template.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: A collection of utilities that integrate with CloudTrail

Resources:
  # This is an _organization sink_ custom EventBridge event bus. It's intended
  # to exist once within an AWS Organization (i.e., in a single region in a
  # single account).
  #
  # Relevant CloudTrail activity within the organization is expected to be sent
  # to this event bus. Generally this is done by creating rules on all default
  # event buses within the organization, which forward CloudTrail events from
  # all accounts and regions to this bus.
  #
  # Any tooling that responds to CloudTrail activity can subscribe to
  # the relevant events on this bus.
  #
  # This bus should always be called `CloudTrail-org-sink`, as that is what
  # the rules on all default buses expect.
  OrgSinkEventBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: CloudTrail-org-sink
  OrgSinkEventBusPolicy:
    # TODO Should have a Condition to limit this to events sent by events.amazonaws.com
    # since it's only intended to get events from other event buses, not from
    # any arbitrary sender
    Type: AWS::Events::EventBusPolicy
    Properties:
      EventBusName: !Ref OrgSinkEventBus
      StatementId: AllowEventsToCloudTrailOrgSink
      Statement:
        Action: events:PutEvents
        Condition:
          StringEquals:
            aws:ResourceOrgID: ${aws:PrincipalOrgID}
        Effect: Allow
        Principal: "*"
        Resource: !GetAtt OrgSinkEventBus.Arn

  # Sends notifications to Slack when activity is found in CloudTrail coming
  # from root AWS accounts.
  RootActivityMonitorFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/root-activity-monitor
      Description: >-
        Sends messages to Slack in response to root account activity found in
        CloudTrail
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
      Events:
        RootActivityEvent:
          Properties:
            EventBusName: !Ref OrgSinkEventBus
            Pattern:
              detail:
                userIdentity:
                  type:
                    - Root
              detail-type:
                - AWS API Call via CloudTrail
                - AWS Console Sign In via CloudTrail
          Type: EventBridgeRule
      Handler: index.handler
      MemorySize: 192
      Policies:
        - Statement:
            - Action: events:PutEvents
              Effect: Allow
              Resource: !Sub arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/default
          Version: "2012-10-17"
      Runtime: nodejs22.x
      Tags:
        prx:meta:tagging-version: "2021-04-07"
        prx:cloudformation:stack-name: !Ref AWS::StackName
        prx:cloudformation:stack-id: !Ref AWS::StackId
        prx:ops:environment: Production
        prx:dev:application: CloudTrail Toolkit
      Timeout: 20
  RootActivityMonitorLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${RootActivityMonitorFunction}
      RetentionInDays: 90
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:ops:environment, Value: Production }
        - { Key: prx:dev:application, Value: CloudTrail Toolkit }
  RootActivityMonitorErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub FATAL [CloudTrail] Root Activity Monitor <prod> FUNCTION ERRORS (${AWS::StackName})
      AlarmDescription: >-
        The Lambda function that relays CloudTrail root account activity to
        Slack is experiencing errors, which means there could be security
        events that need to be investigated.
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: FunctionName
          Value: !Ref RootActivityMonitorFunction
      EvaluationPeriods: 1
      MetricName: Errors
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:ops:environment, Value: Production }
        - { Key: prx:dev:application, Value: CloudTrail Toolkit }
      Threshold: 0
      TreatMissingData: notBreaching