forked from widdix/aws-cf-templates
-
Notifications
You must be signed in to change notification settings - Fork 0
/
cloudtrail.yaml
128 lines (128 loc) · 4.06 KB
/
cloudtrail.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Security: CloudTrail across all regions, a cloudonaut.io template'
Metadata:
'AWS::CloudFormation::Interface':
ParameterGroups:
- Label:
default: 'CloudTrail Parameters'
Parameters:
- CloudWatchLogsRetentionInDays
- ExternalTrailBucket
Parameters:
CloudWatchLogsRetentionInDays:
Description: 'The number of days log events are kept in CloudWatch Logs'
Type: Number
Default: 14
AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
ExternalTrailBucket:
Description: 'Optional The name of the Amazon S3 bucket where CloudTrail publishes log files. If you leave this empty, the Amazon S3 bucket is created for you.'
Type: String
Conditions:
InternalBucket: !Equals [!Ref ExternalTrailBucket, '']
ExternalBucket: !Not [!Equals [!Ref ExternalTrailBucket, '']]
Resources:
TrailBucket:
Condition: InternalBucket
DeletionPolicy: Retain
Type: 'AWS::S3::Bucket'
Properties: {}
TrailBucketPolicy:
Condition: InternalBucket
Type: 'AWS::S3::BucketPolicy'
Properties:
Bucket: !Ref TrailBucket
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: AWSCloudTrailAclCheck
Effect: Allow
Principal:
Service: 'cloudtrail.amazonaws.com'
Action: 's3:GetBucketAcl'
Resource: !Sub 'arn:aws:s3:::${TrailBucket}'
- Sid: AWSCloudTrailWrite
Effect: Allow
Principal:
Service: 'cloudtrail.amazonaws.com'
Action: 's3:PutObject'
Resource: !Sub 'arn:aws:s3:::${TrailBucket}/AWSLogs/${AWS::AccountId}/*'
Condition:
StringEquals:
's3:x-amz-acl': 'bucket-owner-full-control'
TrailLogGroup:
Type: 'AWS::Logs::LogGroup'
Properties:
RetentionInDays: !Ref CloudWatchLogsRetentionInDays
TrailLogGroupRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: AssumeRole1
Effect: Allow
Principal:
Service: 'cloudtrail.amazonaws.com'
Action: 'sts:AssumeRole'
Policies:
- PolicyName: 'cloudtrail-policy'
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: AWSCloudTrailCreateLogStream2014110
Effect: Allow
Action: 'logs:CreateLogStream'
Resource: !GetAtt 'TrailLogGroup.Arn'
- Sid: AWSCloudTrailPutLogEvents20141101
Effect: Allow
Action: 'logs:PutLogEvents'
Resource: !GetAtt 'TrailLogGroup.Arn'
TrailTopic:
Type: 'AWS::SNS::Topic'
Properties: {}
TrailTopicPolicy:
Type: 'AWS::SNS::TopicPolicy'
Properties:
PolicyDocument:
Version: '2008-10-17'
Statement:
- Sid: AWSCloudTrailSNSPolicy
Effect: Allow
Principal:
Service: 'cloudtrail.amazonaws.com'
Resource: !Ref TrailTopic
Action: 'sns:Publish'
Topics:
- !Ref TrailTopic
Trail:
Condition: InternalBucket
DependsOn:
- TrailBucketPolicy
- TrailTopicPolicy
Type: 'AWS::CloudTrail::Trail'
Properties:
IncludeGlobalServiceEvents: true
IsLogging: true
IsMultiRegionTrail: true
S3BucketName: !Ref TrailBucket
CloudWatchLogsLogGroupArn: !GetAtt 'TrailLogGroup.Arn'
CloudWatchLogsRoleArn: !GetAtt 'TrailLogGroupRole.Arn'
SnsTopicName: !GetAtt 'TrailTopic.TopicName'
ExternalTrail:
Condition: ExternalBucket
DependsOn:
- TrailTopicPolicy
Type: 'AWS::CloudTrail::Trail'
Properties:
IncludeGlobalServiceEvents: true
IsLogging: true
IsMultiRegionTrail: true
S3BucketName: !Ref ExternalTrailBucket
CloudWatchLogsLogGroupArn: !GetAtt 'TrailLogGroup.Arn'
CloudWatchLogsRoleArn: !GetAtt 'TrailLogGroupRole.Arn'
SnsTopicName: !GetAtt 'TrailTopic.TopicName'
Outputs:
TemplateID:
Description: 'cloudonaut.io template id'
Value: 'security/cloudtrail'