template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS CloudFormation Template to update config recorder settings in child accounts created by ControlTower.'
Parameters:

  ConfigOptOutExcludedAccounts:
    Description: Excluded Accounts list. This list should contain Management account, Log Archive and Audit accounts at the minimum
    Default: "['111111111111', '222222222222', '333333333333']"
    MaxLength: '2000'
    MinLength: '36'
    Type: String

  ConfigOptOutRecorderResourceTypes:
    Description: List of all resource types to be excluded from Config Recorder
    Default: "AWS::HealthLake::FHIRDatastore,AWS::Pinpoint::Segment,AWS::Pinpoint::ApplicationSettings"
    Type: String

  CloudFormationVersion:
    Type: String
    Default: 2

Resources:
    LambdaZipsBucket:
      Type: AWS::S3::Bucket
      Properties:
          BucketEncryption:
            ServerSideEncryptionConfiguration:
              - ServerSideEncryptionByDefault:
                  SSEAlgorithm: AES256

    ProducerLambda:
        Type: AWS::Lambda::Function
        # DeletionPolicy: Retain
        # DependsOn: CopyZips
        Properties:
            #FunctionName: ct_configrecorder_override_producer_cf
            Code:
                S3Bucket: !Sub 'config-custom-${AWS::AccountId}'
                S3Key: ct_configrecorder_override_producer.zip
            Handler: ct_configrecorder_override_producer.lambda_handler
            Role: !GetAtt ProducerLambdaExecutionRole.Arn
            Runtime: python3.10
            MemorySize: 128
            Timeout: 300
            Architectures:
                - x86_64
            ReservedConcurrentExecutions: 1
            Environment:
                Variables:
                    EXCLUDED_ACCOUNTS: !Ref ConfigOptOutExcludedAccounts
                    LOG_LEVEL: INFO
                    SQS_URL: !Ref SQSConfigRecorder

    ProducerLambdaPermissions:                
      Type: AWS::Lambda::Permission
      # DeletionPolicy: Retain
      Properties: 
        Action: 'lambda:InvokeFunction'
        FunctionName: !Ref ProducerLambda
        Principal: 'events.amazonaws.com'
        SourceArn: !GetAtt ProducerEventTrigger.Arn             
      
    ConsumerLambda:
        Type: AWS::Lambda::Function
        # DeletionPolicy: Retain
        # DependsOn: CopyZips
        Properties:
            #FunctionName: ct_configrecorder_override_consumer_cf
            Code:
                S3Bucket: !Sub 'config-custom-${AWS::AccountId}'
                S3Key: ct_configrecorder_override_consumer.zip
            Handler: ct_configrecorder_override_consumer.lambda_handler
            Role: !GetAtt ConsumerLambdaExecutionRole.Arn
            Runtime: python3.10
            MemorySize: 128
            Timeout: 180
            Architectures:
                - x86_64
            ReservedConcurrentExecutions: 10
            Environment:
                Variables:
                    LOG_LEVEL: INFO
                    CONFIG_RECORDER_EXCLUDED_RESOURCE_LIST: !Ref ConfigOptOutRecorderResourceTypes

    ConsumerLambdaEventSourceMapping:
        Type: AWS::Lambda::EventSourceMapping
        # DeletionPolicy: Retain
        Properties:
          BatchSize: 1
          Enabled: true
          EventSourceArn: !GetAtt SQSConfigRecorder.Arn
          FunctionName: !GetAtt ConsumerLambda.Arn                
    
    ProducerLambdaExecutionRole:
        Type: 'AWS::IAM::Role'
        # DeletionPolicy: Retain
        Properties:
          ManagedPolicyArns:
            - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - lambda.amazonaws.com
                Action:
                  - 'sts:AssumeRole'
          Path: /         
          Policies:
            - PolicyName: ct_cro_producer
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action:
                      - cloudformation:ListStackInstances
                    Resource: !Sub 'arn:${AWS::Partition}:cloudformation:*:*:stackset/AWSControlTowerBP-BASELINE-CONFIG:*'
                  - Effect: Allow
                    Action:
                      - sqs:DeleteMessage
                      - sqs:ReceiveMessage
                      - sqs:SendMessage
                      - sqs:GetQueueAttributes
                    Resource: !GetAtt SQSConfigRecorder.Arn  
                    
    ConsumerLambdaExecutionRole:
        Type: 'AWS::IAM::Role'
        # DeletionPolicy: Retain
        Properties:
          ManagedPolicyArns:
            - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - lambda.amazonaws.com
                Action:
                  - 'sts:AssumeRole'
          Path: /         
          Policies:
            - PolicyName: policy-sts-all
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action:
                      - sts:AssumeRole
                    Resource: "*"
                  - Effect: Allow
                    Action:
                      - sqs:DeleteMessage
                      - sqs:ReceiveMessage
                      - sqs:SendMessage
                      - sqs:GetQueueAttributes
                    Resource: !GetAtt SQSConfigRecorder.Arn   

    SQSConfigRecorder:
        Type: AWS::SQS::Queue
        # DeletionPolicy: Retain
        Properties:
            QueueName: ct_configrecorder_override_cf
            VisibilityTimeout: 180
            DelaySeconds: 5
            KmsMasterKeyId: alias/aws/sqs

    ProducerEventTrigger:
        Type: AWS::Events::Rule
        Properties: 
          Description: "Rule to trigger config recorder override producer lambda"
          EventBusName: default
          EventPattern: '{
                          "source": ["aws.controltower"],
                          "detail-type": ["AWS Service Event via CloudTrail"],
                          "detail": {
                            "eventName": ["UpdateLandingZone", "CreateManagedAccount", "UpdateManagedAccount"]
                          }
                        }'
          Name: !GetAtt SQSConfigRecorder.QueueName #ct_configrecorder_override_cf
          State: ENABLED
          Targets: 
            - 
                Arn: 
                  Fn::GetAtt: 
                    - "ProducerLambda"
                    - "Arn"
                Id: "ProducerTarget"

    ProducerLambdaTrigger:
      Type: 'Custom::ExecuteLambda'
      Properties:
        ServiceToken: !GetAtt "ProducerLambda.Arn"
        FunctionName: !Ref ProducerLambda
        Version: !Ref CloudFormationVersion