template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation Template to update config recorder settings in child accounts created by ControlTower."
Parameters:
  CloudFormationVersion:
    Description: Update Version every time stack is updated to force rerun of the solution.
    Type: String
    Default: 1

  AccountSelectionMode:
    Description: Account selection mode - EXCLUSION (processes all accounts except those in ExcludedAccounts) or INCLUSION (processes only accounts in IncludedAccounts). Default is EXCLUSION for backward compatibility.
    Type: String
    Default: EXCLUSION
    AllowedValues:
      - EXCLUSION
      - INCLUSION

  ExcludedAccounts:
    Description: Excluded Accounts list. This list should contain Management account, Log Archive and Audit accounts at the minimum and other accounts you want to be excluded. Only used when AccountSelectionMode is EXCLUSION.
    Type: String
    Default: "['111111111111', '222222222222', '333333333333']"
    MinLength: 36
    MaxLength: 4096

  IncludedAccounts:
    Description: List of AWS account IDs to include when AccountSelectionMode is INCLUSION. Only used when AccountSelectionMode is INCLUSION.
    Type: String
    Default: "['111111111111', '222222222222', '333333333333']"
    MinLength: 2
    MaxLength: 4096

  ConfigRecorderStrategy:
    Default: EXCLUSION
    Description: Config Recorder Strategy
    Type: String
    AllowedValues:
      - EXCLUSION
      - INCLUSION

  ConfigRecorderExcludedResourceTypes:
    Description: List of all resource types to be excluded from Config Recorder if you pick EXCLUSION strategy
    Default: "AWS::HealthLake::FHIRDatastore,AWS::Pinpoint::Segment,AWS::Pinpoint::ApplicationSettings"
    Type: String

  ConfigRecorderIncludedResourceTypes:
    Description: List of all resource types to be included in Config Recorder if you pick INCLUSION strategy
    Default: "AWS::S3::Bucket,AWS::CloudTrail::Trail"
    Type: String

  ConfigRecorderDailyResourceTypes:
    Description: List of all resource types to be set to a daily cadence
    Default: "AWS::AutoScaling::AutoScalingGroup,AWS::AutoScaling::LaunchConfiguration"
    Type: String

  ConfigRecorderDailyGlobalResourceTypes:
    Description: List of Global resource types to be set to a daily cadence in the AWS Control Tower home region. Append to this list as needed.
    Default: "AWS::IAM::Policy,AWS::IAM::User,AWS::IAM::Role,AWS::IAM::Group"
    Type: String

  ConfigRecorderDefaultRecordingFrequency:
    Description: Default Frequency of recording configuration changes.
    Default: CONTINUOUS
    Type: String
    AllowedValues:
      - CONTINUOUS
      - DAILY

  SourceS3Bucket:
    Type: String
    Default: marketplace-sa-resources
    Description: S3 bucket containing the Lambda deployment packages, leave it default unless you have customized code.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Mandatory Settings"
        Parameters:
          - CloudFormationVersion
          - SourceS3Bucket
      - Label:
          default: "Account Selection Settings"
        Parameters:
          - AccountSelectionMode
          - ExcludedAccounts
          - IncludedAccounts
      - Label:
          default: "Recording Strategy Settings"
        Parameters:
          - ConfigRecorderStrategy
          - ConfigRecorderExcludedResourceTypes
          - ConfigRecorderIncludedResourceTypes
      - Label:
          default: " Recording Frequency Settings"
        Parameters:
          - ConfigRecorderDefaultRecordingFrequency
          - ConfigRecorderDailyResourceTypes
          - ConfigRecorderDailyGlobalResourceTypes

Resources:
  LambdaZipsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  LambdaZipsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: LambdaZipsBucket
      PolicyDocument:
        Statement:
          - Effect: Deny
            Action: "s3:*"
            Principal: "*"
            Resource:
              - !Sub "arn:aws:s3:::${LambdaZipsBucket}"
              - !Sub "arn:aws:s3:::${LambdaZipsBucket}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  ProducerLambda:
    Type: AWS::Lambda::Function
    DeletionPolicy: Retain
    DependsOn: CopyZips
    Properties:
      Code:
        S3Bucket: !Ref LambdaZipsBucket
        S3Key: ct-blogs-content/ct_configrecorder_override_producer.zip
      Handler: ct_configrecorder_override_producer.lambda_handler
      Role: !GetAtt ProducerLambdaExecutionRole.Arn
      Runtime: python3.12
      MemorySize: 128
      Timeout: 300
      Architectures:
        - x86_64
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          ACCOUNT_SELECTION_MODE: !Ref AccountSelectionMode
          EXCLUDED_ACCOUNTS: !Ref ExcludedAccounts
          INCLUDED_ACCOUNTS: !Ref IncludedAccounts
          LOG_LEVEL: INFO
          SQS_URL: !Ref SQSConfigRecorder

  ProducerLambdaPermissions:
    Type: AWS::Lambda::Permission
    DeletionPolicy: Retain
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName: !Ref ProducerLambda
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt ProducerEventTrigger.Arn

  ConsumerLambda:
    Type: AWS::Lambda::Function
    DeletionPolicy: Retain
    DependsOn: CopyZips
    Properties:
      Code:
        S3Bucket: !Ref LambdaZipsBucket
        S3Key: ct-blogs-content/ct_configrecorder_override_consumer.zip
      Handler: ct_configrecorder_override_consumer.lambda_handler
      Role: !GetAtt ConsumerLambdaExecutionRole.Arn
      Runtime: python3.12
      MemorySize: 128
      Timeout: 180
      Architectures:
        - x86_64
      ReservedConcurrentExecutions: 10
      Environment:
        Variables:
          LOG_LEVEL: INFO
          CONFIG_RECORDER_STRATEGY: !Ref ConfigRecorderStrategy
          CONFIG_RECORDER_OVERRIDE_DAILY_RESOURCE_LIST: !Ref ConfigRecorderDailyResourceTypes
          CONFIG_RECORDER_OVERRIDE_DAILY_GLOBAL_RESOURCE_LIST: !Ref ConfigRecorderDailyGlobalResourceTypes
          CONFIG_RECORDER_OVERRIDE_EXCLUDED_RESOURCE_LIST: !Ref ConfigRecorderExcludedResourceTypes
          CONFIG_RECORDER_OVERRIDE_INCLUDED_RESOURCE_LIST: !Ref ConfigRecorderIncludedResourceTypes
          CONFIG_RECORDER_DEFAULT_RECORDING_FREQUENCY: !Ref ConfigRecorderDefaultRecordingFrequency
          CONTROL_TOWER_HOME_REGION: !Ref "AWS::Region"

  ConsumerLambdaEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    DeletionPolicy: Retain
    Properties:
      BatchSize: 1
      Enabled: true
      EventSourceArn: !GetAtt SQSConfigRecorder.Arn
      FunctionName: !GetAtt ConsumerLambda.Arn

  ProducerLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    DeletionPolicy: Retain
    Properties:
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      Policies:
        - PolicyName: ct_cro_producer
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:ListStackInstances
                Resource: !Sub "arn:${AWS::Partition}:cloudformation:*:*:stackset/AWSControlTowerBP-BASELINE-CONFIG:*"
              - Effect: Allow
                Action:
                  - sqs:DeleteMessage
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                  - sqs:GetQueueAttributes
                Resource: !GetAtt SQSConfigRecorder.Arn

  ConsumerLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    DeletionPolicy: Retain
    Properties:
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      Policies:
        - PolicyName: policy-sts-all
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: "*"
              - Effect: Allow
                Action:
                  - sqs:DeleteMessage
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                  - sqs:GetQueueAttributes
                Resource: !GetAtt SQSConfigRecorder.Arn

  SQSConfigRecorder:
    Type: AWS::SQS::Queue
    DeletionPolicy: Retain
    Properties:
      VisibilityTimeout: 180
      DelaySeconds: 5
      KmsMasterKeyId: alias/aws/sqs

  ProducerEventTrigger:
    Type: AWS::Events::Rule
    Properties:
      Description: "Rule to trigger config recorder override producer lambda"
      EventBusName: default
      EventPattern: '{
        "source": ["aws.controltower"],
        "detail-type": ["AWS Service Event via CloudTrail"],
        "detail": {
        "eventName": ["UpdateLandingZone", "CreateManagedAccount", "UpdateManagedAccount", "ResetLandingZone"]
        }
        }'
      Name: !GetAtt SQSConfigRecorder.QueueName
      State: ENABLED
      Targets:
        - Arn:
            Fn::GetAtt:
              - "ProducerLambda"
              - "Arn"
          Id: "ProducerTarget"

  ProducerLambdaTrigger:
    Type: "Custom::ExecuteLambda"
    Properties:
      ServiceToken: !GetAtt "ProducerLambda.Arn"
      FunctionName: !Ref ProducerLambda
      Version: !Ref CloudFormationVersion

  CopyZips:
    Type: Custom::CopyZips
    Properties:
      ServiceToken: !GetAtt "CopyZipsFunction.Arn"
      DestBucket: !Ref "LambdaZipsBucket"
      SourceBucket: !Ref SourceS3Bucket
      Prefix: ct-blogs-content/
      Objects:
        - "ct_configrecorder_override_producer.zip"
        - "ct_configrecorder_override_consumer.zip"

  CopyZipsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Path: /
      Policies:
        - PolicyName: lambda-copier
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectTagging
                Resource: !Sub "arn:${AWS::Partition}:s3:::${SourceS3Bucket}/ct-blogs-content/*"
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                  - s3:PutObjectTagging
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${LambdaZipsBucket}/ct-blogs-content/*"

  CopyZipsFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Copies objects from the S3 bucket to a new location.
      Handler: index.handler
      Runtime: python3.12
      Role: !GetAtt "CopyZipsRole.Arn"
      ReservedConcurrentExecutions: 1
      Timeout: 300
      Code:
        ZipFile: |
          import json
          import logging
          import threading
          import boto3
          import cfnresponse
          def copy_objects(source_bucket, dest_bucket, prefix, objects):
              s3 = boto3.client('s3')
              for o in objects:
                  key = prefix + o
                  copy_source = {
                      'Bucket': source_bucket,
                      'Key': key
                  }
                  print('copy_source: %s' % copy_source)
                  print('dest_bucket = %s'%dest_bucket)
                  print('key = %s' %key)
                  s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                        Key=key)
          def delete_objects(bucket, prefix, objects):
              s3 = boto3.client('s3')
              objects = {'Objects': [{'Key': prefix + o} for o in objects]}
              s3.delete_objects(Bucket=bucket, Delete=objects)
          def timeout(event, context):
              logging.error('Execution is about to time out, sending failure response to CloudFormation')
              cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)
          def handler(event, context):
              # make sure we send a failure to CloudFormation if the function
              # is going to timeout
              timer = threading.Timer((context.get_remaining_time_in_millis()
                        / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()
              print('Received event: %s' % json.dumps(event))
              status = cfnresponse.SUCCESS
              try:
                  source_bucket = event['ResourceProperties']['SourceBucket']
                  dest_bucket = event['ResourceProperties']['DestBucket']
                  prefix = event['ResourceProperties']['Prefix']
                  objects = event['ResourceProperties']['Objects']
                  if event['RequestType'] == 'Delete':
                      delete_objects(dest_bucket, prefix, objects)
                  else:
                      copy_objects(source_bucket, dest_bucket, prefix, objects)
              except Exception as e:
                  logging.error('Exception: %s' % e, exc_info=True)
                  status = cfnresponse.FAILED
              finally:
                  timer.cancel()
                  cfnresponse.send(event, context, status, {}, None)