cloudtrail.yml

AWSTemplateFormatVersion: '2010-09-09-OC'

# Include file that contains Organization Section.
# The Organization Section describes Accounts, Organizational Units, etc.
Organization: !Include ../organization.yml

# Any Binding that does not explicitly specify a region will default to this.
# Value can be either string or list
DefaultOrganizationBindingRegion: eu-central-1

# Section that contains a named list of Bindings.
# Bindings determine what resources are deployed where
# These bindings can be !Ref'd from the Resources in the resource section
OrganizationBindings:

  # Binding for: S3Bucket, S3BucketPolicy
  CloudTrailBucketBinding:
    Account: !Ref SharedComplianceAccount

  # Binding for: CloudTrail, CloudTrailLogGroup, CloudTrailLogGroupRole
  CloudTrailBinding:
    Account: '*'
    IncludeMasterAccount: true

Parameters:
  resourcePrefix:
    Type: String
    Default: my

  logDeletionDays:
    Type: Number
    Default: 365

Resources:

  CloudTrailS3Bucket:
    OrganizationBinding: !Ref CloudTrailBucketBinding
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Sub '${resourcePrefix}-cloudtrail-${SharedComplianceAccount}'
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: !Ref logDeletionDays
            Id: !Sub '${resourcePrefix}-cloudtrail-bucket-lifecycle-configuration'
            Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True

  CloudTrailS3BucketPolicy:
    OrganizationBinding: !Ref CloudTrailBucketBinding
    Type: AWS::S3::BucketPolicy
    DependsOn: CloudTrailS3Bucket
    Properties:
      Bucket: !Ref CloudTrailS3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: 'AWSCloudTrailAclCheck'
            Effect: 'Allow'
            Principal: { Service: 'cloudtrail.amazonaws.com' }
            Action: 's3:GetBucketAcl'
            Resource: !Sub 'arn:aws:s3:::${CloudTrailS3Bucket}'
          - Sid: 'AWSCloudTrailWrite'
            Effect: 'Allow'
            Principal: { Service: 'cloudtrail.amazonaws.com' }
            Action: 's3:PutObject'
            Resource: !Sub 'arn:aws:s3:::${CloudTrailS3Bucket}/AWSLogs/*/*'
            Condition:
              StringEquals:
                s3:x-amz-acl: 'bucket-owner-full-control'
          - Sid: 'AWSCloudTrailForceHttps'
            Effect: Deny
            Principal: "*"
            Action: "*"
            Resource: !Sub 'arn:aws:s3:::${CloudTrailS3Bucket}/*'
            Condition:
              Bool:
                aws:SecureTransport: False

  CloudTrailLogGroup:
    OrganizationBinding: !Ref CloudTrailBinding
    Type: 'AWS::Logs::LogGroup'
    Properties:
      RetentionInDays: 14
      LogGroupName: CloudTrail/audit-log

  CloudTrailLogGroupRole:
    OrganizationBinding: !Ref CloudTrailBinding
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub ${resourcePrefix}-AWSCloudTrailLogGroupRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: AssumeRole1
          Effect: Allow
          Principal:
            Service: 'cloudtrail.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: 'cloudtrail-policy'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: AWSCloudTrailCreateLogStream
            Effect: Allow
            Action:
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
            Resource: !GetAtt 'CloudTrailLogGroup.Arn'

  CloudTrail:
    OrganizationBinding: !Ref CloudTrailBinding
    Type: AWS::CloudTrail::Trail
    DependsOn:
      - CloudTrailS3BucketPolicy
      - CloudTrailLogGroup
      - CloudTrailLogGroupRole
    Properties:
      CloudWatchLogsLogGroupArn: !GetAtt 'CloudTrailLogGroup.Arn'
      CloudWatchLogsRoleArn: !GetAtt 'CloudTrailLogGroupRole.Arn'
      EnableLogFileValidation: true
      IncludeGlobalServiceEvents: true
      IsLogging: true
      IsMultiRegionTrail: true
      S3BucketName: !Ref CloudTrailS3Bucket
      TrailName: !Sub '${resourcePrefix}-trail'