marbot-aws-account-connection.yml

---
# Copyright widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'marbot.io: AWS account connection (https://github.com/marbot-io/monitoring-jump-start)'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'marbot endpoint'
      Parameters:
      - EndpointId
      - Stage
    - Label:
        default: 'Features'
      Parameters:
      - MonitoringAssistant
      - AccountAlias
      - CloudWatchMetricGraph
      - CodePipelineApproval
Parameters:
  EndpointId:
    Description: 'Your marbot endpoint ID (to get this value: select a channel where marbot belongs to and send a message like this: "@marbot show me my endpoint id").'
    Type: String
  Stage:
    Description: 'marbot stage (never change this!).'
    Type: String
    Default: v1
    AllowedValues: [v1, dev]
  MonitoringAssistant:
    Description: 'Configure AWS monitoring rules automatically?'
    Type: String
    Default: true
    AllowedValues: [true, false]
  AccountAlias:
    Description: 'Enrich AWS account IDs with alias names?'
    Type: String
    Default: true
    AllowedValues: [true, false]
  CloudWatchMetricGraph:
    Description: 'Enrich CloudWatch Alarms with metric graphs?'
    Type: String
    Default: true
    AllowedValues: [true, false]
  CodePipelineApproval:
    Description: 'Allow CodePipeline approval requests to be approved or rejected with a button?'
    Type: String
    Default: true
    AllowedValues: [true, false]
Conditions:
  MonitoringAssistantEnabled: !Equals [!Ref MonitoringAssistant, 'true']
  AccountAliasEnabled: !Equals [!Ref AccountAlias, 'true']
  CloudWatchMetricGraphEnabled: !Equals [!Ref CloudWatchMetricGraph, 'true']
  CodePipelineApprovalEnabled: !Equals [!Ref CodePipelineApproval, 'true']
Resources:
  ##########################################################################
  #                                                                        #
  #                                  API                                   #
  #                                                                        #
  ##########################################################################
  ApiConnection:
    Type: 'AWS::Events::Connection'
    Properties:
      AuthorizationType: 'API_KEY'
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: 'X-API-Key'
          ApiKeyValue: !Ref EndpointId
      Description: 'marbot'
  ApiDestination:
    Type: 'AWS::Events::ApiDestination'
    Properties:
      ConnectionArn: !GetAtt 'ApiConnection.Arn'
      Description: 'Forwards notifiations and alarms to marbot'
      HttpMethod: 'POST'
      InvocationEndpoint: !Sub 'https://api.marbot.io/${Stage}/endpoint/${EndpointId}'
      InvocationRateLimitPerSecond: 1
  ApiRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: 'Allow'
          Principal:
            Service:
            - 'events.amazonaws.com'
          Action:
          - sts:AssumeRole
      Path: '/service-role/'
      Policies:
      - PolicyName: eventbridge
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: 'Allow'
            Action: 'events:InvokeApiDestination'
            Resource: !GetAtt 'ApiDestination.Arn'
  MonitoringJumpStartEvent:
    Type: 'AWS::Events::Rule'
    Properties:
      Description: 'Monitoring Jump Start connection. (created by marbot)'
      ScheduleExpression: 'rate(30 days)'
      State: ENABLED
      Targets:
      - Arn: !GetAtt 'ApiDestination.Arn'
        Id: marbot
        RoleArn: !GetAtt 'ApiRole.Arn'
        Input: !Sub |
          {
            "Type": "monitoring-jump-start-connection",
            "StackTemplate": "marbot-aws-account-connection",
            "StackVersion": "1.3.1",
            "Partition": "${AWS::Partition}",
            "AccountId": "${AWS::AccountId}",
            "Region": "${AWS::Region}",
            "StackId": "${AWS::StackId}",
            "StackName": "${AWS::StackName}"
          }
  ##########################################################################
  #                                                                        #
  #                         AWS ACCOUNT CONNECTION                         #
  #                                                                        #
  ##########################################################################
  PermissionsBoundaryPolicy:
    Condition: MonitoringAssistantEnabled
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - 'cloudwatch:describeAlarms'
          - 'securityhub:BatchUpdateFindings'
          Resource: '*'
        - Effect: Allow
          Action: 'sns:Publish'
          Resource: !Sub 'arn:${AWS::Partition}:sns:*:${AWS::AccountId}:marbot*'
        - Effect: Allow
          Action:
          - 'logs:CreateLogStream'
          - 'logs:PutLogEvents'
          Resource: !Sub 'arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/marbot*'
  Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS: '853553028582'
          Action: 'sts:AssumeRole'
          Condition:
            StringEquals:
              'sts:ExternalId': !Select [2, !Split ['/', !Ref 'AWS::StackId']]
      Policies:
      - !If
        - MonitoringAssistantEnabled
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - 'elasticloadbalancing:DescribeLoadBalancers'
              - 'elasticloadbalancing:DescribeTargetGroups'
              - 'elasticloadbalancing:DescribeTags'
              - 'elasticloadbalancing:DescribeLoadBalancerAttributes'
              - 'elasticloadbalancing:DescribeTargetGroupAttributes'
              - 'autoscaling:DescribeAutoScalingGroups'
              - 'ec2:DescribeInstances'
              - 'rds:DescribeDBClusters'
              - 'rds:ListTagsForResource'
              - 'sqs:ListQueues'
              - 'sqs:GetQueueUrl'
              - 'sqs:ListQueueTags'
              - 'sqs:GetQueueAttributes'
              - 'ec2:DescribeAccountAttributes'
              - 'ec2:DescribeInstanceAttribute'
              - 'ec2:DescribeInstanceCreditSpecifications'
              - 'ec2:DescribeInstanceTypes'
              - 'ec2:DescribeVolumes'
              - 'ec2:DescribeVpcs'
              - 'sts:GetCallerIdentity'
              - 'logs:DescribeLogGroups'
              - 'sns:GetSubscriptionAttributes' # no resource-level restrictions supported
              - 'sns:SetSubscriptionAttributes' # no resource-level restrictions supported
              - 'sns:Unsubscribe' # no resource-level restrictions supported
              Resource: '*'
            - Effect: Allow
              Action:
              - 'budgets:ModifyBudget'
              - 'budgets:ViewBudget'
              Resource: !Sub 'arn:${AWS::Partition}:budgets::${AWS::AccountId}:budget/marbot*'
            - Effect: Allow
              Action:
              - 'cloudwatch:DeleteAlarms'
              - 'cloudwatch:DescribeAlarms'
              - 'cloudwatch:ListTagsForResource'
              - 'cloudwatch:PutMetricAlarm'
              - 'cloudwatch:TagResource'
              - 'cloudwatch:UntagResource'
              Resource: !Sub 'arn:${AWS::Partition}:cloudwatch:*:${AWS::AccountId}:alarm:marbot*'
            - Effect: Allow
              Action:
              - 'events:DeleteRule'
              - 'events:DescribeRule'
              - 'events:ListTagsForResource'
              - 'events:ListTargetsByRule'
              - 'events:PutRule'
              - 'events:PutTargets'
              - 'events:RemoveTargets'
              - 'events:TagResource'
              - 'events:UntagResource'
              Resource: !Sub 'arn:${AWS::Partition}:events:*:${AWS::AccountId}:rule/marbot*'
            - Effect: Allow
              Action:
              - 'sns:CreateTopic'
              - 'sns:DeleteTopic'
              - 'sns:GetTopicAttributes'
              - 'sns:ListTagsForResource'
              - 'sns:SetTopicAttributes'
              - 'sns:Subscribe'
              - 'sns:TagResource'
              - 'sns:UntagResource'
              Resource: !Sub 'arn:${AWS::Partition}:sns:*:${AWS::AccountId}:marbot*'
            - Effect: Allow
              Action:
              - 'rds:CreateEventSubscription'
              - 'rds:DeleteEventSubscription'
              - 'rds:AddSourceIdentifierToSubscription'
              - 'rds:RemoveSourceIdentifierFromSubscription'
              - 'rds:DescribeEventSubscriptions'
              - 'rds:ListTagsForResource'
              - 'rds:ModifyEventSubscription'
              - 'rds:AddTagsToResource'
              - 'rds:RemoveTagsFromResource'
              Resource: !Sub 'arn:${AWS::Partition}:rds:*:${AWS::AccountId}:es:marbot*'
            - Effect: Allow
              Action:
              - 'logs:CreateLogGroup'
              - 'logs:DeleteLogGroup'
              - 'logs:DeleteRetentionPolicy'
              - 'logs:ListTagsLogGroup'
              - 'logs:PutRetentionPolicy'
              - 'logs:TagLogGroup'
              - 'logs:TagResource'
              - 'logs:UntagLogGroup'
              - 'logs:UntagResource'
              Resource: !Sub 'arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/marbot*'
            - Effect: Allow
              Action:
              - 'lambda:AddPermission'
              - 'lambda:CreateFunction'
              - 'lambda:UpdateFunctionConfiguration'
              - 'lambda:UpdateFunctionCode'
              - 'lambda:DeleteFunction'
              - 'lambda:GetFunction'
              - 'lambda:GetFunctionCodeSigningConfig'
              - 'lambda:GetPolicy'
              - 'lambda:ListVersionsByFunction'
              - 'lambda:RemovePermission'
              - 'lambda:ListTags'
              - 'lambda:TagResource'
              - 'lambda:UntagResource'
              Resource: !Sub 'arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:marbot*'
            - Effect: Allow
              Action:
              - 'iam:CreateRole'
              - 'iam:DeleteRolePolicy'
              - 'iam:PutRolePolicy'
              - 'iam:PutRolePermissionsBoundary'
              Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/marbot*'
              Condition:
                StringEquals:
                  'iam:PermissionsBoundary': !Ref PermissionsBoundaryPolicy
            - Effect: Allow
              Action: 'iam:PassRole'
              Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/marbot*'
              Condition:
                StringEquals:
                  'iam:PassedToService': 'lambda.amazonaws.com'
            - Effect: Allow
              Action:
              - 'iam:DeleteRole'
              - 'iam:GetRole'
              - 'iam:GetRolePolicy'
              - 'iam:ListAttachedRolePolicies'
              - 'iam:ListInstanceProfilesForRole'
              - 'iam:ListRolePolicies'
              - 'iam:UpdateRoleDescription'
              - 'iam:ListRoleTags'
              - 'iam:TagRole'
              - 'iam:UntagRole'
              Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/marbot*'
          PolicyName: MonitoringAssistantPolicy
        - !Ref 'AWS::NoValue'
      - !If
        - AccountAliasEnabled
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action: 'iam:ListAccountAliases'
              Resource: '*'
          PolicyName: AccountAliasPolicy
        - !Ref 'AWS::NoValue'
      - !If
        - CloudWatchMetricGraphEnabled
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action: 'cloudwatch:GetMetricWidgetImage'
              Resource: '*'
          PolicyName: CloudWatchMetricGraphPolicy
        - !Ref 'AWS::NoValue'
      - !If
        - CodePipelineApprovalEnabled
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action: 'codepipeline:PutApprovalResult'
              Resource: '*'
          PolicyName: CodePipelineApprovalPolicy
        - !Ref 'AWS::NoValue'
  Connection:
    Type: 'Custom::Connection'
    Version: '1.0'
    Properties:
      ServiceToken: !Sub 'arn:${AWS::Partition}:sns:${AWS::Region}:853553028582:marbot-${Stage}-aws-account-connection'
      AwsPartition: !Ref 'AWS::Partition'
      AwsAccountId: !Ref 'AWS::AccountId'
      AwsRoleName: !Ref Role
      AwsRoleExternalId: !Select [2, !Split ['/', !Ref 'AWS::StackId']]
      AwsPermissionsBoundaryPolicyArn: !If [MonitoringAssistantEnabled, !Ref PermissionsBoundaryPolicy, '']
      MarbotEndpointId: !Ref EndpointId
      MarbotFeatureMonitoringAssistant: !Ref MonitoringAssistant
      MarbotFeatureAccountAlias: !Ref AccountAlias
      MarbotFeatureCloudWatchMetricGraph: !Ref CloudWatchMetricGraph
      MarbotFeatureCodePipelineApproval: !Ref CodePipelineApproval
      CloudFormationStackVersion: '1.3.1'
      CloudFormationStackRegion: !Ref 'AWS::Region'
      CloudFormationStackId: !Ref 'AWS::StackId'
      CloudFormationStackName: !Ref 'AWS::StackName'
Outputs:
  StackName:
    Description: 'Stack name.'
    Value: !Sub '${AWS::StackName}'
  StackTemplate:
    Description: 'Stack template.'
    Value: 'marbot-aws-account-connection'
  StackVersion:
    Description: 'Stack version.'
    Value: '1.3.1'