template.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: StackNag Slack Notifications App

Parameters:
  LambdaCodeBucket:
    Type: String
  PriceNotifyUrl:
    Type: String
  CWNamespace:
    Type: String
  LambdaSchedule:
    Type: String

Resources:
  StackNagRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSOpsWorks_FullAccess'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
        - PolicyName: !Sub '${AWS::StackName}-policy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'cloudwatch:PutMetricData'
                  - 'SNS:Publish'
                Resource: '*'

  StackNagSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${AWS::StackName}-notifications'

  StackNagSnsTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref StackNagSnsTopic
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'sns:Publish'
            Resource: !Ref StackNagSnsTopic
            Principal:
              AWS: '*'
            Condition:
              ArnLike:
                AWS::SourceArn: !Sub 'arn:aws:*:*:${AWS::AccountId}:*'

  StackNagFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: stack-nag.handler
      Runtime: python3.8
      Timeout: 300
      Role: !GetAtt [StackNagRole, Arn]
      FunctionName: !Sub '${AWS::StackName}-function'
      Environment:
        Variables:
          CLOUDWATCH_NAMESPACE: !Ref CWNamespace
          PRICE_NOTIFY_URL: !Ref PriceNotifyUrl
          SNS_NOTIFICATION_TOPIC: !Ref StackNagSnsTopic
      Code:
        S3Bucket: !Ref LambdaCodeBucket
        S3Key: !Sub '${AWS::StackName}/stack-nag.zip'

  StackNagPostEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub '${AWS::StackName}-post-trigger'
      ScheduleExpression: !Ref LambdaSchedule
      State: ENABLED
      Targets:
        - Arn: !Sub '${StackNagFunction.Arn}'
          Id: 'StackNagFunction'
          Input: '{"action": "post stack status"}'

  StackNagPostEventRulePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Sub '${StackNagFunction.Arn}'
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt [StackNagPostEventRule, Arn]

  StackNagMetricsEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub '${AWS::StackName}-metrics-trigger'
      ScheduleExpression: rate(10 minutes)
      State: ENABLED
      Targets:
        - Arn: !Sub '${StackNagFunction.Arn}'
          Id: 'StackNagFunction'
          Input: '{"action": "metrics"}'

  StackNagMetricsEventRulePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Sub '${StackNagFunction.Arn}'
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt [StackNagMetricsEventRule, Arn]

  StackNagLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: 'Delete'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-function'
      RetentionInDays: 60