreateKinesisDestinationS3Bucket:
    Type: String
    Default: "yes"
    AllowedValues: ["yes", "no"]
    Description: "Do you want to create a target S3 bucket?"
  WAFPathExpression:
    Type: String
    Description: Path expression to match one or more S3 objects. For example, ABC*.log or ABC.log or *.
    Default: "*"
  DeliveryStreamName:
    Type: String
    Default: waf-kinesis-delivery-stream-quickstart
    Description: "Name of the delivery stream."

  InstallSecurityHub:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  EnableSecurityHub:
    Type: String
    Default: "no"
    AllowedValues: ["yes", "no"]
  SecurityHubConnectionName:
    Type: String
    Default: security-hub-webhook-connection
  SecurityHubSourceCategoryName:
    Type: String
    Description: Category metadata to use later for querying, e.g. prod/web/apache/access . This data is queried using the '_sourceCategory' key name.
    Default: AWS/QuickStart/hub
  SecurityHubPathExpression:
    Type: String
    Default: "*"
    Description: Path expression to match one or more S3 objects. For example, ABC*.log or ABC.log or *.
  SecurityHubLogsS3BucketName:
    Type: String
    Default: "quickstart-hub-logs"
    Description: Provide the bucket name where the logs will be stored and then collected by Sumo Logic source.
  SecurityHubCreateS3Bucket:
    Type: String
    Default: "yes"
    AllowedValues: ["yes", "no"]
    Description: "Do you want to create a target S3 bucket?"

  InstallThreatIntelForAWS:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
  ELBSourceCategory:
    Type: String
    Description: Category name for your Sumo Logic ELB app
    Default: "*elb*"

  InstallPCICloudTrailApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"

  InstallPCIVPCFlowLogsApp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"

  QSS3BucketName:
    AllowedPattern: "^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$"
    ConstraintDescription: "Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-)."
    Default: "aws-quickstart"
    Description: "S3 bucket name for the Quick Start assets. This string can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-)."
    Type: "String"

  QSS3KeyPrefix:
    AllowedPattern: "^[0-9a-zA-Z-/]*$"
    ConstraintDescription: "Quick Start key prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slash (/)."
    Default: "quickstart-sumo-logic-log-centralization/"
    Description: "S3 key prefix for the Quick Start assets. Quick Start key prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slash (/)."
    Type: "String"

Conditions:
  InstallGuardDutyCondition: !Equals [ !Ref InstallGuardDutyApp, "yes" ]
  InstallGuardDutyBenchmarkCondition: !Equals [ !Ref InstallGuardDutyBenchmarkApp, "yes" ]
  InstallCloudTrailCondition: !Equals [ !Ref InstallCloudTrailApp, "yes" ]
  InstallCISFoundationsCondition: !Equals [ !Ref InstallCISFoundationsApp, "yes" ]
  InstallVPCFlowLogsCondition: !Equals [ !Ref InstallVPCFlowLogsApp, "yes" ]
  InstallS3AuditCondition: !Equals [ !Ref InstallS3AuditApp, "yes" ]
  InstallWAFCondition: !Equals [ !Ref InstallWAFApp, "yes" ]
  InstallSecurityHubCondition: !Equals [ !Ref InstallSecurityHub, "yes" ]
  InstallThreatIntelCondition: !Equals [ !Ref InstallThreatIntelForAWS, "yes" ]
  InstallPCICloudTrailCondition: !Equals [ !Ref InstallPCICloudTrailApp, "yes" ]
  InstallPCIVPCFlowLogsCondition: !Equals [ !Ref InstallPCIVPCFlowLogsApp, "yes" ]

Resources:

  sumocisfoundations:
    Condition: InstallCISFoundationsCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/CIS-Foundations/CIS-Foundations.template.yaml"
      Parameters:
        CollectorName: "QuickStart-CISAWSFoundationsBenchmark"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref CISFoundationsSourceCategoryName
        SourceName: "CISAWSFoundationsBenchmark"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        SumoDeployment: !Ref SumoDeployment
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        PathExpression: !Ref CISFoundationsPathExpression
        CISTargetS3BucketName: !Sub "${S3BucketPrefix}-${CISFoundationsTargetS3BucketName}"
        CreateTargetS3Bucket: !Ref CreateCISFoundationsTargetS3Bucket
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoguardduty:
    Condition: InstallGuardDutyCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/guardduty/guardduty.template.yaml"
      Parameters:
        CollectorName: "QuickStart-AmazonGuardDuty"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref SourceCategoryName
        SourceName: "AmazonGuardDuty"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        SumoDeployment: !Ref SumoDeployment
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoguarddutybenchmark:
    Condition: InstallGuardDutyBenchmarkCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/guardduty/benchmark/guarddutybenchmark.template.yaml"
      Parameters:
        CollectorName: "QuickStart-AmazonGuardDutyBenchmark"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref BenchmarkSourceCategoryName
        SourceName: "AmazonGuardDutyBenchmark"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        SumoDeployment: !Ref SumoDeployment
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumocloudtrail:
    Condition: InstallCloudTrailCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/cloudtrail/cloudtrail.template.yaml"
      Parameters:
        CollectorName: "QuickStart-AWSCloudTrail"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref CloudTrailSourceCategoryName
        SourceName: "AWSCloudTrail"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        SumoDeployment: !Ref SumoDeployment
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        PathExpression: !Ref CloudTrailPathExpression
        CloudTrailTargetS3BucketName: !Sub "${S3BucketPrefix}-${CloudTrailTargetS3BucketName}"
        CreateTargetS3Bucket: !Ref CreateCloudTrailTargetS3Bucket
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoS3Audit:
    Condition: InstallS3AuditCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/s3-audit/s3audit.template.yaml"
      Parameters:
        CollectorName: "QuickStart-AmazonS3Audit"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref S3AuditSourceCategoryName
        SourceName: "AmazonS3Audit"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        AccessLogsTargetS3BucketName: !Sub "${S3BucketPrefix}-${S3AuditLogsTargetS3BucketName}"
        CreateTargetS3Bucket: !Ref S3AuditCreateTargetS3Bucket
        PathExpression: !Ref S3AuditPathExpression
        SumoDeployment: !Ref SumoDeployment
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoSecurityHubStack:
    Type: AWS::CloudFormation::Stack
    Condition: InstallSecurityHubCondition
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/security-hub/securityhub.template.yaml"
      Parameters:
        SumoDeployment: !Ref SumoDeployment
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        EnableSecurityHub: !Ref EnableSecurityHub
        CollectorName: "QuickStart-AWSSecurityHub"
        ConnectionName: !Ref SecurityHubConnectionName
        S3BucketName: !Sub "${S3BucketPrefix}-${SecurityHubLogsS3BucketName}"
        CreateTargetS3Bucket: !Ref SecurityHubCreateS3Bucket
        SourceCategoryName: !Ref SecurityHubSourceCategoryName
        SourceName: "AWSSecurityHub"
        PathExpression: !Ref SecurityHubPathExpression
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoThreatIntelForAWS:
    Condition: InstallThreatIntelCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/threat-intel-for-aws/threatintel.template.yaml"
      Parameters:
        CloudTrailSourceCategory: !Ref CloudTrailSourceCategoryName
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        VPCSourceCategory: !Ref VPCFlowLogsSourceCategoryName
        ELBSourceCategory: !Ref ELBSourceCategory
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        SumoDeployment: !Ref SumoDeployment
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoWAF:
    Condition: InstallWAFCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/WAF/waf.template.yaml"
      Parameters:
        CollectorName: "QuickStart-AWSWAF"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref WAFSourceCategoryName
        SourceName: "AWSWAF"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        KinesisDestinationS3BucketName: !Sub "${S3BucketPrefix}-${KinesisDestinationS3BucketName}"
        CreateKinesisDestinationS3Bucket: !Ref CreateKinesisDestinationS3Bucket
        PathExpression: !Ref WAFPathExpression
        SumoDeployment: !Ref SumoDeployment
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        DeliveryStreamName: !Ref DeliveryStreamName
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoVPCFlowLogs:
    Condition: InstallVPCFlowLogsCondition
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/vpc-flow-logs/vpcflowlogs.template.yaml"
      Parameters:
        CollectorName: "QuickStart-AmazonVPCFlowLogs"
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        SourceCategoryName: !Ref VPCFlowLogsSourceCategoryName
        SourceName: "AmazonVPCFlowLogs"
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        LogsTargetS3BucketName: !Sub "${S3BucketPrefix}-${VPCFlowLogsTargetS3BucketName}"
        VPCFlowLogAppSourceCategoryName: !Ref VPCFlowLogsSourceCategoryName
        CreateTargetS3Bucket: !Ref VPCFlowLogsCreateTargetS3Bucket
        PathExpression: !Ref VPCFlowLogsPathExpression
        SumoDeployment: !Ref SumoDeployment
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoPCIVPCFlowLogsStack:
    Type: AWS::CloudFormation::Stack
    Condition: InstallPCIVPCFlowLogsCondition
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/pci-compliance-vpc-flow/pci_compliance_vpc_logs.template.yaml"
      Parameters:
        S3SourceUtilTempalteS3Url: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/sumo-s3-source-utils/s3utils.template.yaml"
        SumoDeployment: !Ref SumoDeployment
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        CollectorName: !If [InstallVPCFlowLogsCondition, "QuickStart-AmazonVPCFlowLogs", "QuickStart-AmazonPCI-VPCFlowLogs"]
        LogsTargetS3BucketName: !Sub "${S3BucketPrefix}-${VPCFlowLogsTargetS3BucketName}"
        CreateTargetS3Bucket: !If [InstallVPCFlowLogsCondition, "no", !Ref VPCFlowLogsCreateTargetS3Bucket]
        PCIVpcFlowAppSourceCategory: !Ref VPCFlowLogsSourceCategoryName
        SourceName: "AmazonVPCFlowLogs"
        PathExpression: !Ref VPCFlowLogsPathExpression
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        SourceCategory: !Ref VPCFlowLogsSourceCategoryName
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix

  sumoPCICloudTrailStack:
    Type: AWS::CloudFormation::Stack
    Condition: InstallPCICloudTrailCondition
    Properties:
      TemplateURL: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/pci-compliance-cloudtrail-app/pci-compliance-cloudtrail-app.template.yaml"
      Parameters:
        S3SourceUtilTempalteS3Url: !Sub "https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/sumo-aws-apps/sumo-s3-source-utils/s3utils.template.yaml"
        SumoDeployment: !Ref SumoDeployment
        SumoAccessID: !Ref SumoAccessID
        SumoAccessKey: !Ref SumoAccessKey
        RemoveSumoResourcesOnDeleteStack: !Ref RemoveSumoResourcesOnDeleteStack
        CollectorName: !If [InstallCloudTrailCondition, "QuickStart-AWSCloudTrail", "QuickStart-AWSPCI-CloudTrail"]
        SourceCategory: !Ref CloudTrailSourceCategoryName
        LogsTargetS3BucketName: !Sub "${S3BucketPrefix}-${CloudTrailTargetS3BucketName}"
        CreateTargetS3Bucket: !If [InstallCloudTrailCondition, "no", !Ref CreateCloudTrailTargetS3Bucket]
        SourceName: "AWSCloudTrail"
        CreateTrail: !If [InstallCloudTrailCondition, "no", "yes"]
        PathExpression: !Ref CloudTrailPathExpression
        ExternalID: !Sub "${SumoDeployment}:${SumoOrganizationId}"
        PCICloudTrailAppSourceCategory: !Ref CloudTrailSourceCategoryName
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix