template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Fugue API Events
Transform: AWS::Serverless-2016-10-31

Parameters:
  LogRetentionInDays:
    Default: "30"
    Description: Number of days to retain log messages
    Type: String
  SplunkUrl:
    Description: Splunk url to publish to
    Type: String

Resources:

  Topic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: fugue-events
      TopicName: fugue-events

  TopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref Topic
      PolicyDocument:
        Version: "2012-10-17"
        Id: "fugue_topic_policy"
        Statement: 
          - Sid: "cross_account_allow"
            Effect: "Allow"
            Principal:
              AWS: arn:aws:iam::370134896156:role/fugue-sns-publish
            Action: "sns:Publish"
            Resource: !Ref Topic
          - Sid: "cross_account_deny"
            Effect: "Deny"
            Principal:
              AWS: arn:aws:iam::370134896156:role/fugue-sns-publish
            NotAction: "sns:Publish"
            Resource: !Ref Topic
          - Sid: "default_allow"
            Effect: "Allow"
            Principal: 
              AWS: "*"
            Action:
              - "sns:GetTopicAttributes"
              - "sns:SetTopicAttributes"
              - "sns:AddPermission"
              - "sns:RemovePermission"
              - "sns:DeleteTopic"
              - "sns:Subscribe"
              - "sns:ListSubscriptionsByTopic"
              - "sns:Publish"
            Resource: !Ref Topic
            Condition:
              StringEquals:
                "AWS:SourceOwner": !Ref AWS::AccountId

  EventHandler:
    Type: AWS::Serverless::Function
    Properties:
      Description: Lambda function that processes notifications from Fugue
      Runtime: nodejs12.x
      Handler: src/index.handler
      Role: !GetAtt LambdaRole.Arn
      Events:
        SNSTopicEvent:
          Type: SNS
          Properties:
            Topic: !Ref Topic
      Environment:
        Variables:
          SECRET_ARN: !Ref ApiCredentials
          SPLUNK_URL: !Ref SplunkUrl
      MemorySize: 1024
      Timeout: 60
      Policies:
        - AWSLambdaBasicExecutionRole

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      - "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
      Policies:
      - PolicyName: get-secret
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Sid: AllowGetSecretValue
            Effect: Allow
            Action:
            - "secretsmanager:GetSecretValue"
            Resource: !Ref ApiCredentials

  ApiCredentials:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: Secret to contain a client ID and secret for the Fugue API

  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${EventHandler}"
      RetentionInDays: !Ref LogRetentionInDays

  LogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Ref LogGroup
      LogStreamName: "default"

Outputs:
  Function:
    Description: "Lambda Function"
    Value: !Ref EventHandler
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", Function ] ]

  Topic:
    Description: "SNS Topic"
    Value: !Ref Topic
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", Topic ] ]

  Secret:
    Description: "Fugue API Credentials Secret"
    Value: !Ref ApiCredentials
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", Secret ] ]