serverless.yml

service: sls-aws-ct-processing

frameworkVersion: ">=1.5.0 < 2.0.0"

provider:
  name: aws
  runtime: python2.7
  stage: ${opt:stage, self:custom.defaultStage}
  profile: ${self:custom.profile}
  region: ${opt:region, self:custom.defaultRegion}
  cfLogs: true
  stackTags:
    DEPLOYMENT_TOOL: sls
    OWNER: ${self:custom.owner}
    DESCRIPTION: ${self:custom.description}

custom:
  owner: ${self:custom.environment.owner}
  description: ${self:custom.environment.description}
  defaultStage: dev
  defaultRegion: us-east-1
  environment: ${file(environment/${opt:stage}.yml)}
  profile: ${self:custom.environment.profile}

functions:
  cloudtrail-process:
    handler: cloudtrail.process
    name: ${self:service}-${self:provider.stage}
    description: This function parses through all CloudTrail logs as they are put into the primary S3 bucket, adds additional metadata, and pushes them into AWS Elasticsearch
    memorySize: 512
    timeout: 300
    role: CloudTrailProcessRole
    environment:
      ES_DOMAIN_NAME: "${self:service}-${self:provider.stage}"
    events:
      - sns:
          arn:
            Fn::Join:
              - ":"
              - - "arn:aws:sns"
                - Ref: "AWS::Region"
                - Ref: "AWS::AccountId"
                - "${self:service}-${self:provider.stage}-topic"
          topicName: ${self:service}-${self:provider.stage}-topic
resources:
  Resources:
    CloudTrailProcessRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /
        RoleName: ${self:service}-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: CloudTrailProcessPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: 
                    - Fn::Join:
                      - ":"
                      -
                        - "arn:aws:logs"
                        - Ref: "AWS::Region"
                        - Ref: "AWS::AccountId"
                        - "log-group:/aws/lambda/*:*:*"
                - Effect: Allow
                  Action:
                    - ec2:CreateNetworkInterface
                    - ec2:DescribeNetworkInterfaces
                    - ec2:DetachNetworkInterface
                    - ec2:DeleteNetworkInterface
                  Resource: "*"
                - Effect: "Allow"
                  Action:
                    - "es:ESHttpPost"
                    - "es:ESHttpGet"
                    - "es:ESHttpPut"
                    - "es:DescribeElasticsearchDomain"
                  Resource: 
                    - Fn::Join:
                      - ":"
                      - - "arn:aws:es"
                        - Ref: "AWS::Region"
                        - Ref: "AWS::AccountId"
                        - "domain/${self:service}-${self:provider.stage}"
                    - Fn::Join:
                      - ":"
                      - - "arn:aws:es"
                        - Ref: "AWS::Region"
                        - Ref: "AWS::AccountId"
                        - "domain/${self:service}-${self:provider.stage}/*"
                - Effect: "Allow"
                  Action:
                    - "s3:GetObject"
                  Resource: 
                    - "arn:aws:s3:::${self:custom.environment.newctbucket}/*"
    ElasticsearchDomain:
      DependsOn: 
        - CloudTrailTopic 
      Type: "AWS::Elasticsearch::Domain"
      Properties:
        DomainName: ${self:service}-${self:provider.stage}
        ElasticsearchClusterConfig: 
          DedicatedMasterEnabled: "true"
          InstanceCount: "2"
          ZoneAwarenessEnabled: "true"
          InstanceType: "m4.large.elasticsearch"
          DedicatedMasterType: "m4.large.elasticsearch"
          DedicatedMasterCount: "3"
        ElasticsearchVersion: "6.2"
        EncryptionAtRestOptions:
          Enabled: true
        EBSOptions: 
          EBSEnabled: true
          Iops: 0
          VolumeSize: 20
          VolumeType: "gp2"
        SnapshotOptions: 
          AutomatedSnapshotStartHour: "0"
        AccessPolicies: 
          Version: "2012-10-17"
          Statement: 
            - 
              Effect: "Allow"
              Principal: 
                AWS: "*"
              Action: "es:*"
              Resource: 
                - Fn::Join:
                      - ":"
                      - - "arn:aws:es"
                        - Ref: "AWS::Region"
                        - Ref: "AWS::AccountId"
                        - "domain/${self:service}-${self:provider.stage}/*"
              Condition:
                IpAddress:
                  aws:SourceIp: ${self:custom.environment.esipaddress}
        AdvancedOptions: 
          rest.action.multi.allow_explicit_index: "true"
    CloudTrailS3Bucket:
      Type: AWS::S3::Bucket
      DeletionPolicy: Retain
      Properties:
        BucketName: ${self:custom.environment.newctbucket}
    CloudTrailBucketPolicy: 
      DependsOn: 
        - CloudTrailS3Bucket
      Type: "AWS::S3::BucketPolicy"
      Properties: 
        Bucket: ${self:custom.environment.newctbucket}
        PolicyDocument: 
          Version: "2012-10-17"
          Statement: 
            - 
              Sid: "AWSCloudTrailAclCheck"
              Effect: "Allow"
              Principal: 
                Service: "cloudtrail.amazonaws.com"
              Action: "s3:GetBucketAcl"
              Resource: "arn:aws:s3:::${self:custom.environment.newctbucket}"
            - 
              Sid: "AWSCloudTrailWrite"
              Effect: "Allow"
              Principal: 
                Service: "cloudtrail.amazonaws.com"
              Action: "s3:PutObject"
              Resource: "arn:aws:s3:::${self:custom.environment.newctbucket}/AWSLogs/*"
              Condition: 
                StringEquals:
                  s3:x-amz-acl: "bucket-owner-full-control"
    CloudTrailTopic: 
      DependsOn: 
        - CloudTrailProcessRole
      Type: "AWS::SNS::Topic"
      Properties: 
        DisplayName: ${self:service}-${self:provider.stage}-topic
        TopicName: ${self:service}-${self:provider.stage}-topic
    CloudTrailTopicPolicy: 
      Type: "AWS::SNS::TopicPolicy"
      Properties: 
        Topics: 
          - Ref: "CloudTrailTopic"
        PolicyDocument: 
          Version: "2008-10-17"
          Statement: 
            - 
              Sid: "AWSCloudTrailSNSPolicy"
              Effect: "Allow"
              Principal: 
                Service: "cloudtrail.amazonaws.com"
              Resource: "*"
              Action: "SNS:Publish"
    CloudTrail: 
      DependsOn: 
        - CloudTrailS3Bucket
        - CloudTrailBucketPolicy
        - CloudTrailTopic
        - CloudTrailTopicPolicy
      Type: "AWS::CloudTrail::Trail"
      Properties: 
        S3BucketName: ${self:custom.environment.newctbucket}
        IsLogging: true
        SnsTopicName: ${self:service}-${self:provider.stage}-topic
        EnableLogFileValidation: true
        IsMultiRegionTrail: true
        IncludeGlobalServiceEvents: true
        TrailName: ${self:service}-${self:provider.stage}
  Outputs: