code2/chapter07/template.yaml at master · AWSinAction/code2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
---
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Adding an owner tag to EC2 instances automatically
Parameters:
  CreateCloudTrail:
    Description: 'Create CloudTrail (set to false if CloudTrail is already enabled in your account).'
    Type: String
    Default: 'true'
    AllowedValues: ['true', 'false']
Conditions:
  HasCreateCloudTrail: !Equals [!Ref CreateCloudTrail, 'true']
Resources:
  TrailBucket:
    Condition: HasCreateCloudTrail
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub '${AWS::StackName}-${AWS::AccountId}'
  TrailBucketPolicy:
    Condition: HasCreateCloudTrail
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref TrailBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: AWSCloudTrailAclCheck
          Effect: Allow
          Principal:
            Service: 'cloudtrail.amazonaws.com'
          Action: 's3:GetBucketAcl'
          Resource: !Sub 'arn:aws:s3:::${TrailBucket}'
        - Sid: AWSCloudTrailWrite
          Effect: Allow
          Principal:
            Service: 'cloudtrail.amazonaws.com'
          Action: 's3:PutObject'
          Resource: !Sub 'arn:aws:s3:::${TrailBucket}/AWSLogs/${AWS::AccountId}/*'
          Condition:
            StringEquals:
              's3:x-amz-acl': 'bucket-owner-full-control'
  Trail:
    Condition: HasCreateCloudTrail
    DependsOn: TrailBucketPolicy
    Type: 'AWS::CloudTrail::Trail'
    Properties:
      IsLogging: true
      IsMultiRegionTrail: false
      S3BucketName: !Ref TrailBucket
  EC2OwnerTagFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.6
      CodeUri: '.'
      Policies:
      - Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: 'ec2:CreateTags'
          Resource: '*'
      Events:
        CloudTrail:
          Type: CloudWatchEvent
          Properties:
            Pattern:
              detail-type:
              - 'AWS API Call via CloudTrail'
              source:
              - 'aws.ec2'
              detail:
                eventName:
                - 'RunInstances'